Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,149cataloged exploits
40,888CVEs with public exploitation
24,696lab-tested
AllReferência 26,559Exploit-DB 24,489GitHub PoC 18,372VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
88,154 exploits
VulnCheck XDB
initial-access
CVE-2026-0257HIGHunder attackransomware15 Jun 2026
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
100RISK
open ↗
GitHub PoC
Research and analysis of the ServiceNow Virtual Agent vulnerability (CVE-2025-12420), including attack flow, MITRE ATT&CK mapping, detection strategies, and mitigation recommendations.
CVE-2025-12420CRITICAL15 Jun 2026
Unauthenticated Privilege Escalation in ServiceNow AI Platform
60RISK
open ↗
GitHub PoC
CVE-2026-54596 - Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
CVE-2026-54596HIGH15 Jun 2026
ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
41RISK
open ↗
GitHub PoC
ikarolaborda/CVE-2026-40176
CVE-2026-40176HIGH15 Jun 2026
Composer is vulnerable to Command Injection via Malicious Perforce Repository
41RISK
open ↗
GitHub PoC
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php
CVE-2026-37072CRITICAL15 Jun 2026
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-update
48RISK
open ↗
GitHub PoC★ 1
This repository documents CVE-2026-48849, a Stored Cross-Site Scripting (XSS), HTML Injection, and CSS Injection vulnerability discovered in Roundcube Webmai
CVE-2026-48849MEDIUM15 Jun 2026
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored valu
33RISK
open ↗
GitHub PoC
Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.
CVE-2026-37066MEDIUM15 Jun 2026
Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Man
33RISK
open ↗
GitHub PoC
Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.
CVE-2026-37067MEDIUM15 Jun 2026
Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauth
33RISK
open ↗
GitHub PoC★ 3
PoC exploit for CVE-2026-53519.
CVE-2026-53519CRITICAL15 Jun 2026
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
63RISK
open ↗
VulnCheck XDB
denial-of-service
CVE-2021-44228CRITICALunder attackransomware15 Jun 2026
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗
GitHub PoC
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint.
CVE-2026-37068HIGH15 Jun 2026
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allow
41RISK
open ↗
VulnCheck XDB
initial-access
CVE-2026-42945CRITICAL15 Jun 2026
NGINX ngx_http_rewrite_module vulnerability
60RISK
open ↗
GitHub PoC
TryHackMe SOC Level 1 — Follina CVE-2022-30190, Nim C2, Chisel, PrintSpoofer, backdoor accounts
CVE-2022-30190HIGHunder attackransomware15 Jun 2026
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗
GitHub PoC★ 1
Defensive research notes for CVE-2026-5950, a BIND 9 resolver DoS vulnerability credited to Billy Baraja (BielraX).
CVE-2026-5950MEDIUM14 Jun 2026
Unbounded resend loop in BIND 9 resolver
33RISK
open ↗
GitHub PoC
webshellseo8/CVE-2026-53787-POC-
CVE-2026-53787CRITICAL14 Jun 2026
Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload
63RISK
open ↗
GitHub PoC
kaleth4/CVE-2022-30190
CVE-2022-30190HIGHunder attackransomware14 Jun 2026
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗
GitHub PoC★ 4
CVE-2017-0144
CVE-2017-0144HIGHunder attackransomware14 Jun 2026
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
GitHub PoC★ 3
CVE-2017-0144
CVE-2017-0144HIGHunder attackransomware14 Jun 2026
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
GitHub PoC
CVE-2026-20253 - Splunk Enterprise
CVE-2026-20253CRITICALunder attack14 Jun 2026
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
100RISK
open ↗
VulnCheck XDB
info-leak
CVE-2021-41773HIGHunder attackransomware14 Jun 2026
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2017-0144HIGHunder attackransomware14 Jun 2026
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
GitHub PoC★ 4
CVE-2026-20245
CVE-2026-20245HIGHunder attack14 Jun 2026
Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability
76RISK
open ↗
GitHub PoC
Python RCE PoC with reverse-shell listener for CVE-2026-42945 (NGINX Rift)
CVE-2026-42945CRITICAL14 Jun 2026
NGINX ngx_http_rewrite_module vulnerability
60RISK
open ↗
GitHub PoC★ 1
rohit-sundar/cve-2026-23744
CVE-2026-23744CRITICAL14 Jun 2026
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISK
open ↗
GitHub PoC
CVE-2026-5513: Bookly <= 27.2 Stored XSS via Cookie (Unauthenticated)
CVE-2026-5513HIGH14 Jun 2026
Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie
41RISK
open ↗
VulnCheck XDB
initial-access
CVE-2026-6279CRITICAL14 Jun 2026
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
63RISK
open ↗
GitHub PoC
Apache HTTP Server 2.4.49 Path Traversal Vulnerability Reproduction
CVE-2021-41773HIGHunder attackransomware14 Jun 2026
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
GitHub PoC★ 1
CVE-2024-3094 XZ Utils backdoor research - attack surface visualiser, system vulnerability checker, and general Linux CVE assessment tool
CVE-2024-3094CRITICAL14 Jun 2026
Xz: malicious code in distributed source
70RISK
open ↗
GitHub PoC
CVE-2025-14847 mongobleed python file
CVE-2025-14847HIGHunder attack14 Jun 2026
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗
GitHub PoC
CVE-2026-20127
CVE-2026-20127CRITICALunder attack14 Jun 2026
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
100RISK
open ↗
← previouspage 233 / 2,939next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.