Skip to content

The catalog

Browse GHSA Reproductions

85 verified reproductions

RSS Feed

Popular records

Top viewed reproduction records

Frequently opened evidence pages with direct links to runnable proof and permanent REPRO IDs.

REPRO-2026-00356 WordPress Core unauthenticated path traversal in get_page_template() page-template resolution leading to conditional RCE CVE-2026-87902 / critical / WordPress/wordpress-develop REPRO-2026-00354 GitLab CE/EE unauthenticated path traversal in Repository Commits API leads to arbitrary file read CVE-2026-85706 / critical / gitlab REPRO-2026-00341 JFrog Artifactory critical unauthenticated authentication bypass leading to administrative takeover CVE-2026-82329 / critical / JFrog Artifactory REPRO-2026-00357 Next.js next/og ImageResponse RCE via Satori improper SVG escaping (critical) CVE-2026-94545 / critical / next REPRO-2026-00337 Keycloak reset-credentials flow: unauthenticated account takeover (CWE-640) CVE-2026-18963 / critical / org.keycloak:keycloak-services (Maven) REPRO-2026-00355 ArangoDB full-chain: unauthenticated %5f URL auth bypass (GHSA-rrgq-978q-36mq) + client-controlled isSystem task escalation (GHSA-rvhw-4hpw-9vrx) -> root-context file write -> host RCE critical / ArangoDB server

85 reproductions

Clear filters
Active GHSA
REPRO-2026-00357 published

Next.js next/og ImageResponse RCE via Satori improper SVG escaping (critical)

CVE-2026-94545 critical Security Known vulnerability npm
next
84m 10s Sep 23, 2026
REPRO-2026-00356 published

WordPress Core unauthenticated path traversal in get_page_template() page-template resolution leading to conditional RCE

CVE-2026-87902 critical Security Known vulnerability github
WordPress/wordpress-develop
67m 36s Sep 22, 2026
REPRO-2026-00352 published

Traefik digestAuth middleware gives empty secret to unknown usernames → auth bypass

CVE-2026-85595 high Security Known vulnerability github
traefik/traefik
65m 40s Sep 11, 2026
REPRO-2026-00339 published

bubblewrap: sandbox escape via /oldroot symlink traversal during setup — files created on host

GHSA-PXHW-H44J-8PFX high Security Known vulnerability
bubblewrap
18m 28s Aug 26, 2026
REPRO-2026-00338 published

Apache Log4j2 serialized LogEvent filter bypass to conditional RCE

GHSA-LOG4J2-4255-MARSHALLEDOBJECT critical Security Known vulnerability maven
org.apache.logging.log4j:log4j-core
73m 31s Aug 26, 2026
REPRO-2026-00296 published

Reported Horilla protected_media Referer authentication bypass

GHSA-9WJX-4J4R-FF8W high Security Variant found Known vulnerability github
horilla/horilla-hr
77m 9s Jul 26, 2026
REPRO-2026-00295 published

Horilla HRMS protected_media path traversal enables outside-root file read

GHSA-x52c-5hrq-76pq high Security Variant found Known vulnerability github
horilla/horilla-hr
87m 3s Jul 25, 2026
REPRO-2026-00283 published

Nuclio cron trigger shell command injection leading to RCE

CVE-2026-52831 critical Security Variant found go
github.com/nuclio/nuclio
89m 0s Jul 11, 2026
REPRO-2026-00274 published

@better-auth/sso <1.6.11 allows non-blind SSRF via unvalidated OIDC endpoint URLs during SSO provider registration, with potential account takeover when trustEmailVerified is enabled.

CVE-2026-53513 critical Security Variant found npm
@better-auth/sso
30m 49s Jul 8, 2026
REPRO-2026-00273 published

Vtiger CRM through 8.4.0 allows authenticated admin users to achieve remote code execution by uploading a crafted module ZIP that places PHP files in the web-accessible modules/ directory.

CVE-2026-23698 high Security Variant found other
Vtiger CRM
33m 54s Jul 8, 2026
REPRO-2026-00272 published

EGroupware contains an authorization bypass in SmallPartMediaRecorder::ajax_upload combined with arbitrary file write and file read primitives, enabling authenticated (or self-registered) attackers to overwrite header.inc.php and achieve remote code execution.

CVE-2026-27823 critical Security Variant found Composer
egroupware/egroupware
78m 4s Jul 8, 2026
REPRO-2026-00264 published

Apache Camel camel-docling improperly validates custom CLI arguments, enabling argument injection and path traversal when untrusted data is mapped into docling invocation headers.

CVE-2026-40047 critical Security Variant found Maven
apache/camel
41m 23s Jul 7, 2026
REPRO-2026-00186 published

libssh2 via curl: malformed SSH packet length crashes SFTP client

CVE-2026-55200 critical Security c
libssh2
11m 23s Jun 25, 2026
REPRO-2026-00185 published

HashiCorp Nomad: path traversal in host volume plugin loader → client-host RCE

CVE-2026-7474 high Security Variant found go
nomad
48m 9s May 28, 2026
REPRO-2026-00183 published

MapServer: heap-buffer-overflow in SLD Categorize parser (msSLDParseRasterSymbolizer)

CVE-2026-33721 medium Security Variant found c
mapserver
14m 33s May 28, 2026
REPRO-2026-00170 published

jq: integer overflow in jv_string_concat triggers heap buffer overflow on large strings

CVE-2026-32316 high Security Variant found github
jq
32m 33s May 28, 2026
REPRO-2026-00159 published

libheif: heap-buffer-overflow write decoding 1x4 grid of odd-height tiles

CVE-2026-32740 high Security Variant found c
libheif
41m 53s May 23, 2026
REPRO-2026-00158 published

goshs: PUT upload accepts cross-origin requests without CSRF token

CVE-2026-42091 medium Security Variant found go
github.com/patrickhener/goshs
35m 17s May 23, 2026
REPRO-2026-00157 published

Fiber v3: cache middleware key collision leaks responses across different query strings

CVE-2026-30246 medium Security Variant found go
github.com/gofiber/fiber/v3
27m 11s May 23, 2026
REPRO-2026-00156 published

Yii2: local file inclusion via View::renderPhpFile extract() of caller-controlled params

CVE-2026-39850 high Security Variant found composer
yiisoft/yii2
15m 11s May 23, 2026