Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
88,056 exploits
GitHub PoC
CVE-2024-4367 proof PDF for cpc docs-preview
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗GitHub PoC★ 10
三星 Galaxy S25 Ultra（SM-S938B）适配版 DFRoot：开机自动获取 root（DirtyFrag CVE-2026-43284 + CVE-2026-43499 双链路），全中文界面，fork 自 diabl0w/DFRoot
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
open ↗GitHub PoC
Alexandertanay/jenkins-cve-2024-23897-lab
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISK
open ↗VulnCheck XDB
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISK
open ↗GitHub PoC★ 1
CVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE).
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
63RISK
open ↗GitHub PoC★ 1
CVE-2026-100740 PoC: D-Link DIR-895L A1_102b07 L2TP Host Name AVP out-of-bounds write in tunnel_set_params (UDP 1701). Device fingerprint + optional OOB trigger packet for authorized lab testing. https://pocbit.org/pocs/cve-2026-100740
D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write
48RISK
open ↗GitHub PoC★ 1
Security research and SOC investigation of CVE-2026-39987 using Docker, Nginx, Linux process monitoring, Splunk SIEM, and SPL detection rules.
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
open ↗GitHub PoC
CVE-2026-71963 - Hermes Agent 0.18.2-0.21.0 RCE via a repository-delivered .git/config (core.fsmonitor). Stdlib-only Python, verified on real 0.21.0 with a clean negative control on the fixed build.
Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
41RISK
open ↗GitHub PoC
A Windows-friendly, non-destructive Python checker for detecting WordPress installations potentially affected by CVE-2026-14281.
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
48RISK
open ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
71RISK
open ↗GitHub PoC
CVE-2026-100835 PoC: Edgeless Contrast <1.16.0 remote attestation relay (aTLS / CWE-295). Manifest audit (AllowedChipIDs/AllowedPIIDs), version & coordinator probe. https://pocbit.org/pocs/cve-2026-100835
Contrast before 1.16.0 Remote Attestation Relay Attack
48RISK
open ↗GitHub PoC
CVE-2026-8712: Unauthenticated SSRF / Backend URI Override in Wyoming HTTP API via uri Query Parameter
Wyoming < 1.10.2 SSRF via uri Query Parameter
33RISK
open ↗VulnCheck XDB
info-leak
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISK
open ↗GitHub PoC★ 9
CVE-2026-67279 + CVE-2026-86060 – MikroTrick MikroTik RouterOS SSH Pre-Auth Takeover (CVSS 9.2) | Red/Blue Team suite. 2 tools: Full Exploit (rekey bypass, fd-2 policy swap, full-admin shell, plant, mass scan, SOCKS5/Tor, stealth) & SafeDetect (banner/version audit, IoC guidance, JSON/CSV/HTML). Use Ethically & Safety only.
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
63RISK
open ↗GitHub PoC★ 3
nth347/mediawiki-CVE-2026-100382
Unauthenticated remote code execution through wikitext in ExternalData
48RISK
open ↗GitHub PoC
Disabled TLS Certificate Verification for HashiCorp Vault KMS in confluent-kafka
Confluent Kafka Python Improper TLS Certificate Validation
41RISK
open ↗GitHub PoC★ 1
CVE-2026-29053 - Ghost CMS < 6.19.0 - Authenticated Remote Code Execution via Malicious Theme
Ghost Vulnerable to Remote Code Execution via Malicious Themes
56RISK
open ↗VulnCheck XDB
denial-of-service
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
rmhowe425/POC-CVE-2026-107327
Langflow OSS is affected by multiple vulnerabilities
48RISK
open ↗GitHub PoC★ 1
Element2023H/CVE-2026-120232
Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption
48RISK
open ↗GitHub PoC★ 1
CVE-2026-97160 PoC for Joomla UP (lomart.fr): privileged {up php=} shortcode eval code injection in versions 5.0.0–5.2.0 and 6.0.0–6.0.29 (fix 5.2.1 / 6.1.0). Detects plugin version and verifies public article execution.
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
48RISK
open ↗GitHub PoC★ 1
CVE-2026-97163 PoC: Joomla UP (lomart.fr) unauthenticated GitHub mini-install / remote action deployment (≤6.0.29). Detects plugin version, probes com_ajax install triggers. Fix: UP 6.1.0 / 5.2.1. https://pocbit.org/pocs/cve-2026-97163
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
48RISK
open ↗GitHub PoC
Farih123/CVE-2026-90817
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
63RISK
open ↗GitHub PoC★ 1
AcyMailing Enterprise for Joomla < 11.1.0: POP3 mailbox actions save MIME attachments without extension checks to media/com_acym/upload/, enabling RCE when an attacker can email the monitored inbox (CVE-2026-94132, CVSS 9.5). Python check/exploit PoC —
Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0
48RISK
open ↗GitHub PoC
Docker-based educational lab for CVE-2021-44228 (Log4Shell)
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
CVE-2026-75650 - Magento Open Source - Critical 10.0 - Unauthenticated POST /graphql - Unauthenticated Remote Code Execution (StyleSmuggler SSTI)
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
100RISK
open ↗GitHub PoC
A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header — no credentials required.
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC
Emergency Zero-Downtime Linux Kernel Defense & Attack-Surface Disarmer. Active hotpatching for CVE-2026-98432 (MPTCP RCE), CVE-2024-1086, CVE-2026-53266 & Seccomp sandboxing.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗VulnCheck XDB
initial-access
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
56RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.