Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
16,343 exploits
GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
71RISK
open ↗GitHub PoC★ 5
三星 Galaxy S25 Ultra（SM-S938B）适配版 DFRoot：开机自动获取 root（DirtyFrag CVE-2026-43284 + CVE-2026-43499 双链路），全中文界面，fork 自 diabl0w/DFRoot
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
open ↗GitHub PoC★ 1
CVE-2026-100740 PoC: D-Link DIR-895L A1_102b07 L2TP Host Name AVP out-of-bounds write in tunnel_set_params (UDP 1701). Device fingerprint + optional OOB trigger packet for authorized lab testing. https://pocbit.org/pocs/cve-2026-100740
D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write
48RISK
open ↗GitHub PoC
CVE-2026-100835 PoC: Edgeless Contrast <1.16.0 remote attestation relay (aTLS / CWE-295). Manifest audit (AllowedChipIDs/AllowedPIIDs), version & coordinator probe. https://pocbit.org/pocs/cve-2026-100835
Contrast before 1.16.0 Remote Attestation Relay Attack
48RISK
open ↗GitHub PoC★ 22
watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RISK
open ↗GitHub PoC
CVE-2026-43805 IOKit IODMACommand race analysis and proof of concept
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequ
48RISK
open ↗GitHub PoC★ 11
watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
78RISK
open ↗GitHub PoC
snapshot of logpresso/CVE-2021-44228-Scanner at a pinned commit, for cross platform ci legs
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
A Windows-friendly, non-destructive Python checker for detecting WordPress installations potentially affected by CVE-2026-14281.
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
48RISK
open ↗GitHub PoC
CVE-2026-8712: Unauthenticated SSRF / Backend URI Override in Wyoming HTTP API via uri Query Parameter
Wyoming < 1.10.2 SSRF via uri Query Parameter
33RISK
open ↗GitHub PoC★ 5
CVE-2026-67279 + CVE-2026-86060 – MikroTrick MikroTik RouterOS SSH Pre-Auth Takeover (CVSS 9.2) | Red/Blue Team suite. 2 tools: Full Exploit (rekey bypass, fd-2 policy swap, full-admin shell, plant, mass scan, SOCKS5/Tor, stealth) & SafeDetect (banner/version audit, IoC guidance, JSON/CSV/HTML). Use Ethically & Safety only.
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
63RISK
open ↗GitHub PoC★ 1
Reproduction and root cause analysis of CVE-2026-39987 Marimo pre-auth WebSocket RCE in a local Docker lab.
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
open ↗GitHub PoC★ 1
Defensive WordPress security scanner for CVE-2026-87902 — local filesystem inspection and safe remote HTTP/HTTPS assessment.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
CVE-2020-14008 — ManageEngine Applications Manager Remote Code Execution
Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in
35RISK
open ↗GitHub PoC★ 3
nth347/mediawiki-CVE-2026-100382
Unauthenticated remote code execution through wikitext in ExternalData
48RISK
open ↗GitHub PoC★ 1
Unauthenticated LFI and conditional RCE scanner for CVE-2026-87902 in WordPress Core (4.7.0 – 7.1.1).
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC★ 2
Exploit para explotar la vulnerabilidad CVE-2026-87902 que se acontece en el core de WordPress
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
PHP Object Injection in Profile Builder < 4.0.1
Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export
33RISK
open ↗GitHub PoC★ 12
CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints Gateway, build vs 14.1-73.37 / 13.1-64.23, UDP/443 DTLS probe. CTX697096; active exploitation reported. https://pocbit.org/pocs/cve-2026-88772
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
78RISK
open ↗GitHub PoC
Alexandertanay/jenkins-cve-2024-23897-lab
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISK
open ↗GitHub PoC
CVE-2026-71963 - Hermes Agent 0.18.2-0.21.0 RCE via a repository-delivered .git/config (core.fsmonitor). Stdlib-only Python, verified on real 0.21.0 with a clean negative control on the fixed build.
Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
41RISK
open ↗GitHub PoC
CVE-2024-4367 proof PDF for cpc docs-preview
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗GitHub PoC
CVE-2026-88008 - Traefik (<=2.11.56 / <=3.7.12): a client-controlled h2c upgrade tunnels past routers and middleware (BasicAuth/ForwardAuth/IPAllowList), unauthorised access + no access logging. Stdlib-only Python PoC + real Jetty h2c lab, verified on v3.7.12 vs v3.7.13.
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
41RISK
open ↗GitHub PoC★ 1
CVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE).
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
63RISK
open ↗GitHub PoC★ 1
Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
open ↗GitHub PoC
CVE-2026-82901 PoC: WordPress Ultra Addons for Contact Form 7 ≤3.5.50 unauth file upload via signature field when PDF Generator is enabled → wp-content/uploads/uacf7-uploads/. Fix: 3.5.51+. https://pocbit.org/pocs/cve-2026-82901
Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
48RISK
open ↗GitHub PoC
CVE-2026-97160 PoC for Joomla UP (lomart.fr): privileged {up php=} shortcode eval code injection in versions 5.0.0–5.2.0 and 6.0.0–6.0.29 (fix 5.2.1 / 6.1.0). Detects plugin version and verifies public article execution.
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
48RISK
open ↗GitHub PoC
Disabled TLS Certificate Verification for HashiCorp Vault KMS in confluent-kafka
Confluent Kafka Python Improper TLS Certificate Validation
41RISK
open ↗GitHub PoC
CVE-2026-97163 PoC payload (UP plugin Joomla remote code installation)
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.