All CVE Labs
Every real, disclosed CVE reproduced as a local lab on this site, newest first.
CVE-2026-68771: ComfyUI Unauthenticated RCE via Pickle Deserialization
An unauthenticated upload endpoint and a node that deserializes whatever lands in a folder combine into remote code execution with no login at all.
CVE-2026-65008: Grav CMS Authenticated RCE via Blueprint Callable Injection
What it actually takes to adapt a published PoC when it was written against an admin interface your target doesn't run.
CVE-2026-63720: datamodel-code-generator customBasePath Code Injection RCE
A code generator trusts a schema field enough to paste it, unescaped, into the Python module it writes — and that module runs on import.
CVE-2026-63030: WordPress Core Pre-Auth Admin Takeover ("wp2shell")
Two chained bugs in WordPress core, no plugin involved, combine into unauthenticated administrator account creation — actively exploited right now.
CVE-2026-62183: Apache Syncope Privilege Escalation
A self-service API endpoint in Apache Syncope lets any authenticated user grant themselves admin-level roles.
CVE-2026-53595: FreeScout Account Takeover
A MySQL trailing-space quirk in a hash comparison is enough to let an attacker take over any FreeScout account, no authentication required.
CVE-2026-53264: Linux Kernel net/sched Use-After-Free
A disposable-VM lab for a real, AI-assisted Linux kernel 0-day — how a use-after-free race in net/sched's traffic-control actions turns an unprivileged shell into root.
CVE-2026-34197: Apache ActiveMQ Jolokia RCE
A JMX management bridge in Apache ActiveMQ turns a single authenticated API call into arbitrary code execution — actively exploited in the wild.
CVE-2026-20253: Splunk Enterprise Unauthenticated File Write Endpoint
A pre-auth endpoint on Splunk's PostgreSQL Sidecar Service returns the exact signature a public detection tool checks for — CVSS 9.8, and real, verifiable signal even without triggering the underlying file write.
CVE-2026-15964: Single Sign On For TNG Account Takeover
A password-reset nonce computed identically for every anonymous visitor, then printed straight into the page — turning a public value into full, unauthenticated admin account takeover.
CVE-2026-11349: WordPress Plugin Unauthenticated SQL Injection
Unauthenticated blind SQL injection in the Modern Events Calendar Lite WordPress plugin, with real data actually extracted, not just a proof-of-concept flag.
CVE-2026-3141: FormGent Unauthenticated Arbitrary File Deletion
A realpath() call on a directory that hasn't been created yet returns false — and a WordPress plugin's own path-traversal guard treats that as proof a request is safe.
CVE-2025-68613: n8n Expression Sandbox Escape to Unauthenticated RCE
A workflow-automation platform's JavaScript expression evaluator becomes full remote code execution with no login at all — actively exploited in the wild.
CVE-2025-55182: React Server Components Unauthenticated RCE ("React2Shell")
A maximum-severity CVE — a crafted deserialization payload against React Server Components turns into remote code execution, with output smuggled back through an HTTP redirect header.
CVE-2025-54068: Laravel Livewire Unauthenticated RCE
A component property's type in Livewire's client-state format is all it takes for unauthenticated remote code execution.
CVE-2025-35939: Craft CMS Unauthenticated Session-File Content Injection
An unauthenticated request writes arbitrary attacker content, unsanitized, into a real PHP session file on disk — a KEV-listed CVE that had no public PoC before this lab.
CVE-2025-24813: Apache Tomcat Session Deserialization RCE
Actively exploited in the wild — two Tomcat misconfigurations combine to let an attacker plant and trigger arbitrary Java deserialization.