CVE‑2026 PoC Collection: All 12 Exploit Codes in One Repository

1. Repository Overview

The repository cve-2026-poc-collection was created and is maintained by security researcher XZ1r0. It organizes PoCs into directories web/, linux/, windows/ and other/ for easy navigation.

In total the collection contains twelve PoCs: three web‑application exploits, three Linux‑kernel exploits, one Windows exploit and five others. Severity ratings include two "critical", eight "high" and two "medium".

The maintainer employed automated scripts with proxy access to gather the code and provides the search_poc.py script so researchers can extend the search scope.

2. Web Application PoCs

Three high‑severity web PoCs all enable remote code execution.

CVE‑2026‑21858 targets the n8n workflow automation platform. With a CVSS score of 10.0 it allows unauthorized file read and full remote code execution. The PoC, maintained by Chocapikk, has received 257 GitHub stars, indicating active exploitation in the wild.

CVE‑2026‑23918 (Apache H2) is a double‑free vulnerability in Apache's mod_http2 module. It can be used for denial‑of‑service attacks and, under certain conditions, trigger passive remote code execution. The PoC by xeloxa supports multiple attack modes.

CVE‑2026‑31431 (Copy‑Fail) appears in this section as a Linux local privilege‑escalation exploit, with implementations for both Linux kernels and Kubernetes containers.

3. Linux Kernel PoCs

All Linux PoCs focus on the Copy‑Fail family (CVE‑2026‑31431) and demonstrate different exploitation scenarios.

cve_2026_31431 is the original PoC authored by rootsecdev, garnering 558 stars—the highest in the collection. It corrupts the page cache to elevate a regular user to root via a crafted sequence of system calls.

CVE‑2026‑31431‑Linux‑Copy‑Fail rewrites the exploit in Rust, producing a static binary that offers better compatibility across various Linux distributions.

Copy‑Fail‑CVE‑2026‑31431‑Kubernetes‑PoC demonstrates container escape. By triggering page‑cache corruption from within a Kubernetes pod, an attacker can break out of the container and execute code on the host node, potentially compromising the entire cluster.

4. Windows and Other PoCs

The Windows category contains a single PoC:

CVE‑2026‑21509 is an Office security‑feature bypass that lets an attacker craft seemingly harmless DOCX files to probe EDR and antivirus detection capabilities. Its CVSS rating is medium, but such flaws are often used in phishing reconnaissance.

The "other" category includes five PoCs:

CVE‑2026‑41940 : cPanel/WHM authentication bypass, allowing unauthenticated access to the WebHost Manager interface.

CVE‑2026‑31802 : npm tar path‑traversal vulnerability; symbolic links enable arbitrary file overwrite, posing a supply‑chain risk.

CVE‑2026‑2991 : KiviCare patient‑management system REST authentication bypass, exposing patient data.

copyfail‑rs : A Rust tool that implements the Copy‑Fail exploit and also provides system‑integrity monitoring and PAM‑bypass capabilities.

5. Language Distribution

Python is the most common implementation language, used in six PoCs, reflecting the security community’s preference for rapid prototyping. Rust appears in two PoCs, chosen for performance or static compilation needs. Go, JavaScript, PHP, C and YAML each have a single PoC.

For security researchers, understanding the underlying implementation logic is more valuable than merely reusing the code; studying the PoCs helps identify similar vulnerabilities during penetration testing.

6. Security Recommendations

The swift public release of PoC code after vulnerability disclosure, illustrated by the rapid appearance of multiple Copy‑Fail implementations across Linux and Kubernetes, highlights the importance of robust vulnerability‑management processes.

Recommendations for security teams include establishing a timely vulnerability‑tracking workflow, enforcing update policies for internet‑exposed services, and testing the published PoCs in controlled environments to verify detection and mitigation capabilities.