Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,150cataloged exploits

39,601CVEs with public exploitation

24,695lab-tested

All Referência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecent popular risk

16,343 exploits

GitHub PoC

Hands-on Learn SecByte CTF labs covering Beelzebub preparation, VM and network clues, Base64, CVE-2026-14461, admin panels, authentication, credential leaks, kernel security, reused keys, SQLMap, and web-to-root concepts.

CVE-2026-14461MEDIUM03 Oct 2026

Out-of-bound read in mtr

33RISK

GitHub PoC★ 1

Unauthenticated Privilege Escalation Mass Exploit Super Forms <= 6.3.316 CVE-2026-15989

CVE-2026-15989CRITICAL03 Oct 2026

Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

48RISK

GitHub PoC

A python3 PoC for CVE-2026-105030 Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API

CVE-2026-105030MEDIUM03 Oct 2026

Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API

33RISK

GitHub PoC

An end-to-end infrastructure penetration testing lab showcasing automated scanning (Nikto), remote code execution (CVE-2012-1823), and manual kernel privilege escalation to Root (CVE-2008-0600).

CVE-2008-0600—03 Oct 2026

The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer befo

23RISK

GitHub PoC

Infrastructure penetration-testing lab demonstrating reconnaissance, CVE-2012-1823 exploitation, initial access, and privilege-escalation investigation.

CVE-2012-1823CRITICALunder attack03 Oct 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RISK

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-90970CRITICAL03 Oct 2026

Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

48RISK

GitHub PoC

Guest-to-host KVM/x86 escape exploiting CVE-2026-64561, delivering a full PoC chain and analysis for security researchers.

CVE-2026-64561HIGH03 Oct 2026

KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

41RISK

GitHub PoC★ 4

Proof-of-concept scanner and exploit helper for CVE-2026-14378: unauthenticated administrator session takeover in the WordPress plugin DevKit Pro (dplugins) through a flawed user-switch “revert” flow.

CVE-2026-19660CRITICAL03 Oct 2026

Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

48RISK

GitHub PoC

Proof of concept for CVE-2026-92592: Craft CMS authenticated RCE

CVE-2026-92592HIGH03 Oct 2026

Craft CMS before 4.18.6 Remote Code Execution via signed cookie

41RISK

GitHub PoC

MotionEye OS Command Injection (CVE-2025-60787)

CVE-2025-60787HIGH03 Oct 2026

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name

61RISK

GitHub PoC★ 2

CVE-2026-103648 | Path Traversal in image-downloader 4.3.0 | CVSS 9.1 Critical | CWE-22 | By EterNullSec

CVE-2026-103648CRITICAL03 Oct 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

48RISK

GitHub PoC

CVE-2026-102282: adm-zip LPE via SUID/SGID preservation during archive extraction (fixed in 0.6.1)

CVE-2026-102282HIGH02 Oct 2026

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

41RISK

GitHub PoC

Exploitability PoC for CVE-2026-102-268 (PyJWT Asymmetric-PEM detection bypass).

CVE-2026-102268CRITICAL02 Oct 2026

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

48RISK

GitHub PoC★ 1

Unauthenticated RCE in Yamcs mission control via YAML injection in reconfigureInstance()

CVE-2026-55559CRITICAL02 Oct 2026

Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)

48RISK

GitHub PoC

Divi Membership (DiviEngine) pre-auth admin takeover — CVE-2026-19660 paypal_param bypass. Python PoC with exploit + cookie export.

CVE-2026-19660CRITICAL02 Oct 2026

Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

48RISK

GitHub PoC★ 1

Meniben/redmi14c-pond-cve-2026-64560

CVE-2026-64560HIGH02 Oct 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISK

GitHub PoC

Out-of-bounds Write (CWE-787)

CVE-2026-86950HIGHunder attack02 Oct 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2

71RISK

GitHub PoC★ 2

Exploited a known RCE vulnerability (PHP-CGI Argument Injection, CVE-2012-1823) on Metasploitable2 using Metasploit Framework, gained a shell, and documented post-exploitation

CVE-2012-1823CRITICALunder attack02 Oct 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RISK

GitHub PoC★ 4

Path Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup.

CVE-2026-100520HIGH02 Oct 2026

Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

41RISK

GitHub PoC

CPython - High - wrap_bio hostname skip

CVE-2026-19553HIGH02 Oct 2026

SSLContext.wrap_bio() missing validation of server_hostname parameter

41RISK

GitHub PoC

LipeOzyy/CVE-2026-42322

CVE-2026-42322CRITICAL02 Oct 2026

Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

48RISK

GitHub PoC★ 1

CVE-2026-88773

CVE-2026-88773CRITICAL02 Oct 2026

HTTP Request Smuggling

48RISK

GitHub PoC

CPython - Critical - SNI SSLContext UAF

CVE-2026-19445CRITICAL02 Oct 2026

Use-after-free of a server-side SSLContext when sni_callback switches contexts

48RISK

GitHub PoC

CVE-2026-63292

CVE-2026-63292HIGH02 Oct 2026

Apache HTTP Server: mod_vhost_alias stack overflow

41RISK

GitHub PoC

Defensive analysis, patch breakdown, and passive detection scanner for CVE-2026-103752 (WordPress Authorizer Plugin <= 3.15.3).

CVE-2026-103752CRITICAL02 Oct 2026

WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability

48RISK

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-103922CRITICAL02 Oct 2026

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

48RISK

GitHub PoC★ 2

Predictable delete_code via rand() in PictShare < 3.7.1 (CWE-338). PoC + advisory writeup.

CVE-2026-104356HIGH02 Oct 2026

PictShare < 3.7.1 Predictable Delete Code via rand()

41RISK

GitHub PoC

watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs

CVE-2026-88771CRITICALunder attack02 Oct 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

78RISK

GitHub PoC

CVE-2026-15989 Super Forms <= 6.3.316 unauthenticated privilege escalation (mass scanner + exploit)

CVE-2026-15989CRITICAL02 Oct 2026

Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

48RISK

GitHub PoC

Penetration testing portfolio: FTP vulnerability assessment & exploitation in isolated lab. Demonstrates network reconnaissance, CVE-2011-2523 validation, and post-exploitation verification. Complete methodology with evidence, findings, and remediation guidance.

CVE-2011-2523—02 Oct 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.