Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC
CLI scanner and PoC for CVE-2026-109618 / CVE-2026-109619 (PHP OOM heap corruption and session upload-progress injection, CVSS 9.2). Affects PHP 5.4.0-8.5.11; patched in 8.2.35, 8.3.36, 8.4.27, 8.5.12. No external dependencies.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Reproducer for CVE-2026-95664 — Apache Camel camel-aws2-s3 evaluated a header-supplied object key as a Simple expression (CWE-917). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
33RISK
open ↗GitHub PoC
Reproducer for CVE-2026-95628 — Apache Camel camel-docling custom-argument path validation did not reject absolute paths, an incomplete fix of CVE-2026-40047 (CWE-22). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)
33RISK
open ↗GitHub PoC★ 1
Scanner to checking (CVE-2026-111497) vulnerability
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Reproducer for CVE-2026-95629 — Apache Camel camel-docling passed the CamelDoclingOutputFilePath header to docling's --output verbatim (CWE-22). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
33RISK
open ↗GitHub PoC★ 26
Xplo8E/CVE-2026-112621-oob-write-poc
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2
41RISK
open ↗GitHub PoC
Reproducer for CVE-2026-101259 — Apache Camel camel-coap consumer sent the exception message to the CoAP client as a 5.00 payload (CWE-209). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
33RISK
open ↗GitHub PoC★ 1
Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC★ 1
kpatch livepatch for CVE-2026-98432 (and CVE-2026-99999) on AlmaLinux and Rocky Linux 8, 9 and 10
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC★ 5
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 1
cve-2026-98432 audit script (ipv4 TCP inet_opt/ireq_opt use-after-free)
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
suominen/CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
bianchiSLR/cve-2018-17463-lab
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbit
100RISK
open ↗GitHub PoC
Reproducer for CVE-2026-95663 — Apache Camel camel-keycloak served a cached token introspection result past the token's expiry (CWE-613). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
33RISK
open ↗GitHub PoC
aymencdm/cve-2026-92424-content-egg-stored-xss-
Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue
33RISK
open ↗GitHub PoC
poc of CVE-2026-111497 delivered as a WOFF2 file
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Reproducer for CVE-2026-90885 — Apache Camel camel-saxon XQuery XML External Entity via an already-built javax.xml.transform.Source (CWE-611, HIGH). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
41RISK
open ↗GitHub PoC
Reproducer for CVE-2026-94386 — Apache Camel camel-oauth cross-scope token reuse via a JVM-global token cache keyed only on endpoint+clientId (CWE-524). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache
33RISK
open ↗GitHub PoC★ 1
PoC CVE-2026-88804 (Rancher)
Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
63RISK
open ↗GitHub PoC
Reproducer for CVE-2026-71569 — Apache Camel camel-a2a push-notification webhook guard accepted an IPv6 unique local address (fc00::/7) reached through a host name (CWE-918). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name
33RISK
open ↗GitHub PoC
Adapted PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISK
open ↗GitHub PoC
Exploit for CVE-2026-104286 — FortiMail: Unauthenticated Arbitrary File Write → Code Execution
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
78RISK
open ↗GitHub PoC
SOC-style investigation of a Netflix phishing email, CVE-2017-11882 exploitation, IOC extraction, and detection engineering mapping.
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi
100RISK
open ↗GitHub PoC★ 1
Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Tracking repo for our quarterly Log4Shell (CVE-2021-44228) security briefing.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.