Skip to content

The catalog

Browse CVE Reproductions

197 verified reproductions

RSS Feed

Popular records

Top viewed reproduction records

Frequently opened evidence pages with direct links to runnable proof and permanent REPRO IDs.

REPRO-2026-00294 WordPress 7.0.1 pre-auth fresh-administrator chain to RCE CVE-2026-63030 / critical / WordPress Core REPRO-2026-00297 JFrog Artifactory privilege escalation allowing low-privileged users to obtain elevated permissions high / Artifactory REPRO-2026-00306 fastjson2 AutoType type-resolution flaw may lead to remote code execution critical / alibaba/fastjson2 REPRO-2026-00319 MariaDB Galera SST remote_auth shell command injection (wsrep_shell_char blacklist bypass) — candidate for v12sec 2026-07-31 0day critical / MariaDB/server REPRO-2026-00308 NGINX ASLR-enabled network RCE CVE-2026-42533 / critical / nginx/nginx REPRO-2026-00307 vBulletin runtime template runMaths pre-auth RCE CVE-2026-61511 / critical / vBulletin

197 reproductions

Clear filters
Active CVE
REPRO-2026-00318 published

mcp-toolbox authorization bypass: unauthenticated tool invocation via direct HTTP API

CVE-2026-14537 high Security Known vulnerability github
googleapis/genai-toolbox
37m 46s Aug 1, 2026
REPRO-2026-00317 published

Rails Active Storage variant processing arbitrary file read and potential RCE

CVE-2026-66066 critical Security Known vulnerability github
rails/rails
148m 42s Aug 1, 2026
REPRO-2026-00316 published

marimo Pre-Auth RCE via Terminal WebSocket Authentication Bypass (/terminal/ws missing validate_auth)

CVE-2026-39987 critical Security Known vulnerability github
marimo
24m 19s Jul 30, 2026
REPRO-2026-00315 published

Unauthenticated RCE in ruflo MCP bridge default docker-compose deployment

CVE-2026-59726 critical Security Known vulnerability npm
ruflo
34m 45s Jul 30, 2026
REPRO-2026-00314 published

OpenCTI authentication bypass via user impersonation

CVE-2026-27960 critical Security Known vulnerability docker
opencti
44m 34s Jul 30, 2026
REPRO-2026-00312 published

Gitea diffpatch Git hook installation leads to remote code execution

CVE-2026-60004 critical Security Known vulnerability github
go-gitea/gitea
30m 6s Jul 29, 2026
REPRO-2026-00311 published

xrdp Xvnc backend authentication issue on RHEL 9

CVE-2026-55626 high Security Known vulnerability github
neutrinolabs/xrdp
64m 30s Jul 29, 2026
REPRO-2026-00310 published

Flowise arbitrary file access via unvalidated chatflowId/chatId

CVE-2025-71334 critical Security Known vulnerability npm
FlowiseAI/Flowise
66m 57s Jul 28, 2026
REPRO-2026-00309 published

PipeWire sandbox escape via malicious library loading in PulseAudio compatibility layer

CVE-2026-5674 high Security Known vulnerability
pipewire (pipewire-pulse daemon)
88m 8s Jul 28, 2026
REPRO-2026-00308 published

NGINX ASLR-enabled network RCE

CVE-2026-42533 critical Security Known vulnerability github
nginx/nginx
71m 44s Jul 27, 2026
REPRO-2026-00307 published

vBulletin runtime template runMaths pre-auth RCE

CVE-2026-61511 critical Security Discovery hunt
vBulletin
139m 11s Jul 27, 2026
REPRO-2026-00305 published

SiYuan missing authorization in /mcp enables unauthenticated administrator takeover via Publish proxy

CVE-2026-66012 critical Security Known vulnerability github
siyuan
171m 57s Jul 27, 2026
REPRO-2026-00304 published

NoteGen chat preview XSS via unsanitized HTML rendering before 0.32.0

CVE-2026-17496 high Security Known vulnerability github
note-gen
78m 29s Jul 27, 2026
REPRO-2026-00303 published

AWS API MCP Server security policy bypass via startup initialization failure

CVE-2026-16584 high Security Known vulnerability pip
awslabs.aws-api-mcp-server
29m 52s Jul 27, 2026
REPRO-2026-00302 published

datamodel-code-generator code injection via customBasePath before 0.70.0

CVE-2026-63720 high Security Known vulnerability pip
datamodel-code-generator
13m 44s Jul 27, 2026
REPRO-2026-00300 published

OpenRemote console registration authentication bypass via known asset identifier

CVE-2026-66013 critical Security Known vulnerability github
openremote
35m 36s Jul 27, 2026
REPRO-2026-00294 published

WordPress 7.0.1 pre-auth fresh-administrator chain to RCE

CVE-2026-63030 critical Security Variant found Known vulnerability
WordPress Core
65m 17s Jul 19, 2026
REPRO-2026-00293 published

Metabase arbitrary code execution via unsafe H2 connection property validation bypass

CVE-2026-59826 critical Security Variant found Known vulnerability github
metabase/metabase
92m 57s Jul 17, 2026
REPRO-2026-00292 published

websocket-driver: message corruption via abuse of draft-WebSocket length headers

CVE-2026-54466 critical Security Variant found Known vulnerability npm
faye/websocket-driver-node
7m 28s Jul 16, 2026
REPRO-2026-00291 published

systeminformation networkInterfaces() Linux source-directive command injection

CVE-2026-50289 high Security Variant found Known vulnerability github
sebhildebrandt/systeminformation
14m 44s Jul 16, 2026