Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,054cataloged exploits
40,803CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,349VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
88,055 exploits
GitHub PoC
Upstream OpenVPN kernel fix for CVE-2026-74727, tested on Ubuntu kernel 7.0.0-38.38. Includes build instructions and functional test results.
ovpn: skip rehash for peers already removed from by_id
48RISK
open ↗VulnCheck XDB
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
open ↗VulnCheck XDB
initial-access
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
48RISK
open ↗VulnCheck XDB
info-leak
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISK
open ↗GitHub PoC
beyavuz/cve-2026-105080-poc
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-conve
48RISK
open ↗GitHub PoC
CVE-2023-54391: Proxmox VE Authentication Bypass RCE
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RISK
open ↗GitHub PoC★ 2
CVE-2023-54391: Proxmox VE Authentication Bypass RCE Exploit
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RISK
open ↗GitHub PoC
Penetration test for Metasploitable 2 — Samba 3.0.20 Username Map Script (CVE-2007-2447)
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RISK
open ↗GitHub PoC★ 15
watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISK
open ↗GitHub PoC
CVE-2025-55182 "Ghost Action" — pre-auth RCE (React Flight deserialization, Next.js 15.5.6) CTF challenge. Problem only; solve/writeup excluded.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
Educational lab and clean-room reproduction demonstrating the OS command injection pattern in CVE-2026-105134. For defensive research only.
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
100RISK
open ↗GitHub PoC
A Kubernetes security project that exploits React2Shell (CVE-2025-55182) in a Next.js application on Amazon EKS, investigates the breach, tests layered defenses, and integrates security into delivery.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
CVE-2026-39987 Exploit | by infrar3d
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
open ↗GitHub PoC
tunahantekeoglu/CVE-2025-54769
KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal
41RISK
open ↗GitHub PoC★ 1
CVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS
76RISK
open ↗VulnCheck XDB
info-leak
[20230201] - Core - Improper access check in webservice endpoints
100RISK
open ↗VulnCheck XDB
initial-access
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗GitHub PoC
PoC and automated code to exploit CVE-2025-57819 in FreePBX. It demonstrates the Remote Code Execution (RCE) vulnerability via command injection in the Asterisk system. Ideal for HackTheBox environments.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISK
open ↗VulnCheck XDB
info-leak
Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure
68RISK
open ↗VulnCheck XDB
initial-access
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
100RISK
open ↗GitHub PoC
kashishtopi/CVE-2026-105314
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call
41RISK
open ↗GitHub PoC★ 1
CVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS
76RISK
open ↗GitHub PoC
CVE-2024-4367 PDF.js FontMatrix injection PoC (payload: alert(1)) - authorized pentest artifact
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗VulnCheck XDB
initial-access
Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
63RISK
open ↗VulnCheck XDB
initial-access
Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
63RISK
open ↗GitHub PoC
Controlled vulnerability assessment of Metasploitable 2, identifying and validating CVE-2011-2523 in vsftpd 2.3.4 within an isolated lab environment.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗VulnCheck XDB
initial-access
Samba: samba: remote code execution in printing subsystem via unescaped job description
68RISK
open ↗GitHub PoC
CVE-2026-16444 — Arbitrary file write on the controller via TeamViewer Classical File Transfer (TV-2026-1008)
Improper Validation of File Paths in TeamViewer Desktop Clients
41RISK
open ↗GitHub PoC
r30xlqo6从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）w680rjb2afux
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
13RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.