Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,600cataloged exploits
39,734CVEs with public exploitation
24,695lab-tested
AllReferência 25,742Exploit-DB 24,486GitHub PoC 16,618VulnCheck XDB 9,736Nuclei 4,493Metasploit 3,525✓ verified onlyrecentpopularrisk
16,343 exploits
GitHub PoC★ 15
watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127
BIG-IP APM OAuth vulnerability
78RISK
open ↗GitHub PoC★ 1
yulisec/CVE-2026-90817
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
48RISK
open ↗GitHub PoC
Ninja Forms unauth stored XSS POC
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting
41RISK
open ↗GitHub PoC
UnrealIRCd 3.2.8.1 backdoor exploit — reverse shell via AB; trigger, built from scratch in Python using raw sockets. No Metasploit.
UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally
60RISK
open ↗GitHub PoC
DJI Drone DUML Command Injection over Bluetooth — Proof of Concept for CVE-2026-78306
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
41RISK
open ↗GitHub PoC
Detailed technical analysis of CVE-2026-43284 (Dirty Frag) local privilege escalation flaw in the Linux kernel.
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
open ↗GitHub PoC
zyphorixofficialmain-lab/cve-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
PoC for CVE-2026-72001 — Pangolin < 1.22.0 cross-organization resource authentication bypass via the share-link access-token endpoint (CWE-639, CVSS 8.1).
Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint
41RISK
open ↗GitHub PoC★ 40
Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27,
41RISK
open ↗GitHub PoC
Detailed technical analysis of CVE-2026-43284 (Dirty Frag) local privilege escalation flaw in the Linux kernel.
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
open ↗GitHub PoC
Temporary fork of braces with a minimal security patch for CVE-2026-93687, created only to validate dependency override behavior and Fortify/FoD detection before moving the fix to an official Bentobox-owned source.
braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
41RISK
open ↗GitHub PoC★ 1
This repository contains the exploit for CVE-2026-16764.
OWASP DefectDojo API/Web serializers.py UserSerializer privileges management
33RISK
open ↗GitHub PoC★ 14
a23bc/op13-cve-2026-64560
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISK
open ↗GitHub PoC
A WordPress plugin exposing an MCP server over the REST API, with the security model as the point -- closes the CVE-2026-15015 OAuth-bypass shape by never having that surface at all.
MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint
63RISK
open ↗GitHub PoC
whoami-012/CVE-2026-96515
Command Injection Vulnerability in Netlink ICT HG323RW Router
41RISK
open ↗GitHub PoC
CVE-2026-63030 + CVE-2026-60137 WordPress Core pre-auth RCE mass exploit
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
open ↗GitHub PoC★ 3
CVE-2026-87902 detector. WordPress get_page_template LFI class. Detect-only. Authorized lab.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
Docker-based cybersecurity lab for studying and reproducing CVE-2021-41773 in an isolated environment.
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗GitHub PoC★ 1
CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j — Next.js next/og ImageResponse SVG injection (Satori, GHSA-wx4j-mvgx-mqwp): isolated Docker validation lab with vulnerable (16.3.5) vs patched (16.3.6) controls, non-destructive Python scanner with pixel-level PNG evidence, and root-cause analysis of the upstream Satori fix. Authorized security research only.
Satori-generated SVG has improper escaping
33RISK
open ↗GitHub PoC★ 13
Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4.7.0-7.1.1, fixed 7.1.2). Authorized/defensive testing.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
zer0dayf/CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
Blue Team home lab: full incident response lifecycle (attack → detect → respond) with Wazuh SIEM + Suricata IDS, CVE-2007-2447 exploitation, MITRE ATT&CK mapping, and an AI-assisted alert triage pipeline.
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RISK
open ↗GitHub PoC★ 2
WordPress Core <= 7.1.1 unauthenticated LFI to RCE - validation lab, PoC, nuclei template (GHSA-7hp8-65ch-5whp)
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
CVE-2026-89274 — WP Recipe Maker <= 10.8.1 arbitrary shortcode execution via rating-comment reviewBody (CVSS 9.1): Docker validation lab with vulnerable (10.8.1) vs patched (10.8.2) controls, Python PoC proving server-side shortcode execution in recipe JSON-LD, nuclei version screen. Authorized security research only.
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
48RISK
open ↗GitHub PoC★ 1
CVE-2026-95675 · POC
D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface
48RISK
open ↗GitHub PoC★ 11
CVE-2026-102282: Local Privilege Escalation via SUID/SGID preservation during archive extraction
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
41RISK
open ↗GitHub PoC
CVE-2019-11707 is a critical type confusion in Firefox's IonMonkey optimizing JIT. The browser bug provides native code execution in the content process, but that process remains constrained by the Firefox sandbox. The complete laboratory chain therefore combines three vulnerabilities:
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow
83RISK
open ↗GitHub PoC
Docker CTF challenge for CVE-2025-57819
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.