Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,035cataloged exploits
39,531CVEs with public exploitation
24,695lab-tested
AllReferência 25,557Exploit-DB 24,485GitHub PoC 16,313VulnCheck XDB 9,678Nuclei 4,478Metasploit 3,524✓ verified onlyrecentpopularrisk
16,313 exploits
GitHub PoC
Android/ARM64 port
mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
41RISK
open ↗GitHub PoC
CVE-2026-98180 — drm/msm use-after-free of the scheduler-containing ring and VM objects (fixed by 01c8d1f385f7)
drm/msm: RCU-free the scheduler-containing ring and VM objects
41RISK
open ↗GitHub PoC★ 3
CVE-2026-103849 (BlockStrap) reproduction lab: unauthenticated {{block}} injection on Magento 2.4.9 via guest GraphQL, A/B vs APSB26-153; command execution only through a labeled synthetic gadget, not stock classes.
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
48RISK
open ↗GitHub PoC
Reproducer for CVE-2026-80312 (Apache Camel camel-oauth): fail-open authentication guard — the OAuth processors returned control to the route instead of terminating when auth could not complete — Camel Spring Boot + Camel Quarkus
Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors
38RISK
open ↗GitHub PoC
A slow, from-zero walk through a Linux kernel privilege-escalation bug (CVE-2026-98260)
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC
Reproducer for CVE-2026-80343 (Apache Camel camel-netty-http): security constraint case-sensitivity bypass — altering the path case skips the constraint while routing still dispatches to the protected endpoint — Camel Spring Boot + Camel Quarkus
Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching
38RISK
open ↗GitHub PoC★ 6
CVE-2026-98260 (Timer) Android/ARM64 port
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC
kpatch livepatch build for CVE-2026-99999 on AlmaLinux 8/9 GA kernels
ipv4: validate checksum_start before completing checksum
48RISK
open ↗GitHub PoC
PoC for CVE-2026-92262, CVE-2026-85746, CVE-2026-85748 against MariaDB 13.0.1
MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
48RISK
open ↗GitHub PoC
Reviewed isolated comparison lab for CVE-2026-71557
go-git: Malicious reference names may modify files outside the reference storage
33RISK
open ↗GitHub PoC
kpatch livepatch build for CVE-2026-99999 on AlmaLinux 8/9 GA kernels
ipv4: validate checksum_start before completing checksum
48RISK
open ↗GitHub PoC
PoC for CVE-2026-104736 — LearnPress ≤4.4.10 unauthenticated PHP object injection via checkout-email (lp-ajax=checkout). Check + exploit. Authorized testing only.
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
48RISK
open ↗GitHub PoC
Android/ARM64 port
mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race
41RISK
open ↗GitHub PoC★ 2
CVE-2026-99999 PwnEscape PoC - Linux kernel IPv4 csum_start validation bug guest-to-host memory leak (CVSS 9.3)
ipv4: validate checksum_start before completing checksum
48RISK
open ↗GitHub PoC
kingahmadr/CVE-2026-99999-kernel-check
ipv4: validate checksum_start before completing checksum
48RISK
open ↗GitHub PoC★ 1
Panduan Praktikum Edukasi: Deteksi Versi Cisco ASA & FTD (CVE-2026-20349)
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
71RISK
open ↗GitHub PoC★ 1
Android/ARM64 port
futex: Fix race on the initial mm->futex.phash.ref allocation
23RISK
open ↗GitHub PoC
PoC for CVE-2026-111823 — Mage AI OAuth session auth bypass (POST /api/sessions). Check + exploit modes. Authorized testing only.
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
48RISK
open ↗GitHub PoC
Probe MCP OAuth discovery issuer validation (CVE-2026-104850 class)
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
21RISK
open ↗GitHub PoC★ 1
Passive internet-wide discovery + responsible-disclosure helper for CVE-2026-74580 (Linux vhost metadata-cache bug) — queries existing scan data (Sonar/Shodan/Censys), triages exposure, and drafts (never auto-sends) notices to owners.
vhost: reset the vring metadata cache on vring reconfiguration
41RISK
open ↗GitHub PoC★ 1
CVE-2026-64560 temporary-root exploit for realme RMX6699 (Snapdragon 8 Elite, kernel 6.6.118, Android 17/COOS17)
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISK
open ↗GitHub PoC★ 10
PoC for CVE-2026-99999 (PwnEscape) on a prepared TAP.
ipv4: validate checksum_start before completing checksum
48RISK
open ↗GitHub PoC
songzzzz/CVE-2026-8933
snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup
41RISK
open ↗GitHub PoC
Vulnerability analysis, exploitation, and multi-layered defense hardening for Apache Struts 2 (CVE-2017-5638) & Windows Print Spooler / PrintNightmare (CVE-2021-34527) with ELK SIEM monitoring and Windows Event Log auditing.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISK
open ↗GitHub PoC
CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
Plex Media Server SSRF
33RISK
open ↗GitHub PoC★ 2
cve-2026-99999-audit script (PwnEscape)
ipv4: validate checksum_start before completing checksum
48RISK
open ↗GitHub PoC
SQL Injection via unquoted numeric concatenation in SLiMS 9.8.0 admin modules (subscription.php & dl_detail.php). CVE-2026-107083.
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/r
45RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.