Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC
Detection-only triage scanner for MLflow scorer RCE CVE-2026-116692: version check via the /version endpoint. No payloads, no scorer invocation.
MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules
48RISK
open ↗GitHub PoC
Non-intrusive detector for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) - scans codebases and live hosts for vulnerable PHP versions and risky config. Detection, not exploitation.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
keitan339/primefaces-cve-2017-1000486
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
100RISK
open ↗GitHub PoC
One-click exploit PoC for CVE-2026-109618 and CVE-2026-109619 against vulnerable PHP + Apache mod_php (prefork) targets.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Script avanzado del motor de scripting de Nmap (NSE) diseñado para identificar vulnerabilidades de PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Ofrece análisis de caja negra multicapa resistente a WAF, proxies y eliminación de encabezados.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 24
Independent discovery & coordinated disclosure: CoreMedia bytestream XPC (mediaplaybackd) vended live file descriptors for protected paths to any sandboxed app on iOS 26.5–27.0.1. Fixed in iOS 27.2 as CVE-2026-112706. PoC + evidence.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS
33RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-15723 version exposure in self-managed GitLab CE/EE, with CSV/JSON inventories and auditable reports.
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
41RISK
open ↗GitHub PoC★ 1
Persistent root for LG webOS 2.x TVs (CVE-2014-3153)
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two diff
98RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-94300 exposure in ISC BIND 9, with edition-aware rules, CSV/JSON inventories, and auditable reports.
Concurrent GSS-TSIG messages corrupt memory
41RISK
open ↗GitHub PoC
Offline Python detector for CVE-2023-7356 exposure in upstream Linux kernels, with CSV/JSON inventories and auditable reports.
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
21RISK
open ↗GitHub PoC★ 1
CVE-2026-114148 - .NET Linux Tarball Local Privilege Escalation PoC & Exploit
ASP.NET Core Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC
PoC / exploit archive for CVE-2026-102785
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
48RISK
open ↗GitHub PoC★ 1
Hunt CVE-2026-111497(HTTP2Shell/Brotli2Shell): find vulnerable Brotli decoder copies, including bundled/vendored ones, and ranks severity by reachability and exploitability.
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC★ 2
Laravel TokenGuard authentication bypass through non-string API credentials
Laravel TokenGuard authentication bypass through non-string API credentials
63RISK
open ↗GitHub PoC
php2shell (CVE-2026-109618/109619) research: lab + analysis
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-89035 exposure in MikroTik RouterOS inventories, with CSV/JSON input and auditable reports.
MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass
28RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-71195 exposure in OpenStack Manila, with branch-aware rules, CSV/JSON inventories, and auditable reports.
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns th
48RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-71195 exposure in OpenStack Manila, with branch-aware rules, CSV/JSON inventories, and auditable reports.
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns th
48RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-76473 release exposure in Cisco UC inventories, with CSV/JSON input and auditable reports.
Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.
28RISK
open ↗GitHub PoC
CVE-2026-115893: full Wasmtime aarch64 Cranelift br_table sandbox-escape public exploit, PoV, calibration notes, and verification evidence.
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
48RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-89035 exposure in MikroTik RouterOS inventories, with CSV/JSON input and auditable reports.
MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass
28RISK
open ↗GitHub PoC
Offline Python detector for CVE-2023-7356 exposure in upstream Linux kernels, with CSV/JSON inventories and auditable reports.
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
21RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-113870 exposure in MongoDB Compass inventories, with CSV/JSON input and auditable reports.
Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing
21RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-76474 exposure in Cisco UC inventories, with CSV/JSON input, versioned rules, and auditable reports.
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities
28RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-76473 release exposure in Cisco UC inventories, with CSV/JSON input and auditable reports.
Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.
28RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-76475 exposure in Cisco UC inventories, with CSV/JSON input, versioned rules, and auditable reports.
Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities
28RISK
open ↗GitHub PoC★ 1
The authorization layer CVE-2026-93328 was missing: scoped grants, path confinement, and signed receipts in front of MCP storage tools. CVE reproduction + gated proof, 10/10 tests.
Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
48RISK
open ↗GitHub PoC
KharalDipendra/CVE-2026-43621
Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()
41RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-76475 exposure in Cisco UC inventories, with CSV/JSON input, versioned rules, and auditable reports.
Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.