Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
17,609 exploits
GitHub PoC★ 3
Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload [POC & Xploit]
Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload
48RISK
open ↗GitHub PoC
1-day exploit for CVE-2026-45258
Multiple vulnerabilities in the sound(4) mmap path
41RISK
open ↗GitHub PoC★ 1
OSCP like CVE-2025-24893 exploit for Linux XWiki
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC★ 3
PoC de CVE-2026-11645: lectura/escritura fuera de limites en Chrome V8 (CVSS 8.8).
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitra
71RISK
open ↗GitHub PoC
CVE-2026-48962 - IO::Compress - Code Execution
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob
41RISK
open ↗GitHub PoC
1-day exploit for CVE-2026-49417
Multiple vulnerabilities in the sound(4) mmap path
41RISK
open ↗GitHub PoC★ 1
PoC de CVE-2026-50751: bypass de autenticacion IKEv1 en Check Point Remote/Mobile Access.
User Authentication Bypass in VPN Remote Access and Mobile Access
100RISK
open ↗GitHub PoC
Layer-6/CVE-2026-5027-Langflow
Langflow - Path Traversal Arbitrary File Write via upload_user_file
68RISK
open ↗GitHub PoC
adamshaikhma/CVE-2026-11645
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitra
71RISK
open ↗GitHub PoC
PoC de CVE-2026-20245: escalada de privilegios en Cisco SD-WAN. Solo fines educativos y pruebas autorizadas.
Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability
76RISK
open ↗GitHub PoC
Dhananjayasj/CVE-2025-24813-Apache-Tomcat-Partial-PUT-Deserialization-RCE-
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC★ 1
SolarWinds Serv-U CVE-2026-28318: unauthenticated Content-Encoding: deflate crash. Root-cause analysis (invalid free of an interior pointer -> heap corruption) + DoS-only PoC. Fixed in 15.5.4 Hotfix 1.
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
83RISK
open ↗GitHub PoC
jenniferreire26/CVE-2026-0257
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
100RISK
open ↗GitHub PoC
CVE-2026-42271 - Draft
LiteLLM: Authenticated command execution via MCP stdio test endpoints
100RISK
open ↗GitHub PoC★ 1
Insert PHP Plugin PHP Code Injection
WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API
48RISK
open ↗GitHub PoC
dotCMS Pre-auth SQL Injection
Unauthenticated SQL Injection in dotCMS Publish Audit API
63RISK
open ↗GitHub PoC
fevar54/CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
93RISK
open ↗GitHub PoC
jenniferreire26/CVE-2024-21182
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
93RISK
open ↗GitHub PoC
Running OWASP cve-lite-cli against the pi monorepo: scan journey and key finding (vitest CVE-2026-47429).
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
48RISK
open ↗GitHub PoC
kennedy-aikohi/mcpjam-cve-2026-23744-validator
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISK
open ↗GitHub PoC
CVE-2026-45247 - Mirasvit Full Page Cache Warmer for Magento 2 Unauthenticated PHP Object Injection -> Remote Code Execution
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
83RISK
open ↗GitHub PoC
Patched google_gax 0.4.1 for Tesla 1.18.3+ compatibility (CVE-2026-48598)
CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection
28RISK
open ↗GitHub PoC
PoC and writeup for CVE-2026-46394: OS command injection in HAXcms Git.php (CWE-78). Authorized security research only.
HAX CMS Vulnerable to Command Injection using Git.php
41RISK
open ↗GitHub PoC★ 1
PoC de CVE-2025-48595: desbordamiento de entero en multiples ubicaciones del Framework de Android.
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to
71RISK
open ↗GitHub PoC
CVE-2021-44228 漏洞复现完整记录（含环境搭建、触发验证）
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.