Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,179cataloged exploits

40,156CVEs with public exploitation

24,696lab-tested

All Referência 26,041Exploit-DB 24,488GitHub PoC 17,602VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecent popular risk

17,602 exploits

GitHub PoC

A public share looked clean in the page tree, but the search endpoint told a different story. In Docmost, restricted child pages hidden from public share viewers could still leak through public share search results.

CVE-2026-33146MEDIUM26 Jun 2026

Docmost's Public Share Search Exposes Metadata of Restricted Children

33RISK

GitHub PoC★ 3

CVE-2026-20251 — Splunk Secure Gateway jsonpickle deserialization RCE (CVSS 8.8) | ReactiveZero Security Research

CVE-2026-20251HIGH26 Jun 2026

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

53RISK

GitHub PoC★ 5

CVE-2026-8461

CVE-2026-8461HIGH26 Jun 2026

Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

41RISK

GitHub PoC

12hrformat/CVE-2026-35273-POC

CVE-2026-35273CRITICALunder attackransomware26 Jun 2026

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana

100RISK

GitHub PoC

CVE-2026-54807 WooCommerce Privilege Escalation ║ ║ Unauthenticated Admin Role Assignment via Reg. Form

CVE-2026-54807CRITICAL26 Jun 2026

WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability

48RISK

GitHub PoC

Plane’s V2 asset subsystem trusted workspace slugs and asset UUIDs without enforcing the right membership checks, which let one authenticated user read, copy, delete, and overwrite assets in other workspaces.

CVE-2026-46558HIGH26 Jun 2026

Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces

41RISK

GitHub PoC

Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin.

CVE-2026-34212MEDIUM26 Jun 2026

Docmost page content has stored XSS via unsanitized attachment URLs

33RISK

GitHub PoC★ 1

VulnHub DC-1 boot-to-root — exploiting CVE-2018-7600 (Drupalgeddon2) for RCE, extracting DB credentials from settings.php, forging admin password hash, and escalating to root via SUID find.

CVE-2018-7600CRITICALunder attackransomware25 Jun 2026

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

GitHub PoC★ 1

W5M1n9/Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230

CVE-2026-20230HIGHunder attack25 Jun 2026

Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

93RISK

GitHub PoC

Squamity/CVE-2026-8181-PoC

CVE-2026-8181CRITICAL25 Jun 2026

Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover

68RISK

GitHub PoC

CVE-2026-55584 — phpSysInfo IP Allowlist Bypass

CVE-2026-55584HIGH25 Jun 2026

phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

41RISK

GitHub PoC★ 34

CVE-2026-43503

CVE-2026-43503HIGH25 Jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

56RISK

GitHub PoC

POC of CVE-2026-53075

CVE-2026-53075HIGH25 Jun 2026

ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

41RISK

GitHub PoC★ 1

SCAN END POC THE CVE-2024-4367

CVE-2024-4367MEDIUM25 Jun 2026

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RISK

GitHub PoC

7whyex/CVE-2026-45321-Tanstack

CVE-2026-45321CRITICALunder attackransomware25 Jun 2026

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

78RISK

GitHub PoC★ 1

CVE-2026-7574

CVE-2026-7574HIGH25 Jun 2026

Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use

41RISK

GitHub PoC

Unauthenticated time-based blind SQL injection exploit for CMS Made Simple ≤ 2.2.9 (CVE-2019-9053), ported to Python 3.

CVE-2019-9053—25 Jun 2026

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RISK

GitHub PoC

Lab — Privilege Escalation via Dirty Cow CVE-2016-5195 | 4Geeks Academy

CVE-2016-5195HIGHunder attack25 Jun 2026

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC

Joapath/CVE-2021-42013

CVE-2021-42013CRITICALunder attackransomware24 Jun 2026

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RISK

GitHub PoC

CVE-2025-57819 FreePBX SQLi RCE PoC

CVE-2025-57819CRITICALunder attack24 Jun 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISK

GitHub PoC★ 16

Y5neKO/CVE-2026-8461-EXP

CVE-2026-8461HIGH24 Jun 2026

Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

41RISK

GitHub PoC★ 1

CVE-2026-49777, CVE-2026-10735

CVE-2026-49777CRITICAL24 Jun 2026

WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability

63RISK

GitHub PoC★ 2

CVE-2026-48908

CVE-2026-48908CRITICALunder attack24 Jun 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

100RISK

GitHub PoC★ 1

CVE-2026-39275 - Stored XSS Leading to Account Takeover in Cockpit CMS

CVE-2026-39275MEDIUM24 Jun 2026

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code

33RISK

GitHub PoC★ 63

CVE-2026-45504 Microsoft Exchange File Read

CVE-2026-45504HIGH24 Jun 2026

Microsoft Exchange Server Elevation of Privilege Vulnerability

41RISK

GitHub PoC

Khai thác lỗ hổng bảo mật CVE-2025-55182

CVE-2025-55182CRITICALunder attackransomware24 Jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

GitHub PoC

Unauthenticated RCE PoC for CVE-2026-48908 SP Page Builder (Joomla) arbitrary file upload and remote code execution exploit with mass scaning support.

CVE-2026-48908CRITICALunder attack24 Jun 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

100RISK

GitHub PoC★ 3

Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter | Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover

CVE-2026-12416CRITICAL24 Jun 2026

Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter

48RISK

GitHub PoC

CVE-2025-57819 FreePBX SQLi RCE PoC

CVE-2025-57819CRITICALunder attack24 Jun 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISK

GitHub PoC

CVE-2026-31431 getroot from a Turkish Cryptominer

CVE-2026-31431HIGHunder attack24 Jun 2026

crypto: algif_aead - Revert to operating out-of-place

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.