pig-tail/security-researchPoCs & write-ups for CVEs I reported (coordinated disclosure; published + patched only)
Proof-of-concept code and technical write-ups for vulnerabilities I discovered and reported through coordinated disclosure. Every entry here is already public: the vendor advisory is published and a fixed release is available. Nothing under embargo or in draft is included.
The PoCs are verification harnesses, not weaponized exploits: each runs against a local, self-owned instance and proves the defect with a benign sentinel (a marker file, a seeded "secret" record, a policy-evaluation assertion). None of them target third-party systems, and none perform any destructive or persistent action.
— Pig-Tail · Offensive Security Engineer & Vulnerability Researcher · [email protected]
| CVE / Advisory | Project | Class (CWE) | Severity | PoC |
|---|
| GHSA-f5m5-jfmq-ghpx | SteeltoeOSS/NetCoreToolService | Unauthenticated RCE via argument injection into 'dotnet new' (CWE-88) | Critical | ✅ runnable |
| CVE-2026-77312 | flyto-core | Arbitrary file write via unguarded data./file. modules (in (CWE-22) | Critical | ✅ runnable |
| GHSA-7833-fr7j-v32q | GitPython | Arbitrary local file content disclosure via [include] direct (CWE-73/CWE-200) | High | ✅ runnable |
| GHSA-284h-m62q-gf8w | GitPython | Dormant multi-line git-config values are corrupted into live (CWE-88/CWE-94) | High | ✅ runnable |
| GHSA-8mcc-hrx5-hvxc | GitPython | clone_from()/clone() omit --separate-git-dir from unsafe_git (CWE-22/CWE-73) | High | ✅ runnable |
| CVE-2026-62263 | OpenAM | OpenAM WebAuthn Java deserialization RCE via ObjectInputFilt (CWE-502) | High | 📄 write-up |
| CVE-2026-53626 | glpi | Arbitrary document read (CWE-639/CWE-862) | High | 📄 write-up |
| CVE-2026-75606 | egroupware | Authenticated SQL injection via col_filter string-key in Base (CWE-89) | High | ✅ runnable |
| CVE-2026-49285 | glpi-agent | OS Command Injection in GLPI Agent ToolBox Results export vi (CWE-78) | High | 📄 write-up |
| CVE-2026-52764 | glpi-agent | MSSQL inventory module executes OS commands with unsanitized (CWE-78) | High | 📄 write-up |
| CVE-2026-45621 | glpi-agent | MongoDB inventory module allows JavaScript injection via une (CWE-94/CWE-116) | High | 📄 write-up |
| CVE-2026-46615 | glpi-agent | Database inventory modules execute OS commands with unsaniti (CWE-78) | High | 📄 write-up |
| CVE-2026-40936 | glpi-agent | ToolBox plugin can allow unauthenticated path traversal lead (CWE-22/CWE-73) | High | 📄 write-up |
| CVE-2026-48730 | glpi-inventory-plugin | Reflected XSS (CWE-79) | High | 📄 write-up |
| CVE-2026-75594 | kirby | Access to image files and limited access to JSON files outsi (CWE-22) | High | 📄 write-up |
| CVE-2026-77437 | kiwitcms | ORM lookup-injection in RPC *.filter methods leaks bug-track (CWE-943/CWE-200) | High | ✅ runnable |
| CVE-2026-77435 | kiwitcms | Authenticated SSRF via Bug.details API method (CWE-918/CWE-697) | High | ✅ runnable |
| CVE-2026-58229 | mint | Unbounded HTTP/1 response-header and chunked-trailer accumul (CWE-770) | High | ✅ runnable |
| CVE-2026-61699 | nebula-mesh | Certificate revocation is never enforced at the mesh: nebula (CWE-299/CWE-672) | High | 📄 write-up |
| CVE-2026-63202 | netty-incubator-codec-ohttp | BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via inf (CWE-400/CWE-835) | High | ✅ runnable |
| GHSA-p6gq-j5cr-w38f | nodemailer | Message-level raw option bypasses disableFileAccess/disableU (CWE-73/CWE-918) | High | ✅ runnable |
| CVE-2026-71315 | nuxt | Nuxt route rules silently dropped for mixed-case paths, bypa (CWE-178/CWE-863) | High | ✅ runnable |
| CVE-2026-62375 | opendj | OpenDJ Unbounded VLV offset array allocation → memory-exhaus (CWE-190/CWE-770/CWE-789) | High | 📄 write-up |
| CVE-2026-62366 | opendj | OpenDJ Unauthenticated stack exhaustion when decoding an LDA (CWE-400/CWE-674) | High | 📄 write-up |
| GHSA-r9mf-88r7-g6j9 | probo | Account takeover via OIDC login: the continue redirect hands (CWE-384/CWE-601) | High | ✅ runnable |
| CVE-2026-76079 | probo | Vertical privilege escalation: an organization ADMIN can min (CWE-269/CWE-863) | High | ✅ runnable |
| GHSA-fj3w-533r-fvf6 | python-statemachine | SCXML reads arbitrary local files when (CWE-22/CWE-200) | High | ✅ runnable |
| GHSA-r7hw-jx6r-756g | saml2 | Incomplete fix of CVE-2026-49283: unsigned embedded Response (CWE-287/CWE-347) | High | ✅ runnable |
| CVE-2026-62989 | shopper | Missing authorization on product variant DeleteAction/Delete (CWE-285/CWE-862) | High | 📄 write-up |
| CVE-2026-86043 | skipper | OPA body-authz bypass: truncated_body mitigation fails ope (CWE-863) | High | ✅ runnable |
| CVE-2026-54697 | cbssh | Excessive allocation and integer overflow in DER private-key (CWE-190/CWE-789) | Medium | 📄 write-up |
| CVE-2026-55422 | conda-forge | Stored DOM XSS on conda-forge.org via unsanitized dangerousl (CWE-79) | Medium | 📄 write-up |
| CVE-2026-75609 | egroupware | Post-authentication open redirect via login.php phpgw_forwa (CWE-601) | Medium | ✅ runnable |
| CVE-2026-77316 | flyto-core | SSRF guard bypass via DNS rebinding (validate_url_ssrf resol (CWE-918) | Medium | ✅ runnable |
| CVE-2026-52768 | glpi-agent | Deploy task Path Traversal in Tools::Archive (CWE-22/CWE-23) | Medium | ✅ runnable |
| CVE-2026-52765 | glpi-agent | Oracle and DB2 inventory modules allow SQL injection in GLPI (CWE-89) | Medium | 📄 write-up |
| CVE-2026-42187 | glpi-agent | Proxy plugin can allow arbitrary file write if local_store (CWE-22) | Medium | 📄 write-up |
| CVE-2026-48728 | glpi-inventory-plugin | Job enumeration and status manipulation on Deploy, Collect, (CWE-306) | Medium | 📄 write-up |
| CVE-2026-63432 | horilla-hr | Server-Side Template Injection (SSTI) in Mail Preview Endpoi (CWE-94/CWE-200) | Medium | 📄 write-up |
| CVE-2026-59249 | mint | HTTP/1 chunk-size desync in Mint via Integer.parse/2 sign to (CWE-444) | Medium | 📄 write-up |
| CVE-2026-67435 | monitoring-plugins | fetch() forwards credential headers across a cross-origin re (CWE-200/CWE-918) | Medium | 📄 write-up |
| CVE-2026-67436 | monitoring-plugins | SSRF and auth-token disclosure via unvalidated @odata.id lin (CWE-20/CWE-200/CWE-918) | Medium | ✅ runnable |
| CVE-2026-62373 | opendj | OpenDJ JMX MBean-argument deserialization without a serial f (CWE-502) | Medium | 📄 write-up |
| CVE-2026-73616 | openremote | Notification delete crosses realm boundaries (CWE-639/CWE-862) | Medium | ✅ runnable |
| CVE-2026-63505 | probo | Cross-tenant IDOR via unvalidated FK references (CWE-639) | Medium | ✅ runnable |
| CVE-2026-64662 | statamic | Missing authorization on navigation endpoint allows disclosu (CWE-639/CWE-862) | Medium | 📄 write-up |
| GHSA-h5rg-8p7f-47g2 | surrealdb | SSRF via JWKS URL — Redirect Following in JWT Key Fetch (CWE-918) | Medium | 📄 write-up |
| CVE-2026-54764 | traefik | ForwardAuth middleware leaks X-Forwarded-Port spoofing via u (CWE-345) | Medium | 📄 write-up |
| CVE-2026-14620 | webpack-dev-server | webpack-dev-server vulnerable to cross-site request forgery (CWE-352/CWE-749) | Medium | ✅ runnable |
| CVE-2026-55780 | NanaZip | Uncaught exception / unbounded allocation in NanaZip .NET si (CWE-248/CWE-400) | Low | 📄 write-up |
| CVE-2026-55781 | NanaZip | Unbounded memory allocation (DoS) in NanaZip UFS parser via (CWE-400/CWE-789) | Low | 📄 write-up |
| CVE-2026-55782 | NanaZip | Unbounded memory allocation (DoS) in NanaZip WebAssembly par (CWE-400/CWE-789) | Low | 📄 write-up |
| CVE-2026-55783 | NanaZip | NULL pointer dereference in Extract() of all seven NanaZip c (CWE-476) | Low | 📄 write-up |
| GHSA-vwv6-85p7-mjvc | glpi-agent | Oracle inventory module uses unvalidated process username in (CWE-78) | Low | 📄 write-up |
| GHSA-mgcf-xgv7-5w4x | glpi-agent | Collect task compiles server-controlled regular expression w (CWE-1333) | Low | 📄 write-up |
| GHSA-cwg9-jj5m-pq4q | glpi-agent | Stored XSS via SNMP community/authprotocol credential fields (CWE-79) | Low | 📄 write-up |
| CVE-2026-67433 | monitoring-plugins | Symlink following in logfile legacy database migration (CWE-59/CWE-367) | Low | ✅ runnable |
| GHSA-m5p8-h274-f7w8 | openproject | Content Security Policy img-src wildcard enables cross-origi (CWE-200) | Low | 📄 write-up |
| CVE-2026-76078 | probo | Broken access control in public e-signature API: any trust-c (CWE-639/CWE-862) | Low | 📄 write-up |
| CVE-2026-76080 | probo | Unauthenticated cross-tenant and hidden-item disclosure via (CWE-284/CWE-639) | Low | 📄 write-up |
| More entries are added here as their advisories are published by each vendor. Findings still under | ||||
| coordinated-disclosure embargo (advisory in draft, CVE reserved but not yet public) are deliberately | ||||
| not included until the vendor publishes. |
All findings were reported privately to the maintainer first (GitHub Private Vulnerability Report or the vendor's security contact), triaged, fixed, and only then published. PoCs are released after the fix so defenders can verify their own patching — not to arm attackers.
