The catalog
Browse GHSA Reproductions
82 verified reproductions
Popular records
Top viewed reproduction records
Frequently opened evidence pages with direct links to runnable proof and permanent REPRO IDs.
REPRO-2026-00294 WordPress 7.0.1 pre-auth fresh-administrator chain to RCE REPRO-2026-00297 JFrog Artifactory privilege escalation allowing low-privileged users to obtain elevated permissions REPRO-2026-00306 fastjson2 AutoType type-resolution flaw may lead to remote code execution REPRO-2026-00319 MariaDB Galera SST remote_auth shell command injection (wsrep_shell_char blacklist bypass) — candidate for v12sec 2026-07-31 0day REPRO-2026-00308 NGINX ASLR-enabled network RCE REPRO-2026-00307 vBulletin runtime template runMaths pre-auth RCE
82 reproductions
Clear filters Active GHSA
REPRO-2026-00110 published
Deno Command Injection via Incomplete Metacharacter Blocklist
CVE-2026-27190 high Security rust
deno
10m 5s Feb 20, 2026
REPRO-2026-00109 published
Feathers OAuth Open Redirect Account Takeover
CVE-2026-27191 medium Security npm
@feathersjs/authentication-oauth
12m 54s Feb 20, 2026
REPRO-2026-00108 published
Zumba JSON Serializer PHP Object Injection
CVE-2026-27206 high Security composer
zumba/json-serializer
11m 26s Feb 20, 2026
REPRO-2026-00107 published
Swiper Prototype Pollution
CVE-2026-27212 high Security npm
swiper
10m 21s Feb 20, 2026
REPRO-2026-00106 published
Dagu Unauthenticated RCE via Inline DAG Spec
GHSA-6qr9-g2xw-cw92 critical Security go
github.com/dagu-org/dagu
18m 38s Feb 20, 2026
REPRO-2026-00105 published
Fabric.js: Stored XSS via SVG Export
CVE-2026-27013 high Security npm
fabric
16m 24s Feb 19, 2026
REPRO-2026-00104 published
systeminformation: Command Injection via WiFi Interface Parameter
CVE-2026-26280 high Security npm
systeminformation
19m 36s Feb 19, 2026
REPRO-2026-00103 published
jsPDF: PDF Object Injection via Unsanitized addJS Input
CVE-2026-25755 high Security npm
jspdf
14m 30s Feb 19, 2026
REPRO-2026-00102 published
jsPDF: PDF Injection in AcroForm RadioButton allows JS Execution
CVE-2026-25940 high Security npm
jspdf
23m 38s Feb 19, 2026
REPRO-2026-00101 published
LibreNMS: Time-Based Blind SQL Injection in address-search
CVE-2026-26990 high Security composer
librenms/librenms
11m 33s Feb 19, 2026
REPRO-2026-00100 published
systeminformation: Command Injection via locate Output
CVE-2026-26318 high Security npm
systeminformation
18m 44s Feb 19, 2026
REPRO-2026-00099 published
Semantic Kernel: RCE via InMemoryVectorStore Filter
CVE-2026-26030 critical Security pip
semantic-kernel
25m 13s Feb 19, 2026
REPRO-2026-00098 published
SandboxJS: Host Prototype Pollution via Array Intermediary (Sandbox Escape)
CVE-2026-25881 critical Security npm
@nyariv/sandboxjs
16m 1s Feb 19, 2026
REPRO-2026-00097 published
CASL Ability: Prototype Pollution via Condition Handling
CVE-2026-1774 critical Security npm
@casl/ability
6m 19s Feb 19, 2026
REPRO-2026-00096 published
Milvus: Unauthenticated Access to Restful API on Metrics Port Leading to System Compromise
CVE-2026-26190 critical Security go
github.com/milvus-io/milvus
16m 18s Feb 19, 2026
REPRO-2026-00095 published
Known CMS: Account Takeover via Password Reset Token Leakage
CVE-2026-26273 critical Security composer
idno/known
17m 40s Feb 19, 2026
REPRO-2026-00094 published
OpenClaw: Path Traversal in Plugin Installation
GHSA-qrq5-wjgg-rvqw critical Security npm
openclaw
7m 36s Feb 19, 2026
REPRO-2026-00093 published
Crawl4AI: Remote Code Execution in Docker API via Hooks Parameter
CVE-2026-26216 critical Security pip
Crawl4AI
10m 34s Feb 19, 2026
REPRO-2026-00092 published
Payload CMS: Blind SQL Injection in JSON/RichText Queries via Drizzle Adapters
CVE-2026-25544 critical Security npm
@payloadcms/drizzle
15m 33s Feb 19, 2026
REPRO-2026-00091 published
Ghost CMS: Unauthenticated SQL Injection in Content API Slug Filter
CVE-2026-26980 critical Security npm
ghost
4m 15s Feb 19, 2026