The catalog
Browse Reproductions
220 verified reproductions
Popular records
Top viewed reproduction records
Frequently opened evidence pages with direct links to runnable proof and permanent REPRO IDs.
REPRO-2026-00294 WordPress 7.0.1 pre-auth fresh-administrator chain to RCE REPRO-2026-00297 JFrog Artifactory privilege escalation allowing low-privileged users to obtain elevated permissions REPRO-2026-00306 fastjson2 AutoType type-resolution flaw may lead to remote code execution REPRO-2026-00319 MariaDB Galera SST remote_auth shell command injection (wsrep_shell_char blacklist bypass) — candidate for v12sec 2026-07-31 0day REPRO-2026-00308 NGINX ASLR-enabled network RCE REPRO-2026-00307 vBulletin runtime template runMaths pre-auth RCE
220 reproductions
REPRO-2026-00085 published
Pillow 10.3.0–12.1.0 allows an out-of-bounds write when loading specially crafted PSD images, potentially leading to memory corruption.
GHSA-CFH3-3JMP-RVHC Security
Variant found
3m 16s Feb 13, 2026
REPRO-2026-00084 published
Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
CVE-2025-64712 critical Security
Variant found
pypi
unstructured
4m 50s Feb 13, 2026
REPRO-2026-00080 published
Docling-core YAML Deserialization RCE via FullLoader
CVE-2026-24009 high Security
Variant found
pip
docling-core
6m 1s Feb 13, 2026
REPRO-2026-00078 published
vLLM RCE via auto_map dynamic module loading
CVE-2026-22807 high Security pip
vllm
19m 50s Jan 22, 2026
REPRO-2026-00077 published
GNU InetUtils telnetd Remote Authentication Bypass
critical Security gnu
inetutils
35m 50s Jan 21, 2026
REPRO-2026-00076 published
MCP Server Git: Path Traversal via Missing Repository Path Validation
CVE-2025-68145 critical Security pip
mcp-server-git
11m 29s Jan 21, 2026
REPRO-2026-00072 published
Apache bRPC: Remote Command Injection in Heap Profiler
CVE-2025-60021 critical Security cpp
brpc
47m 53s Jan 21, 2026
REPRO-2026-00070 published
wlc: Path traversal via unsanitized API slugs in download command
CVE-2026-23535 high Security pip
wlc
20m 59s Jan 17, 2026
REPRO-2026-00067 published
Svelte XSS via textarea bind:value in SSR
GHSA-gw32-9rmw-qwww high Security npm
svelte
8m 49s Jan 17, 2026
REPRO-2026-00066 published
Skipper Lua Filter Arbitrary Code Execution
GHSA-cc8m-98fm-rc9g high Security go
github.com/zalando/skipper
9m 5s Jan 17, 2026
REPRO-2026-00065 published
node-tar Arbitrary File Overwrite via Hardlink Escape
GHSA-8qq5-rm4j-mr97 high Security npm
tar
6m 8s Jan 17, 2026
REPRO-2026-00064 published
node-tar Arbitrary File Overwrite via Hardlink Escape
GHSA-8qq5-rm4j-mr97 high Security npm
tar
6m 8s Jan 17, 2026
REPRO-2026-00063 published
deepdiff: Class Pollution RCE via Delta Tuple Path Bypass
CVE-2025-58367 critical Security pip
deepdiff
1m 7s Jan 13, 2026
REPRO-2026-00062 published
langgraph-checkpoint: Constructor Deserialization RCE in JsonPlusSerializer
CVE-2025-64439 high Security pip
langgraph-checkpoint
1m 7s Jan 12, 2026
REPRO-2026-00061 published
python-socketio: Pickle Deserialization RCE in PubSub Manager
CVE-2025-61765 medium Security pip
python-socketio
1m 5s Jan 12, 2026
REPRO-2026-00054 published
Craft CMS: Unauthenticated Database Backup Trigger
CVE-2025-68456 critical Security composer
craftcms/cms
36m 45s Jan 8, 2026
REPRO-2026-00052 published
ComfyUI-Manager: Configuration File Exposure via Web-Accessible Path
CVE-2025-67303 high Security pip
ComfyUI-Manager
11m 32s Jan 8, 2026
REPRO-2026-00045 published
BentoML RCE via Insecure Deserialization
CVE-2025-27520 critical Security pip
bentoml
16m 37s Jan 7, 2026
REPRO-2026-00044 published
jsPDF Local File Inclusion/Path Traversal in Node.js builds
CVE-2025-68428 high Security npm
jspdf
8m 13s Jan 7, 2026
REPRO-2026-00001 published
Setuptools Path Traversal via PackageIndex.download
CVE-2025-47273 high Security pip
setuptools
14m 9s Jan 7, 2026