Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits

40,084CVEs with public exploitation

24,696lab-tested

All Referência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecent popular risk

17,519 exploits

GitHub PoC

PoC for jenkins 2.63 CVE-2019-1003030

CVE-2019-1003030CRITICALunder attack11 Jul 2026

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/

100RISK

open ↗

GitHub PoC★ 1

A PoC script for CVE-2026-38526, RCE via a file upload vulnerability in the /admin/tinymce/upload endpoint of webkul krayin 2.2.x

CVE-2026-38526CRITICAL11 Jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RISK

open ↗

GitHub PoC★ 1

RustDesk < 1.4.9 - Missing Session-Scope Enforcement Allows Out-of-Scope Control Message Injection

CVE-2026-57850HIGH11 Jul 2026

RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection

41RISK

open ↗

GitHub PoC

Cybersecurity Capstone Project completed during the NCSC Nashama CyberCamp 11, delivered in collaboration with IT Security C&T. The project demonstrates vulnerability assessment, exploitation, mitigation, and SIEM detection for Oracle WebLogic (CVE-2017-10271) and Apache Druid (CVE-2021-25646).

CVE-2017-10271HIGHunder attackransomware11 Jul 2026

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

100RISK

open ↗

GitHub PoC★ 1

CVE-2026-23744 MCPJam Inspector unauthenticated RCE PoC

CVE-2026-23744CRITICAL11 Jul 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RISK

open ↗

GitHub PoC★ 1

PoC untuk CVE-2026-0740: Ninja Forms File Uploads <= 3.3.26 — Unauthenticated Arbitrary File Upload yang dapat mengarah ke RCE.

CVE-2026-0740CRITICAL11 Jul 2026

Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

75RISK

open ↗

GitHub PoC★ 1

Dahua CVE-2026-29115

CVE-2026-29115MEDIUM11 Jul 2026

A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially c

33RISK

open ↗

GitHub PoC★ 1

Dahua CVE-2026-29116

CVE-2026-29116HIGH11 Jul 2026

A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially

41RISK

open ↗

GitHub PoC★ 4

CVE-2026-46331 act_pedit page-cache corruption exploit, with Alpine PIE fix

CVE-2026-46331HIGH11 Jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISK

open ↗

GitHub PoC

Instant Appointment <= 1.2 — Unauthenticated Arbitrary File Upload to RCE via add_service_front AJAX | CVSS 9.8

CVE-2026-15282CRITICAL11 Jul 2026

Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload

48RISK

open ↗

GitHub PoC★ 1

Azure IoT Hub where exposure of an owner-level Shared Access Key enables unauthenticated remote code execution (RCE) against connected IoT devices. Proof-Of-Concept

CVE-2026-13768CRITICAL11 Jul 2026

Gardyn IoT Hub Use of Hard-coded Credentials

48RISK

open ↗

GitHub PoC

Web application security assessment of DVWA using OWASP ZAP — vulnerability scanning, RCE (CVE-2012-1823) analysis, and remediation report.

CVE-2012-1823CRITICALunder attack11 Jul 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RISK

open ↗

GitHub PoC★ 6

Termux Privilege Escalation Tool & Root Manager - CVE-2026-43501

CVE-2026-43501CRITICAL11 Jul 2026

ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

48RISK

open ↗

GitHub PoC

1beelze/CVE-2026-14894

CVE-2026-14894CRITICAL11 Jul 2026

Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)

63RISK

open ↗

GitHub PoC

MW-HF/Drupal-CVE-2026-9082

CVE-2026-9082CRITICALunder attack11 Jul 2026

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

100RISK

open ↗

GitHub PoC

An unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database.

CVE-2026-40887CRITICAL11 Jul 2026

@vendure/core has a SQL Injection vulnerability

43RISK

open ↗

GitHub PoC

[AI-assisted] Root method for Lenovo IdeaTab A1000G (MT8317, kernel 3.4.0, Android 4.1) via CVE-2016-5195 (Dirty COW)

CVE-2016-5195HIGHunder attack11 Jul 2026

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

open ↗

GitHub PoC

Lim-ahmin/CVE-2021-43798

CVE-2021-43798HIGHunder attack11 Jul 2026

Grafana path traversal

100RISK

open ↗

GitHub PoC

nvicloud/CVE-2026-12948

CVE-2026-12948MEDIUM10 Jul 2026

Stored Cross-Site Scripting (XSS)

33RISK

open ↗

GitHub PoC

CVE-2026-54390 — JTL Shop Smarty SSTI RCE | Pre-Auth Template Injection via fetch('string:' . ) | 5.2.0-5.7.1

CVE-2026-54390CRITICAL10 Jul 2026

JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer

48RISK

open ↗

GitHub PoC★ 2

A Proof of Concept (PoC) exploit for CVE-2026-46331

CVE-2026-46331HIGH10 Jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISK

open ↗

GitHub PoC

Exploit for CVE-2022-26134

CVE-2022-26134CRITICALunder attackransomware10 Jul 2026

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

open ↗

GitHub PoC

Dr-D25/CVE-2026-49049

CVE-2026-49049HIGH10 Jul 2026

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

56RISK

open ↗

GitHub PoC

Abyssal is a high-performance Telnet vulnerability scanner for CVE-2026-24061, delivering root shells on vulnerable systems with false-positive detection.

CVE-2026-24061CRITICALunder attack10 Jul 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

open ↗

GitHub PoC

Exploitability PoC for CVE-2026-9558 (SSTI Mautic Theme)

CVE-2026-9558CRITICAL10 Jul 2026

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twi

48RISK

open ↗

GitHub PoC★ 1

inforcqb/CVE-2026-43499-pja110

CVE-2026-43499HIGH10 Jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

open ↗

GitHub PoC

PoC for CVE-2026-56423: MISP deleteSelection broken access control (CWE-862, contributor hard-deletes other orgs' Event Reports/Sharing Groups, CVSS 8.8)

CVE-2026-56423CRITICAL10 Jul 2026

MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

48RISK

open ↗

GitHub PoC

CVE-2026-28992 IOHIDFamily FastPathUserClient race condition PoC — security research

CVE-2026-28992MEDIUM10 Jul 2026

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7

33RISK

open ↗

GitHub PoC

sudoand3rs0n/CVE-2025-5548

CVE-2025-5548MEDIUM10 Jul 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RISK

open ↗

GitHub PoC

oPanel Authanticated Remote Code Execution via 'advenced/curl' Component

CVE-2026-50979HIGH10 Jul 2026

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allow

41RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.