Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
88,056 exploits
GitHub PoC
Reproduction of cve-2024-3400-panos_rce_reproduction
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
100RISK
open ↗GitHub PoC
finding by nvth
Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
21RISK
open ↗GitHub PoC
CVE Reproduction: cve-2024-4577-phpcgi_rce_reproduction
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC
ghostpels/CVE-2026-13001
Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
63RISK
open ↗GitHub PoC
CVE Reproduction: cve-2026-0770-langflow_rce_reproduction
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC
CVE Reproduction: cve-2025-5777-citrixbleed2_reproduction
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISK
open ↗GitHub PoC
Dynamo2k1/CVE-2026-33017
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISK
open ↗GitHub PoC
CVE Reproduction: cve-2025-2783-chrome_sandbox_escape_reproduction
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allow
71RISK
open ↗GitHub PoC★ 1
Metabase CVE-2026-59827 Vulnerability Scanner
Metabase: Unsafe Deserialization of H2 Query Results
48RISK
open ↗GitHub PoC★ 332
Certighost POC
Active Directory Certificate Services Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC
Legacy HPE iMC vuln
A disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than ve
23RISK
open ↗GitHub PoC
CVE-2026-66374: Knot Resolver 6.3.0 DNS-over-QUIC heap overflow (RCE)
Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) rece
41RISK
open ↗GitHub PoC
Proof-of-concept and offensive security research analyzing CVE-2026-23744 (MCPJam Inspector Unauthenticated RCE, Patched in v1.4.3+).
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISK
open ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
open ↗GitHub PoC★ 495
Android complete exploit chain that enables privilege escalation from a local untrusted app to root/kernel, combination of CVE-2026-49881 and CVE-2026-43284
In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the
41RISK
open ↗GitHub PoC
CVE Reproduction: cve-2025-55182-react2shell_reproduction
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC★ 2
Exploit for CVE-2026-64560, kernelctf-lts-6.12.95
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISK
open ↗GitHub PoC
FernandoCassioDev/CVE-2015-1328
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no
50RISK
open ↗VulnCheck XDB
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗GitHub PoC
GitHub Actions workflow sandbox for CVE-2026-45132 reproduction
CloudPirates Open Source Helm Charts: GitHub Actions workflow leaks PAT and SSH signing key via unsafe credential handling
48RISK
open ↗VulnCheck XDB
info-leak
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISK
open ↗GitHub PoC
CVE Reproduction: cve-2026-63030_60137-wordpress_rce_reproduction
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
open ↗VulnCheck XDB
local
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o
98RISK
open ↗GitHub PoC★ 4
soralis0912/CVE-2026-43499-aristotle
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.