Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
88,056 exploits
GitHub PoC
Authorized education-sector recon & triage orchestrator (nmap/dirsearch/sqlmap/hydra + CVE-2024-4577, secret/API-key leak, XSS, wp2shell) with a web control panel
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC
mohamedjawady/CVE-2026-53613-poc
util-linux mount target TOCTOU allows local privilege escalation
41RISK
open ↗GitHub PoC
KongQBin/CVE-2016-5195
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗GitHub PoC
ksotaria1337/-CVE-2026-48907-
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISK
open ↗GitHub PoC
CVE-2026-56705 — Adminer < 5.4.3 Unauthenticated RCE via MSSQL PDO DSN Injection
Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection
48RISK
open ↗VulnCheck XDB
initial-access
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISK
open ↗VulnCheck XDB
initial-access
Microsoft SharePoint Server Security Feature Bypass Vulnerability
100RISK
open ↗VulnCheck XDB
info-leak
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
63RISK
open ↗GitHub PoC
Check for CVE-2026-79266. A use-after-free in the DevTools component allows arbitrary code execution inside the sandbox via a malicious Chrome extension leveraging social engineering.
Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeri
41RISK
open ↗VulnCheck XDB
local
An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user
33RISK
open ↗VulnCheck XDB
local
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗GitHub PoC★ 2
CVE-2026-19632 - TranslatePress One-Day PoC
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
63RISK
open ↗VulnCheck XDB
initial-access
Microsoft SharePoint Server Remote Code Execution Vulnerability
41RISK
open ↗GitHub PoC
Detector + root-cause analysis for CVE-2026-72898 (Metabase unauthenticated SQLi via reset_password)
Metabase SQL injection via password reset endpoint
100RISK
open ↗VulnCheck XDB
initial-access
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
63RISK
open ↗VulnCheck XDB
initial-access
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
63RISK
open ↗GitHub PoC
Threat model and vulnerability analysis of Contec SolarView Compact (CVE-2022-29303)
SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.
100RISK
open ↗GitHub PoC
PoC for CVE-2026-19632 - TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
63RISK
open ↗VulnCheck XDB
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISK
open ↗VulnCheck XDB
initial-access
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
100RISK
open ↗GitHub PoC★ 2
CVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
63RISK
open ↗GitHub PoC
zenzue/CVE-2026-55040
Microsoft SharePoint Server Security Feature Bypass Vulnerability
100RISK
open ↗GitHub PoC
WooCommerce plugin: photo & video product reviews, closing CVE-2026-12684's unauthenticated-upload vulnerability class by construction
Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media
33RISK
open ↗GitHub PoC★ 4
Zimbra SNMP Notification OS Command Injection — Unauthenticated RCE via SMTP exploit (Poc)
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
100RISK
open ↗GitHub PoC
t3bik/CVE-2026-75898
RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component
41RISK
open ↗VulnCheck XDB
initial-access
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISK
open ↗VulnCheck XDB
initial-access
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
100RISK
open ↗VulnCheck XDB
initial-access
WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
63RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.