The catalog
Browse CVE Reproductions
197 verified reproductions
Popular records
Top viewed reproduction records
Frequently opened evidence pages with direct links to runnable proof and permanent REPRO IDs.
REPRO-2026-00294 WordPress 7.0.1 pre-auth fresh-administrator chain to RCE REPRO-2026-00297 JFrog Artifactory privilege escalation allowing low-privileged users to obtain elevated permissions REPRO-2026-00306 fastjson2 AutoType type-resolution flaw may lead to remote code execution REPRO-2026-00319 MariaDB Galera SST remote_auth shell command injection (wsrep_shell_char blacklist bypass) — candidate for v12sec 2026-07-31 0day REPRO-2026-00308 NGINX ASLR-enabled network RCE REPRO-2026-00307 vBulletin runtime template runMaths pre-auth RCE
197 reproductions
Clear filters Active CVE
REPRO-2026-00089 published
pyca/cryptography SECT curve public key parsing lacks subgroup validation, enabling small-subgroup attacks that leak ECDH private key bits and allow ECDSA signature forgery.
CVE-2026-26007 medium Security
Variant found
cryptography (pip)
6m 32s Feb 15, 2026
REPRO-2026-00087 published
Apache Druid basic security LDAP authenticator can be bypassed when the LDAP server allows anonymous binds, permitting login with any existing username and an empty password.
CVE-2026-23906 critical Security
Variant found
Maven
org.apache.druid.extensions:druid-basic-security
48m 55s Feb 13, 2026
REPRO-2026-00086 published
RAGFlow MinerU parser Zip Slip allows arbitrary file overwrite and potential RCE via malicious ZIP archives.
CVE-2026-24770 critical Security
Variant found
pip (per GitHub advisory)
ragflow (RAGFlow)
8m 19s Feb 13, 2026
REPRO-2026-00084 published
Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
CVE-2025-64712 critical Security
Variant found
pypi
unstructured
4m 50s Feb 13, 2026
REPRO-2026-00080 published
Docling-core YAML Deserialization RCE via FullLoader
CVE-2026-24009 high Security
Variant found
pip
docling-core
6m 1s Feb 13, 2026
REPRO-2026-00078 published
vLLM RCE via auto_map dynamic module loading
CVE-2026-22807 high Security pip
vllm
19m 50s Jan 22, 2026
REPRO-2026-00076 published
MCP Server Git: Path Traversal via Missing Repository Path Validation
CVE-2025-68145 critical Security pip
mcp-server-git
11m 29s Jan 21, 2026
REPRO-2026-00072 published
Apache bRPC: Remote Command Injection in Heap Profiler
CVE-2025-60021 critical Security cpp
brpc
47m 53s Jan 21, 2026
REPRO-2026-00070 published
wlc: Path traversal via unsanitized API slugs in download command
CVE-2026-23535 high Security pip
wlc
20m 59s Jan 17, 2026
REPRO-2026-00063 published
deepdiff: Class Pollution RCE via Delta Tuple Path Bypass
CVE-2025-58367 critical Security pip
deepdiff
1m 7s Jan 13, 2026
REPRO-2026-00062 published
langgraph-checkpoint: Constructor Deserialization RCE in JsonPlusSerializer
CVE-2025-64439 high Security pip
langgraph-checkpoint
1m 7s Jan 12, 2026
REPRO-2026-00061 published
python-socketio: Pickle Deserialization RCE in PubSub Manager
CVE-2025-61765 medium Security pip
python-socketio
1m 5s Jan 12, 2026
REPRO-2026-00054 published
Craft CMS: Unauthenticated Database Backup Trigger
CVE-2025-68456 critical Security composer
craftcms/cms
36m 45s Jan 8, 2026
REPRO-2026-00052 published
ComfyUI-Manager: Configuration File Exposure via Web-Accessible Path
CVE-2025-67303 high Security pip
ComfyUI-Manager
11m 32s Jan 8, 2026
REPRO-2026-00045 published
BentoML RCE via Insecure Deserialization
CVE-2025-27520 critical Security pip
bentoml
16m 37s Jan 7, 2026
REPRO-2026-00044 published
jsPDF Local File Inclusion/Path Traversal in Node.js builds
CVE-2025-68428 high Security npm
jspdf
8m 13s Jan 7, 2026
REPRO-2026-00001 published
Setuptools Path Traversal via PackageIndex.download
CVE-2025-47273 high Security pip
setuptools
14m 9s Jan 7, 2026