Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC
CVE-2024-4367 PDF.js FontMatrix PoC - authorized pentest artifact
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗GitHub PoC
Cybersecurity research project analyzing threat intelligence feeds, Log4Shell (CVE-2021-44228), attack progression, remediation, incident response, and threat hunting.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
Offline Python applicability detector for CVE-2026-97785 in Microsoft Entra application proxy, with CSV/JSON inventories and auditable reports.
AAD App Proxy Elevation of Privilege Vulnerability
28RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-114625 exposure in on-premises VeloCloud Orchestrator, with train-specific build checks and auditable reports.
Security Advisory 0199
78RISK
open ↗GitHub PoC
sachincool/cve-2026-84383-poc
libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items
48RISK
open ↗GitHub PoC
sudo5Q/CVE-2026-38056-PoC
ST Engineering iDirect iQ-Series Terminals Missing Authorization
48RISK
open ↗VulnCheck XDB
initial-access
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August
63RISK
open ↗GitHub PoC
Controlled penetration testing and Linux host-hardening lab demonstrating Shellshock (CVE-2014-6271), privilege escalation, vulnerability assessment and defensive security controls.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-15723 version exposure in self-managed GitLab CE/EE, with CSV/JSON inventories and auditable reports.
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
41RISK
open ↗GitHub PoC★ 14
AirPods Bluetooth MAC Address Disclosure via NSUserDefaults
This issue was addressed with improved data protection. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPad
33RISK
open ↗GitHub PoC
Security-patched php56 RPMs for Amazon Linux 1 (AMI 2018.03): PHP2Shell (CVE-2026-109618, CVE-2026-109619) and post-5.6.40 fixes backported from deb.sury.org
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC★ 1
Live demo: the same vulnerable Rust zip crate (RUSTSEC-2026-0367 setuid + CVE-2026-115905 zip cloaking) contained by a deny-by-default Cosmonic WebAssembly sandbox.
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
48RISK
open ↗GitHub PoC
One-click exploit PoC for CVE-2026-109618 and CVE-2026-109619 against vulnerable PHP + Apache mod_php (prefork) targets.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP2Shell CVE-2026-109618 / CVE-2026-109619 Mitigation work (Ansible Role)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 2
Lab reproduction, exposure probe and detection content for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell). Defensive research; no exploit.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
[PHP2Shell] Golang exploit for CVE-2026-109618 / CVE-2026-109619: Unauthenticated RCE in PHP 5.4–8.5.11 via OOM corruption + session.upload_progress UAF
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
initial-access
Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
63RISK
open ↗GitHub PoC★ 1
Remote Zend MM ASLR leak testbed (PHP CVE-2026-109618 / CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Hands-on PHP2Shell workshop: Docker labs, guided debugging, and annotated exploits for CVE-2026-109618 and CVE-2026-109619.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Non-intrusive detector for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) - scans codebases and live hosts for vulnerable PHP versions and risky config. Detection, not exploitation.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Unofficial rebuild of Remi's php80-php 8.0.30-21 SCL packages for CentOS/RHEL 7 (EOL). Includes all 44 CVE fixes between Remi -6 and -21, among them CVE-2026-109618 / CVE-2026-109619 (PHP2Shell).
RCE via OOM corruption
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.