Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
PoC and research for CVE-2026-123014: iTerm2 x-man-page NUL-byte argument injection.
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to
41RISK
open ↗VulnCheck XDB
local
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h
100RISK
open ↗GitHub PoC
Find Dockerfiles that ship an sshd exposed to *sshole (CVE-2026-123158). CLI, pre-commit hook and GitHub Action.
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
Detection and remediation scripts for CVE-2026-83844, Windows Paint remote code execution (CVSS 8.1)
Windows Paint Remote Code Execution Vulnerability
41RISK
open ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
OS command injection as root via Google Cloud DNS challenge key
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-c
48RISK
open ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗VulnCheck XDB
info-leak
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RISK
open ↗GitHub PoC
CVE-2026-98260 (posix-cpu-timers UAF) to KernelSU on a bootloader-locked OPPO PKT110: exploit core, on-device app, and the research write-up.
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 1
Dream-Rainy/CVE-2026-98260
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC
A proof of concept for CVE-2026-83844. Microsoft paint version 11.2609.401.0
Windows Paint Remote Code Execution Vulnerability
41RISK
open ↗GitHub PoC
Ansible playbook that upgrades OpenSSH to 10.6p2 on Alpine Linux to remediate CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
A scanner for *sshole SSH vulnerability (CVE-2026-123158)
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
kjry8sb/CVE-2026-19219
DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX
41RISK
open ↗GitHub PoC
3jee/CVE-2026-120491
Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page
33RISK
open ↗VulnCheck XDB
local
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
76RISK
open ↗GitHub PoC
CVE-2026-100109 - Security For WooCommerce 1.0.10-1.0.16 unauthenticated admin creation (PoC + exploit by thiscitze)
Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user
48RISK
open ↗GitHub PoC
CVE-2026-113615 - GS JWT <= 1.0.0 unauthenticated SQLi to administrator JWT (PoC + exploit by thiscitze)
GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi
48RISK
open ↗GitHub PoC
Detection-only local triage for Apache OFBiz CVE-2026-83542 (CVSS 9.8) and the 24.09.08 batch — grades installs against the fixed release. No probing, no payloads.
Apache OFBiz: Unauthenticated RCE via login-page widget injection
48RISK
open ↗VulnCheck XDB
initial-access
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
48RISK
open ↗VulnCheck XDB
initial-access
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
48RISK
open ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISK
open ↗GitHub PoC
CVE-2026-118423 — WP Libre Form <= 1.5.0.1 unauthenticated file upload to RCE (PoC, lab-verified)
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
48RISK
open ↗GitHub PoC★ 1
OpenSSH + musl password authentication bypass (sshole) checker: local precondition audit + remote verification; for authorized testing
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
sshole漏洞复现，CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
open ↗page 1 / 2,916next →
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.