Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,781cataloged exploits

36,771CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,475Referência 23,305GitHub PoC 15,197VulnCheck XDB 8,932Nuclei 4,379Metasploit 3,493✓ verified onlyrecent popular risk

79,781 exploits

GitHub PoC★ 1

Custom Content Types and Fields plugin for WordPress

CVE-2026-19598CRITICAL21 Aug 2026

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

63RISK

open ↗

GitHub PoC

PoC for J2Store CVE-2026-67358–67362 (J2Commerce security advisory Aug 2026)

CVE-2026-67358MEDIUM21 Aug 2026

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

33RISK

open ↗

GitHub PoC

CVE-2022-36804 Bitbucket command execution and file transfer tool

CVE-2022-36804HIGHunder attack21 Aug 2026

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef

100RISK

open ↗

GitHub PoC★ 8

CVE-2026-32475 The Elementor Pro Forms File Upload field handles validation and file processing in two separate loops with different handling of empty upload entries (UPLOAD_ERR_NO_FILE). An unauthenticated attacker can submit a multipart

CVE-2026-32475CRITICAL21 Aug 2026

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

63RISK

open ↗

GitHub PoC★ 5

CVE-2026-73570

CVE-2026-73570HIGHunder attack21 Aug 2026

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp

98RISK

open ↗

VulnCheck XDB

client-side

CVE-2024-4947CRITICALunder attack21 Aug 2026

Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside

83RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-8181CRITICAL21 Aug 2026

Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover

68RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-60137MEDIUMunder attack21 Aug 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

100RISK

open ↗

GitHub PoC

Stored XSS via User-Agent in Admin Order View in PhocaCart

CVE-2026-76564HIGH21 Aug 2026

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

41RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-33032CRITICAL21 Aug 2026

Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

75RISK

open ↗

GitHub PoC★ 1

PoC for CVE-2026-58455: Dockwatch <=0.6.567 unauthenticated RCE. Stdlib-only Python.

CVE-2026-58455CRITICAL21 Aug 2026

Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php

63RISK

open ↗

VulnCheck XDB

local

CVE-2022-2586MEDIUMunder attack21 Aug 2026

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-a

68RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-63030CRITICALunder attack21 Aug 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISK

open ↗

VulnCheck XDB

remote-with-credentials

CVE-2022-36804HIGHunder attack21 Aug 2026

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef

100RISK

open ↗

GitHub PoC

CVE-2026-69836 - Draft or TODO

CVE-2026-69836CRITICAL21 Aug 2026

Microsoft Entra ID Remote Code Execution Vulnerability

48RISK

open ↗

GitHub PoC★ 1

CVE-2026-69836 — Unauthenticated RCE via Entra ID deserialization

CVE-2026-69836CRITICAL21 Aug 2026

Microsoft Entra ID Remote Code Execution Vulnerability

48RISK

open ↗

GitHub PoC

CVE-2026-41567 1day

CVE-2026-41567HIGH21 Aug 2026

Docker: `PUT /containers/{id}/archive` executes container binary on the host

41RISK

open ↗

GitHub PoC

JCEzploit is a powerful, fully-automated RCE exploit for Joomla JCE (CVE-2026-48907) featuring interactive shell, batch command execution, file download capability, and proxy support. Built with Python & Rich for penetration testers. Ethical use only. By Sudeepa Wanigarathna.

CVE-2026-48907CRITICALunder attack21 Aug 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISK

open ↗

GitHub PoC

Reflected XSS via price_from & price_to Filter Parameters in PhocaCart

CVE-2026-76565MEDIUM21 Aug 2026

Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7

33RISK

open ↗

VulnCheck XDB

info-leak

CVE-2026-65400CRITICALunder attack21 Aug 2026

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS

78RISK

open ↗

GitHub PoC★ 1

Educational use only!

CVE-2026-64638HIGH21 Aug 2026

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malici

68RISK

open ↗

GitHub PoC

CVE-2026-39113: SQLite SQLAR heap-buffer-overflow advisory and reproducer

CVE-2026-39113MEDIUM21 Aug 2026

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3a

33RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-58455CRITICAL21 Aug 2026

Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php

63RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-32475CRITICAL21 Aug 2026

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

63RISK

open ↗

GitHub PoC★ 7

Read-only PoC for CVE-2026-65400 — macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file read. Patched in macOS 26.6.1 / 15.7.9 / 14.8.9.

CVE-2026-65400CRITICALunder attack21 Aug 2026

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS

78RISK

open ↗

GitHub PoC★ 1

Hunt-Benito/rendering-code-outside-the-sandbox-cve-2026-76036-dawn-webgpu-buffer-overflow-in-chrome-on-android

CVE-2026-76036CRITICAL21 Aug 2026

Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbi

48RISK

open ↗

GitHub PoC★ 2

wp2shell — WordPress Core Pre-Auth RCE Chain poc for CVE-2026-63030 and CVE-2026-60137

CVE-2026-63030CRITICALunder attack21 Aug 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISK

open ↗

GitHub PoC★ 15

Hunt for CVE-2026-18963 exploitation traces (Keycloak unauthenticated account takeover) in the Keycloak database

CVE-2026-18963CRITICAL20 Aug 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RISK

open ↗

GitHub PoC

Proof-of-concept for CVE-2026-18315 (TrueBooker WordPress Plugin): Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover

CVE-2026-18315CRITICAL20 Aug 2026

TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter

48RISK

open ↗

GitHub PoC

aarch64 race condition checker

CVE-2026-46242HIGH20 Aug 2026

eventpoll: fix ep_remove struct eventpoll / struct file UAF

41RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.