Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
88,056 exploits
GitHub PoC★ 18
CVE-2026-83991: Windows Cloud Files access-check bypass
Windows Cloud Files Mini Filter Driver Tampering Vulnerability
33RISK
open ↗GitHub PoC★ 110
CVE-2026-49881, using insecure context creation in Android 17's Telecom service to execute arbitrary code as UID 1000 system_server from an unprivileged app
In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the
41RISK
open ↗VulnCheck XDB
initial-access
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4
78RISK
open ↗GitHub PoC
CVE-2026-67401 - Draft or TODO
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr
48RISK
open ↗GitHub PoC★ 1
AD CS 证书身份伪造漏洞，属于ESC（Exploit Certification）系列 的新成员
Active Directory Certificate Services Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC
CVE-2026-41940 PoC - Linux/Termux Compatible Version
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC★ 2
An educational reference and defensive analysis of CVE-2025-3248, a critical code injection vulnerability affecting Langflow.
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISK
open ↗GitHub PoC
FortiClient FortiShield exploit (CVE-2015-5736) for Windows 10 1809
The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel
23RISK
open ↗GitHub PoC★ 5
CVE-2026-19089 WooCommerce Tych Remote Command Execution
Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
63RISK
open ↗VulnCheck XDB
initial-access
Potential authentication bypass leading to administrative access in Artifactory
98RISK
open ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗VulnCheck XDB
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
open ↗GitHub PoC
From patch to RCE: hand-built exploit for CVE-2010-4221 (ProFTPD TELNET IAC stack overflow), with the full failure-driven journey documented
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow rem
60RISK
open ↗VulnCheck XDB
initial-access
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RISK
open ↗GitHub PoC
CVE-2026-10795 - Draft or TODO
UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
41RISK
open ↗VulnCheck XDB
initial-access
All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
41RISK
open ↗VulnCheck XDB
initial-access
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version i
71RISK
open ↗VulnCheck XDB
info-leak
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
100RISK
open ↗GitHub PoC
CVE-2025-58434 - Flowise (CVE-2025-58434) unauthenticated account takeover via password-reset token disclosure
Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
85RISK
open ↗VulnCheck XDB
local
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socke
43RISK
open ↗VulnCheck XDB
initial-access
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RISK
open ↗VulnCheck XDB
remote-with-credentials
Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could se
45RISK
open ↗GitHub PoC★ 9
Marimo Pre Authentication RCE
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
open ↗VulnCheck XDB
initial-access
AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows re
60RISK
open ↗GitHub PoC★ 1
Writeup/finding of CVE-2026-24061 within the Cyberhawks lab
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISK
open ↗GitHub PoC★ 8
CVE-2026-85046 | Chrome V8 Type Confusion in Inline Array.prototype.sort (Maglev/Turbofan) | CVSS 8.8 | CWE-843 | Chrome < 152.0.7977.82
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside
71RISK
open ↗GitHub PoC
CVE-2026-83548, CVE-2026-83549, - Draft or TODO - https://github.com/rapid7/metasploit-framework/pull/21883
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern
93RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.