Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC
Simulasi type juggling & implicit type conversion CVE-2026-114509 pada query autentikasi
Laravel TokenGuard authentication bypass through non-string API credentials
63RISK
open ↗GitHub PoC
CVE-2026-105192 (LMCache): pre-auth pickle deserialization RCE over the unauth ZMQ transport (single frame) — b63 showcase, lab-verified with patched-build negative + reliability/matrix evidence
LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization
48RISK
open ↗GitHub PoC
CVE-2026-115965
WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
41RISK
open ↗GitHub PoC★ 1
Ghost-Bx1/cve-2026-98432-linux-tcp-uaf
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC★ 1
Read-only Node2Shell detection for CVE-2026-111497 using verified Node.js artifact identities.
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC★ 1
Evidence-based PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Analysis of buffer overflow in Google Brotli decoder (CVE-2026-111497)
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC★ 4
XDP program to mitigate CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC★ 1
🚨 CVE ID: CVE-2026-116779 📦 Product: FreeSWITCH 💉 Type: Command Injection (via SIP MESSAGE) 🔥 Score: 9.8 (Critical(RCE)) +20K target
FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands
48RISK
open ↗GitHub PoC★ 2
A CVE-2026-98260 adapt for OPPO Pad Air 5
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 5
One-tap Android root for Samsung Galaxy devices, built around the CVE-2026-98260 timer exploit.
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC
Incident Response Case Study: Zero-Day RCE Vulnerability Mitigation & Zero-Downtime Container Hotfix on AWS + Docker (CVE-2026-109618)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Detection-only local triage scanner for Progress WS_FTP Server October 2026 patch batch: CVE-2026-84295 (CVSS 10.0) and 14 more, graded per group against the split 2024.0.6/2025.0.3 vs 2024.0.7/2025.0.4 fix table. No payloads, no remote probing.
Improper Authentication in Progress WS_FTP Server
48RISK
open ↗GitHub PoC★ 1
基于CVE-2026-98260漏洞开发的提权项目
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC
Citrix NetScaler RCE/DoS CVE-2026-107406
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
48RISK
open ↗GitHub PoC★ 1
Gitea archived repository write-protection bypass — milestones, releases and labels unprotected (CVE-2026-116296)
Gitea archived repository release, milestone and label modification
33RISK
open ↗GitHub PoC
Xboard 节点后端：基于 Xray-core v26.10.31，单补丁实现设备数/限速，严格对齐 Xboard V2 契约，内置 CVE-2026-98432 缓解
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
PHP 5.6.40 RPM packages with PHP2Shell security patches for CVE-2026-109618 and CVE-2026-109619 on EL6.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 3
Independent lab reproduction and post-patch verification tool for CVE-2026-112816 (LXD/MicroCloud mTLS chain bypass).
Improper certificate validation in the HTTPS listener in LXD
48RISK
open ↗GitHub PoC
CVE-2026-88773 - NetScaler nsppe 32-bit chunk-size accumulator wrap (HTTP Request Smuggling)
HTTP Request Smuggling
63RISK
open ↗GitHub PoC
RPM package that applies an nftables mitigation for CVE-2026-98432 (RHSB-2026-016) on EL 8/9/10
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC★ 1
基于CVE-2026-98260的iQOO Neo9 Pro 临时Root实现，AwA
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC
bobmarleyfaruk9/CVE-2026-86962
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS
33RISK
open ↗GitHub PoC
Proof-of-Concept for CVE-2026-98258.
posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
41RISK
open ↗GitHub PoC
Mervent/cve-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
Proof-of-Concept for CVE-2026-98258.
posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
41RISK
open ↗GitHub PoC
LB-LINK WR1210M (CVE-2026-19971) 未授权配置泄露漏洞与访客网络扩展攻击链分析
LB-Link WR1210M Backup Endpoint backup.cgi main missing authentication
33RISK
open ↗GitHub PoC★ 2
PoC for CVE-2026-116366 — ClickHouse Server unauthenticated RCE (brotli v1.2.0 decoder out-of-bounds write): differential detector, weaponized DoS, containerized vulnerable-vs-fixed lab, root-cause analysis
Unauthenticated RCE vulnerability against ClickHouse Server
63RISK
open ↗GitHub PoC
Grafana alerting contact point authorization bypass via schema downgrade (CVSS 7.7) — containerized lab, full PoC, plus 2 unreported findings reproducible on 13.2.5
Alerting contact point authorization bypass via schema downgrade
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.