Skip to content

The catalog

Browse Reproductions

276 verified reproductions

RSS Feed

Popular records

Top viewed reproduction records

Frequently opened evidence pages with direct links to runnable proof and permanent REPRO IDs.

REPRO-2026-00356 WordPress Core unauthenticated path traversal in get_page_template() page-template resolution leading to conditional RCE CVE-2026-87902 / critical / WordPress/wordpress-develop REPRO-2026-00354 GitLab CE/EE unauthenticated path traversal in Repository Commits API leads to arbitrary file read CVE-2026-85706 / critical / gitlab REPRO-2026-00341 JFrog Artifactory critical unauthenticated authentication bypass leading to administrative takeover CVE-2026-82329 / critical / JFrog Artifactory REPRO-2026-00357 Next.js next/og ImageResponse RCE via Satori improper SVG escaping (critical) CVE-2026-94545 / critical / next REPRO-2026-00337 Keycloak reset-credentials flow: unauthenticated account takeover (CWE-640) CVE-2026-18963 / critical / org.keycloak:keycloak-services (Maven) REPRO-2026-00355 ArangoDB full-chain: unauthenticated %5f URL auth bypass (GHSA-rrgq-978q-36mq) + client-controlled isSystem task escalation (GHSA-rvhw-4hpw-9vrx) -> root-context file write -> host RCE critical / ArangoDB server

276 reproductions

REPRO-2026-00295 published

Horilla HRMS protected_media path traversal enables outside-root file read

GHSA-x52c-5hrq-76pq high Security Variant found Known vulnerability github
horilla/horilla-hr
87m 3s Jul 25, 2026
REPRO-2026-00294 published

WordPress 7.0.1 pre-auth fresh-administrator chain to RCE

CVE-2026-63030 critical Security Variant found Known vulnerability
WordPress Core
65m 17s Jul 19, 2026
REPRO-2026-00293 published

Metabase arbitrary code execution via unsafe H2 connection property validation bypass

CVE-2026-59826 critical Security Variant found Known vulnerability github
metabase/metabase
92m 57s Jul 17, 2026
REPRO-2026-00292 published

websocket-driver: message corruption via abuse of draft-WebSocket length headers

CVE-2026-54466 critical Security Variant found Known vulnerability npm
faye/websocket-driver-node
7m 28s Jul 16, 2026
REPRO-2026-00291 published

systeminformation networkInterfaces() Linux source-directive command injection

CVE-2026-50289 high Security Variant found Known vulnerability github
sebhildebrandt/systeminformation
14m 44s Jul 16, 2026
REPRO-2026-00290 published

ToolHive SSRF in remote MCP server authentication discovery

CVE-2026-58196 medium Security Variant found Known vulnerability github
github.com/stacklok/toolhive
43m 47s Jul 16, 2026
REPRO-2026-00289 published

Spinnaker Kustomize bake unsafe YAML tag processing leading to RCE

CVE-2026-55175 high Security Variant found Known vulnerability github
spinnaker/spinnaker
15m 51s Jul 15, 2026
REPRO-2026-00288 published

Horde VFS < 3.0.1 OS command injection via Horde_Vfs_Smb driver

CVE-2026-60102 high Security Variant found github
horde/vfs
12m 50s Jul 14, 2026
REPRO-2026-00287 published

Apache APISIX jwt-auth authentication bypass via algorithm confusion

CVE-2026-39999 critical Security Variant found github
apache/apisix
14m 33s Jul 14, 2026
REPRO-2026-00286 published

Log4j MapMessage emits invalid JSON for non-finite values

CVE-2026-49844 medium Security Variant found maven
org.apache.logging.log4j:log4j-api
11m 14s Jul 13, 2026
REPRO-2026-00285 published

Samba’s printing subsystem allows OS command injection via unescaped job description (%J), enabling remote code execution through crafted print jobs.

CVE-2026-4480 critical Security Variant found generic
samba-team/samba
28m 55s Jul 13, 2026
REPRO-2026-00284 published

XRING: Alibaba XQUIC QPACK ring-buffer resize underflow

high Security Variant found github
Alibaba XQUIC
20m 53s Jul 11, 2026
REPRO-2026-00283 published

Nuclio cron trigger shell command injection leading to RCE

CVE-2026-52831 critical Security Variant found go
github.com/nuclio/nuclio
89m 0s Jul 11, 2026
REPRO-2026-00282 published

Apache Tomcat partial PUT session deserialization RCE

CVE-2025-24813 critical Security maven
Apache Tomcat
42m 34s Jul 11, 2026
REPRO-2026-00281 published

Apache Kafka SASL/OAUTHBEARER accepts unvalidated JWTs

CVE-2026-33557 critical Security Variant found maven
Apache Kafka
44m 25s Jul 11, 2026
REPRO-2026-00280 published

Apache Tomcat examples app XSS in numguess.jsp

CVE-2026-50229 medium Security Variant found github
apache/tomcat
16m 6s Jul 9, 2026
REPRO-2026-00279 published

Apache OpenNLP SvmDoccatModel unsafe deserialization

CVE-2026-43825 high Security Variant found github
apache/opennlp
14m 59s Jul 9, 2026
REPRO-2026-00278 published

libcurl HTTP/2 stream-dependency tree use-after-free

CVE-2026-10536 critical Security Variant found github
curl/libcurl
22m 30s Jul 9, 2026
REPRO-2026-00277 published

Apache Airflow DAG author RCE via unrestricted import_string() in BaseSerialization.deserialize()

CVE-2026-33264 critical Security Variant found github
apache/airflow
16m 12s Jul 9, 2026
REPRO-2026-00276 published

Apache Gravitino unauthenticated H2 JDBC URL injection via testConnection API

CVE-2026-41042 critical Security Variant found github
apache/gravitino
22m 47s Jul 9, 2026