Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC★ 6
PoC for CVE-2026-98432 (Linux kernel IPv4 TCP inet_opt/ireq_opt use-after-free, CVSS 9.8): KASAN-verified UAF reproduction in inet_csk_route_req with A/B fixed-kernel control
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC★ 1
CVE-2026-54523 Kyverno cross-namespace resource generation PoC and exploit
Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
48RISK
open ↗GitHub PoC★ 5
CVE-2026-111585 — TeamViewer Remote-Control Screen Decompression Integer Overflow → Heap Buffer Overflow (PoC, fixed in 15.83, CVSS 8.8). Containerized lab + one-command repro with vulnerable/fixed differential evidence.
Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow
41RISK
open ↗GitHub PoC
IPv4 SYN with IP options, one lab target per run, for CVE-2026-98432 research. Header-offset parser, regression tests, and a postmortem of a broken auto-exploiter.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC★ 2
CVE-2026-103039: Gravity Forms <= 3.1.2 PHP object injection to RCE. PoC by NOXCRYPT (noxcrypt-x). gen_payload.php is not included.
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
48RISK
open ↗GitHub PoC★ 2
PoC for CVE-2026-116366 — ClickHouse Server unauthenticated RCE (brotli v1.2.0 decoder out-of-bounds write): differential detector, weaponized DoS, containerized vulnerable-vs-fixed lab, root-cause analysis
Unauthenticated RCE vulnerability against ClickHouse Server
63RISK
open ↗GitHub PoC★ 18
macOS revisiond local privilege escalation to root (CVE-2026-112487)
A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequo
41RISK
open ↗GitHub PoC★ 2
Interim nftables mitigation for Linux kernel CVE-2026-98432 (IPv4-options UAF in tcp_v4_syn_recv_sock) as a reproducible agent skill
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
CVE-2026-119712 (CVSS 8.5 High) — PipesHub < 0.10.0 SSRF via image URLs in indexed documents (CWE-918). Verified PoC.
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
33RISK
open ↗GitHub PoC★ 1
woshigenm/CVE-2026-89633
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
48RISK
open ↗GitHub PoC★ 7
PHP 7.4.33 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libraries. Documented builds, source and patch checksums, focused regression tests, Trivy reports, and non-root defaults. Linux amd64. UNVERIFIED development preview; independent mysqlnd review remains incomplete.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Stopgap firewall mitigation for CVE-2026-98432 on Ubuntu 16.04/24.04
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗VulnCheck XDB
info-leak
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported
48RISK
open ↗GitHub PoC
Grafana alerting contact point authorization bypass via schema downgrade (CVSS 7.7) — containerized lab, full PoC, plus 2 unreported findings reproducible on 13.2.5
Alerting contact point authorization bypass via schema downgrade
41RISK
open ↗GitHub PoC★ 1
Bash toolkit that finds and fixes PHP CVEs — PHP2Shell (CVE-2026-109618/109619), CVE-2026-115560, CVE-2024-4577, CVE-2019-11043 — on Linux and macOS. Detects runtimes, audits config, applies source patches, hardens php.ini / FPM / nginx / Apache, hunts compromise, rolls back cleanly. MIT.
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC★ 1
Bash toolkit that finds and fixes PHP CVEs — PHP2Shell (CVE-2026-109618/109619), CVE-2026-115560, CVE-2024-4577, CVE-2019-11043 — on Linux and macOS. Detects runtimes, audits config, applies source patches, hardens php.ini / FPM / nginx / Apache, hunts compromise, rolls back cleanly. MIT.
Underflow in PHP-FPM can lead to RCE
100RISK
open ↗GitHub PoC
Ansible playbook to mitigate CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
Check whether a PHP version is patched against PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Stdlib-only Python.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
CVE 2026 98260 vivo x fold6 poc
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC
eBPF (XDP/tc) mitigation for CVE-2026-98432 / RHSB-2026-016 - draft
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC★ 4
woshigenm/CVE-2026-98937
perf/core: Check kernel access when kernel callchains are requested
23RISK
open ↗GitHub PoC
Detection-only local triage scanner for Linux kernel Fragnesia CVE-2026-46300: grade a running or installed kernel against upstream and distro fixed builds. No payloads, no network.
net: skbuff: preserve shared-frag marker during coalescing
91RISK
open ↗GitHub PoC★ 1
CVE-2026-120218: bilingual TypeMill stored XSS analysis and safe SVG/XSLT PoC
Typemill SvgSanitizer.php saveImage cross site scripting
33RISK
open ↗GitHub PoC
antonyantony/cve-2026-98432-nft
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
Detector and local lab for CVE-2026-98432 (IPv4 TCP UAF in inet_opt/ireq_opt): static analysis, kprobes, the tcp2kaslr trigger vector, and remote-risk evidence. Not an exploit; no RCE.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
CVE-2026-63686 demo
Apache HTTP Server: mod_xml2enc crash on charset conversion failure
41RISK
open ↗GitHub PoC
Unauthenticated SQL injection (CVSS 9.8) in the Oracle EBS 12.2.312.2.15 TCF servlet
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported
48RISK
open ↗GitHub PoC★ 3
Tiny Shizuku app that clears stuck 'SMS of Death' (CVE-2026-58882) WAP Push messages. Material 3 Expressive.
In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could le
41RISK
open ↗GitHub PoC
Audit statique de l'exposition d'une application Quarkus au décodeur Brotli vulnérable (CVE-2026-111497). Généré avec Claude Code.
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.