Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

88,056 exploits

GitHub PoC★ 1

Apache HTTP Server 2.4.x mod_lua Buffer Overflow (CVE-2021-44790) - Advanced exploitation framework with fingerprinting, multi-stage scanning, plugin architecture, professional reporting, screenshot capture, SQLite database, and 95%+ confidence detection. Author: Sudeepa Wanigarathna.

CVE-2021-44790—04 Aug 2026

Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

45RISK

GitHub PoC

0xdak/CVE-2025-32463_exploit

CVE-2025-32463CRITICALunder attack04 Aug 2026

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RISK

GitHub PoC★ 1

0xdak/CVE-2026-59243_exploit

CVE-2026-59243CRITICAL04 Aug 2026

Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

48RISK

GitHub PoC

George0Papasotiriou/CVE-2026-11120-Command-Injection-via-Git-URL-in-CI-CD-Pipeline

CVE-2026-11120CRITICAL04 Aug 2026

Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allowed a rem

48RISK

GitHub PoC

0xdak/CVE-2026-14483_exploit

CVE-2026-14483CRITICAL04 Aug 2026

Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command

63RISK

GitHub PoC

George0Papasotiriou/CVE-2026-21015-PHP-Filter-Chain-Arbitrary-File-Read

CVE-2026-21015MEDIUM04 Aug 2026

Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique id

33RISK

GitHub PoC

George0Papasotiriou/CVE-2026-21016-Malicious-PyPI-Package-Install-Hook-setup.py-Execution-

CVE-2026-21016MEDIUM04 Aug 2026

Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensi

33RISK

VulnCheck XDB

initial-access

CVE-2026-60137MEDIUMunder attack04 Aug 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RISK

GitHub PoC★ 5

WordPress All-in-One Exploit Framework — detector, scanner, enumerator, exploit, escalation. 10 CVEs from the 2026-08 wave incl. CVE-2026-63030 (wp2shell).

CVE-2026-63030CRITICALunder attack04 Aug 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISK

GitHub PoC★ 1

CVE-2026-66066 — KindaRails2Shell: Rails Active Storage/libvips Arbitrary File Read → RCE. MATLAB/HDF5 dual-identity file → SECRET_KEY_BASE theft → forged variation. CVSS 9.5 | Rails < 8.1.3.1

CVE-2026-66066CRITICAL04 Aug 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

75RISK

GitHub PoC

George0Papasotiriou/CVE-2026-11119-Padding-Oracle-Attack-on-CBC-Mode-Encryption

CVE-2026-11119CRITICAL04 Aug 2026

Inappropriate implementation in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had

48RISK

GitHub PoC

0xdak/CVE-2026-52680_exploit

CVE-2026-52680CRITICAL04 Aug 2026

Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write

48RISK

GitHub PoC★ 1

JVBotelho/cve-2026-69243-poc-aiohttp-smuggling

CVE-2026-69243MEDIUM04 Aug 2026

AIOHTTP: HTTP request smuggling via WebSocket upgrade

33RISK

GitHub PoC

Safe PowerShell validator for PHP CVE-2026-17543 exposure via HTTP headers and non-destructive login-form probes.

CVE-2026-17543HIGH04 Aug 2026

SQL injection in ext-pgsql via E'...' backslash breakout

41RISK

VulnCheck XDB

initial-access

CVE-2021-41773HIGHunder attackransomware04 Aug 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

GitHub PoC

George0Papasotiriou/CVE-2026-11113-SMTP-Header-Injection-in-Contact-Form

CVE-2026-11113CRITICAL04 Aug 2026

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker wh

48RISK

GitHub PoC

George0Papasotiriou/CVE-2026-21017-LDAP-Anonymous-Bind-Privilege-Escalation

CVE-2026-21017MEDIUM04 Aug 2026

Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attack

33RISK

GitHub PoC

George0Papasotiriou/CVE-2026-11112-XXE-via-SVG-Image-Upload

CVE-2026-11112CRITICAL04 Aug 2026

Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remo

48RISK

GitHub PoC

George0Papasotiriou/CVE-2026-11115-Database-Connection-String-Injection-via-Env-Variable

CVE-2026-11115HIGH04 Aug 2026

Use after free in Updater in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-leve

41RISK

GitHub PoC

0xdak/CVE-2026-67340_exploit

CVE-2026-67340HIGH04 Aug 2026

ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

41RISK

GitHub PoC

Technical analysis and PoC of CVE-2026-52824: default APP_SECRET in the Kimai Docker image enabling unauthenticated login link forgery. Affects <= 2.57.0, fixed in 2.58.0.

CVE-2026-52824CRITICAL04 Aug 2026

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

63RISK

GitHub PoC★ 3

GhostLock (CVE-2026-43499) kernel exploit for samsung devices with locked bootloader

CVE-2026-43499HIGH04 Aug 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

GitHub PoC

webshellseo8/CVE-2026-12720-Proof-of-Concept

CVE-2026-12720HIGH04 Aug 2026

Kirki < 6.0.13 - Unauthenticated PHP Object Injection

41RISK

GitHub PoC

🚨 Threat intel & incident response research on SharePoint "ToolShell" RCE zero-day (CVE-2025-53770). 🕵️‍♂️ Covers root-cause deserialization flaws, attack timelines, risk metrics, and defensive EDR validation playbooks. 🛡️

CVE-2025-53770CRITICALunder attackransomware04 Aug 2026

Microsoft SharePoint Server Remote Code Execution Vulnerability

100RISK

GitHub PoC

George0Papasotiriou/CVE-2026-11111-TOCTOU-in-File-Permission-Check-Before-Open

CVE-2026-11111HIGH04 Aug 2026

Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bound

41RISK

GitHub PoC

CVE-2026-18577 - Draft

CVE-2026-18577HIGHunder attack04 Aug 2026

Incomplete patch leads to administrative account takeover

91RISK

GitHub PoC

x-znn/CVE-2026-63030

CVE-2026-63030CRITICALunder attack04 Aug 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISK

VulnCheck XDB

local

CVE-2025-32463CRITICALunder attack04 Aug 2026

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RISK

GitHub PoC

Shams-Ul-Mehmood/CVE-2021-41773-Exploit

CVE-2021-41773HIGHunder attackransomware04 Aug 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

GitHub PoC

CVE-2026-13934

CVE-2026-13934CRITICAL04 Aug 2026

Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.47 allowed a remote a

48RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.