CVE-2026-31431

CVE-2026-31431 LPE PoC Rust Implementation This project is a Proof of Concept PoC implemented in Rust for a local privilege escalation LPE vulnerability simulating CVE-2026-31431. It demonstrates how to manipulate the Linux kernel page cache by exploiting the Crypto API.cite: 1, 2 !CAUTION This...

EUVD-2026-102200

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

CVE-2026-100409

The OpenNext Cloudflare adapter (versions 0.3.0 through 1.20.2 ) is vulnerable to an authorization bypass when enableCacheInterception is active. The root cause is an inconsistency in how encoded pathnames are processed between middleware matching and cache lookup. An unauthenticated attacker can...

CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

CVE-2026-102527

The Nuxt OG Image module is vulnerable to a cache poisoning attack in versions 6.2.5 through 6.7.0 . The root cause is that the dynamic /_og/d/*.png route accepts unsigned requests, and the resolvePathCacheKey() function generates cache keys from request paths and rendering options exposed via im...

CVE-2022-28368

CVE-2022-28368 - Dompdf RCE Dompdf RCE PoC Exploit alt text ExploitDB Dompdf versions 1.2.1 are vulnerable to Remote Code Execution RCE by injecting CSS into the data. The file can be tricked into storing a malicious font with a .php file extension in its font cache, which can later be executed b...

CVE-2026-31431-poc

Copy Fail Command PoC Wrapper A small modified proof-of-concept wrapper for Copy Fail / CVE-2026-31431 that allows passing a custom command from the terminal instead of always launching an interactive root shell so it can be ran in an none interactive environment such as a web shell. This project...

copy-fail-tiny-elf-CVE-2026-31431

Copy Fail Tiny ELF - CVE-2026-31431 Minimal 436-bytes exploit for Copy Fail, thanks to the power of golfing Magic This ELF ultra golfs the exploit by being totally unmapped, rwx, and by using itself conditionally as the ELF payload to use to poison the cache. More cursed ELF internals golfs comin...

DirtyClone

DirtyClone CVE-2026-43503 - Python PoC Non-official Python port of DirtyClone — a Linux kernel local privilege escalation vulnerability. This repository contains a working Proof of Concept that allows an unprivileged local user to gain root privileges by exploiting page-cache corruption via clone...

copyfail-rs

copyfail-rs Rust implementation of CVE-2026-31431 Copy Fail — a Linux kernel page-cache write primitive via AFALG splice. 中文文档 / Chinese README CVE-2026-31431 The Linux kernel's algifaead implementation allows an unprivileged user to write arbitrary data into the page cache of any readable file v...

Dirty-Frag-Analysis

Dirty Frag Deep Technical Analysis CVE-2026-43284 xfrm-ESP / CVE-2026-43500 RxRPC Linux kernel local privilege escalation vulnerability — PoC reverse engineering · Shellcode breakdown · Patch principles · Detection script Vulnerability Overview Dirty Frag exploits two independent vulnerabilities,...

CVE-2026-3844

CVE-2026-3844 Breeze Cache ≤ 2.4.4 - Unauthenticated Arbitrary File Upload ⚠️ Disclaimer THIS TOOL IS PROVIDED FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES ONLY. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission to test. The...

CVE-2026-31431

CVE-2026-31431 - Copy Fail PoC Educational Proof of Concept for CVE-2026-31431 , also known as Copy Fail , a Linux kernel local privilege escalation vulnerability involving the AFALG / algifaead cryptographic interface. !WARNING This repository is provided strictly for educational, defensive, and...

CVE-2026-53365

CVE-2026-53365 — VsockDrop:iouring + AFVSOCK Zero-Copy Reference Count Underflow, Page-Cache Overwrite Privilege Escalation HackSpeak distribution mirror. This repository is a distribution mirror of MaherAzzouzi/vsockdrop , with code identical to upstream; upstream does not include a LICENSE, so...

CVE-2026-46300_Fragnesia

🧨 Fragnesia — CVE-2026-46300 Linux Kernel LPE Audit & Exploit Toolkit · Page-Cache / XFRM ESP-in-TCP espintcp Regression Interactive audit → LPE prerequisite detection → Automated exploit execution after confirmation ⚠️ Ethical & Legal Warning This tool is intended solely for legitimate and...

CVE-2026-1010-WebSocket-Connection-Smuggling-via-Malformed-Upgrade-Header

CVE-2026-1010 – WebSocket Connection Smuggling Overview A reverse proxy and backend disagree on how to parse an HTTP request with a malformed WebSocket upgrade header. The proxy treats it as one request, while the backend interprets it as two, allowing an attacker to smuggle a hidden request. Thi...

dompdf-rce

RCE exploit for dompdf This repository contains a vulnerable demo application using dompdf 1.2.0 and an exploit that achieves remote code execution via a ttf+php polyglot file. For more details, please visit https://positive.security/blog/dompdf-rce Instructions 1. Run the demo application $ cd...

CVE-2024-44000-LiteSpeed-Cache

Poc LiteSpeed Cache CVE-2024-44000 Exploit CVE-2024-44000 is a vulnerability in the LiteSpeed Cache plugin, a popular WordPress plugin. This vulnerability affects session management in LiteSpeed Cache, allowing attackers to gain unauthorized access to sensitive data. The script works in the...

CVE-2026-18040

A flaw was found in Bouncy Castle. The Hamming Quasi-Cyclic HQC cryptographic algorithm leaks secret data through memory cache access patterns and execution timing variations during key encapsulation and decapsulation operations. A local attacker capable of monitoring cache activity or measuring...

CVE-2023-6063-PoC

CVE-2023-6063 PoC Reference Unauthenticated SQL Injection Vulnerability Addressed in WP Fastest Cache 1.2.2 | WPScan Plugin setting Enable "WP Fastest Cache". PoC The "wordpressloggedin" cookie parameter is vulnerable. $ python sqlmap.py --dbms=mysql -u "http://127.0.0.1/wp-login.php"...