Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
17,378 exploits
GitHub PoC
Security Advisory: HTTP Response Splitting via Unvalidated Response Header Values (rouille)
Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
33RISK
open ↗GitHub PoC★ 23
基于内核漏洞CVE-2026-43499的本地提权适配，集成嵌入式 KernelSU.CVE-2026-43499+KernelSU越狱模式
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC
Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values (tiny_http)
tiny-http 0.12.0 HTTP Response Splitting via Header Injection
33RISK
open ↗GitHub PoC
Security Advisory: Insufficient Access Controls Allow for Unauthorized Room Deletion (Let's Chat)
Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room
33RISK
open ↗GitHub PoC★ 1
Security Advisory: Unauthenticated Path Traversal Allows Arbitrary File Read (TinyWeb)
TinyWeb 0.0.8 Path Traversal via URL Path Component
41RISK
open ↗GitHub PoC★ 1
Security Advisory: HTTP Request Smuggling via Transfer-Encoding Desynchronization (rouille)
Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header
33RISK
open ↗GitHub PoC
Security Advisory: Unchecked Room Lookup Leads to Server Crash (Let's Chat)
Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup
41RISK
open ↗GitHub PoC
Security Advisory: HTTP Request Smuggling via Unparsed Transfer-Encoding Values (tiny_http)
tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling
33RISK
open ↗GitHub PoC★ 1
Hunt-Benito/siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP
48RISK
open ↗GitHub PoC
Docker-based isolated proof-of-concept lab for analysing CVE-2021-44228 (Log4Shell) for the COMP6441 Security Engineering project.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC★ 5
WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
56RISK
open ↗GitHub PoC
Adding --insecure to skip ssl
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISK
open ↗GitHub PoC
Slidev presentation for Certighost (CVE-2026-54121), with Mermaid diagrams and exported assets.
Active Directory Certificate Services Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC
Security Advisory: Unauthenticated Memory Leak Leads To Memory Exhaustion (TinyWeb)
TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling
41RISK
open ↗GitHub PoC★ 7
A C-based Linux security utility for detecting, safely verifying (Proof of Concept), and mitigating CVE-2026-64600 (RefluXFS). It provides kernel vulnerability assessment, XFS reflink detection, a safe race-condition PoC, and layered mitigation using SystemTap and XFS hardening.
xfs: resample the data fork mapping after cycling ILOCK
41RISK
open ↗GitHub PoC
Security Advisory: Insufficient Access Controls Allow for Unauthorized File Downloads (Let's Chat)
Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route
33RISK
open ↗GitHub PoC
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
48RISK
open ↗GitHub PoC★ 1
CypherHippie/CVE-2026-66804
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC
Security Advisory for CVE-2026-51565
Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attacker
33RISK
open ↗GitHub PoC★ 1
Technical analysis and Proof-of-Concept for CVE-2026-60206, a critical Oracle WebLogic Server SAML authentication bypass vulnerability.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
48RISK
open ↗GitHub PoC
Penpot <2.15.0 allows for unathenticated RCE CVE-2026-45805
Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
41RISK
open ↗GitHub PoC★ 1
PoC for CVE-2026-65694 — Microweber CMS (<=2.0.20) unauthenticated path traversal → arbitrary file read (.env / secrets)
Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController
56RISK
open ↗GitHub PoC
Auth Bypass in inetutils-telnetd
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISK
open ↗GitHub PoC
Manage BitLocker encrypted drives on Windows. Extract recovery keys, check encryption status, and apply security mitigations for CVE-2026-45585.
Windows BitLocker Security Feature Bypass Vulnerability
33RISK
open ↗GitHub PoC
CVE-2026-12960 - Improper Export of Android Application Components in the ASUS Router app (com.asus.aihome). PoC, exploit APK, video, and vendor report. Fixed in 1.0.0.9.74.
An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application o
33RISK
open ↗GitHub PoC★ 5
CVE-2026-43499 per-boot root exploit — core logic (arm64 Android GKI 6.6)
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC★ 17
（CVE-2026-43499）内核漏洞利用程序，适用于未解锁 Bootloader 的一加15T.
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC
CVE-2026-61946: Unauthenticated IDOR in Easy Appointments <= 3.12.27
WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability
33RISK
open ↗GitHub PoC
CVE-2026-54900, CVE-2026-54902 - Draft
Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.