Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC★ 3
CVE-2026-98260 (exec: posix timer UAF) LKM jailbreak for OPPO Find X10 Pro Max (PMX110) and OnePlus 16 (PYB110): one-command root via shell uid 2000, with KernelSU / FinaSU / SukiSU / KernelSU-Next handover. Release build Root618 1.5.12 (R8-obfuscated).
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 5
CVE 2026 98260 vivo x fold6 poc
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 1
Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
poc of CVE-2026-111497 delivered as a WOFF2 file
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Reproducer for CVE-2026-95663 — Apache Camel camel-keycloak served a cached token introspection result past the token's expiry (CWE-613). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
33RISK
open ↗GitHub PoC
Log4Shell (CVE-2021-44228) remediation tracking notes and checklist
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
The layer that protects you. Proactive defense-in-depth Web Application Firewall mitigating recent critical PHP engine vulnerabilities including PHP2Shell (CVE-2026-109618/9), PHP-CGI Argument Injection (CVE-2024-4577), iconv Filter Chains (CVE-2024-2961), and stream wrapper abuse.
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC
bianchiSLR/cve-2018-17463-lab
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbit
100RISK
open ↗GitHub PoC
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC
Work 1 — secure Flask REST API, three-stage CI, and CVE-2024-23897 (Jenkins CLI) analysis
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISK
open ↗GitHub PoC
Log4Shell (CVE-2021-44228) security briefing research: remediation checklist and write-up
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC★ 1
Realistic multi-version lab + toolkit for the PHP php2shell pre-auth RCE (CVE-2026-109618/109619): detect, blindly prove, and understand it. No shared mounts, no planted files, no LFI.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Verified CVE-2026-98260 Android port for Xiaomi 15 dada OS4.0.0.22.XOCCNXM
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 1
Scanner to checking (CVE-2026-111497) vulnerability
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC★ 26
Xplo8E/CVE-2026-112621-oob-write-poc
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2
41RISK
open ↗VulnCheck XDB
initial-access
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISK
open ↗GitHub PoC
A practical collection of cybersecurity CTF labs covering real-world CVE exploitation, zero-day/N-day vulnerability analysis (Citrix Bleed, FortiGate SSL VPN, Apache Superset CVE-2023-27524, Ivanti VPN, ColdFusion WDDX, Veeam, HTTP/2 Rapid Reset), and Red Team fundamentals.
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
100RISK
open ↗VulnCheck XDB
local
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
76RISK
open ↗GitHub PoC★ 3
PHP2Shell (CVE-2026-109618/109619): demos reproducibles y guia de parcheo paso a paso.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Log4Shell (CVE-2021-44228) remediation tracking and security research notes
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
Quarterly security briefing notes and Log4Shell (CVE-2021-44228) remediation tracking
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
Tracking repo for our quarterly Log4Shell (CVE-2021-44228) security briefing.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC★ 1
Remote Zend MM ASLR leak testbed (PHP CVE-2026-109618 / CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
php2shell (CVE-2026-109618/109619) reproduction lab — lab only, targets the vulnerable php:8.5.11 images
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 24
Independent discovery & coordinated disclosure: CoreMedia bytestream XPC (mediaplaybackd) vended live file descriptors for protected paths to any sandboxed app on iOS 26.5–27.0.1. Fixed in iOS 27.2 as CVE-2026-112706. PoC + evidence.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.