VulnCheck

Ghost CMS lab image with jsonpath 1.1.1 + static-eval 2.0.2 pinned (CVE-2026-29053).

Zammad 6.5.4 webapp lab target (CVE-2026-102489 / CVE-2026-102490)

MediaWiki 1.43 + ExternalData 3.6.1 lab (CVE-2026-100382 OS command injection)

LightLLM RPyC CacheServer allow_pickle lab (CVE-2026-103040 / CVE-2026-103041)

Chamilo LMS 1.11.36 all-in-one pre-seeded lab (CVE-2026-61600 / CVE-2026-70647)

WSO2 API Manager 4.5.0 vulnerable to CVE-2026-5430 (JWT alg-confusion auth bypass), self-seeding adm

Grav CMS 1.7.49.5 lab target for CVE-2026-42608 FormFlash path traversal

OmniRoute AI gateway lab image

Cua computer-server 0.3.41 lab for CVE-2026-86121 (unauthenticated run_command RCE)

WordPress Core 7.1.1 lab for CVE-2026-87902 (get_page_template LFI to pearcmd RCE)