Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗VulnCheck XDB
local
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h
100RISK
open ↗GitHub PoC
PoC and research for CVE-2026-123014: iTerm2 x-man-page NUL-byte argument injection.
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to
41RISK
open ↗GitHub PoC
POC exploit for CVE-2026-123488 - unauthenticated SQL injection vulnerability in Craft CMS (MySQL/MariaDB backend). Admin takeover.
Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint
45RISK
open ↗GitHub PoC
CVE-2026-98260 (posix-cpu-timers UAF) to KernelSU on a bootloader-locked OPPO PKT110: exploit core, on-device app, and the research write-up.
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 1
hackzuoji/freeswitch-cve-2026-116779-POC
FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands
48RISK
open ↗GitHub PoC★ 1
OpenSSH + musl password authentication bypass (sshole) checker: local precondition audit + remote verification; for authorized testing
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
CVE-2026-118423 - WP Libre Form <= 1.5.0.1 unauthenticated upload to RCE (PoC + exploit by thiscitze)
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
48RISK
open ↗GitHub PoC
Ansible playbook that upgrades OpenSSH to 10.6p2 on Alpine Linux to remediate CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
Sable Research — Analysis of CVE-2026-118423: Unauthenticated Arbitrary File Upload to RCE in WP Libre Form (≤ 1.5.0.1)
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
48RISK
open ↗GitHub PoC
Reproducer for CVE-2026-101678 (MySQL Connector/J <= 26.7.0) - malicious server reporting huge result-set column count
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is
33RISK
open ↗GitHub PoC★ 1
Dream-Rainy/CVE-2026-98260
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 1
Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation | RCE
AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
48RISK
open ↗GitHub PoC
Find Dockerfiles that ship an sshd exposed to *sshole (CVE-2026-123158). CLI, pre-commit hook and GitHub Action.
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
sshole漏洞复现，CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC★ 1
CVE-2026-116214: unauthenticated account takeover in MacCMS v10 via an unbound password-recovery code. Full technical writeup + self-contained Docker lab (maccms10 2021.1000.2000, PHP 7.4, MariaDB, Mailpit). For authorized testing only.
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
48RISK
open ↗GitHub PoC
CVE-2026-118569 — any editor could publish every draft on a Drupal site
Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282
33RISK
open ↗GitHub PoC
Unofficial offline checker: Omada gateway firmware vs TP-Link bulletin 132084 (CVE-2026-19586). Not affiliated with TP-Link.
Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways
48RISK
open ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
A scanner for *sshole SSH vulnerability (CVE-2026-123158)
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
CVE-2026-114630 - ELEX HelpDesk <= 3.3.8 unauthenticated arbitrary file deletion (PoC + exploit by thiscitze)
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter
45RISK
open ↗GitHub PoC
CVE-2026-97229 - GitLab CE/EE CI/CD Integer Overflow RCE | CVSS 10.0 | By Gh0st-Bx1
Integer Overflow or Wraparound in GitLab
100RISK
open ↗GitHub PoC
CVE-2026-118423 — WP Libre Form <= 1.5.0.1 unauthenticated file upload to RCE (PoC, lab-verified)
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
48RISK
open ↗GitHub PoC
OS command injection as root via Google Cloud DNS challenge key
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-c
48RISK
open ↗GitHub PoC
Detection-only local triage for Apache OFBiz CVE-2026-83542 (CVSS 9.8) and the 24.09.08 batch — grades installs against the fixed release. No probing, no payloads.
Apache OFBiz: Unauthenticated RCE via login-page widget injection
48RISK
open ↗GitHub PoC
A Patch Without Proof: the verification gap behind CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗page 1 / 2,916next →
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.