Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC★ 1
CVE-2026-114148 - .NET Linux Tarball Local Privilege Escalation PoC & Exploit
ASP.NET Core Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC★ 49
6.12.69-android16-6-g242e1a07f878
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC
PHP2Shell (CVE-2026-109618/109619) exposure sweep and takeover assessment across 56 vulnerable TZ/KE hosts
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PwnKit CVE-2021-4034 Mitigation work (Ansible Role)
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗GitHub PoC
Unofficial backport of the CVE-2026-109618 / CVE-2026-109619 (php2shell) fixes to Ubuntu 12.10 php5 5.4.6-1ubuntu1.8, with chroot build, regression tests, rollback and step-by-step deploy scripts for Apache 2.2 + mod_php. Stopgap only: PHP 5.4 is end-of-life.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 3
Check whether a website is affected by PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Unauthenticated RCE in PHP via session.upload_progress use-after-free (CVE-2026-109618 / CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 6
REDMI K90 Max在OS4.0.5.0.XAACNXM利用CVE-2026-98260获取ROOT权限并加载KSU模块。
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 1
node2shell-detector - local + network detections for Node2Shell (CVE-2026-111497) by IONSEC. Python CLI: runtime posture, Brotli decoder fingerprints, dependency exposure, log fingerprints, opt-in self-test; plus Sigma, Suricata, ModSecurity, YARA rules and edge/app snippets.
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC★ 2
Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, no dependencies or exploit payloads.
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC★ 1
CVE-2026-109619 - PHP session.upload_progress File Poisoning + LFI RCE (CVSS 9.2)
RCE via stale global state
100RISK
open ↗VulnCheck XDB
local
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile
91RISK
open ↗GitHub PoC
Offline Python detector for CVE-2026-76466 in Cisco Expressway, using version and clustering evidence with JSON reporting.
Cisco Expressway Series Remote Code Execution Vulnerability
28RISK
open ↗GitHub PoC
PoC / exploit archive for CVE-2026-0303
Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File
28RISK
open ↗GitHub PoC
Cross-platform scanner that finds .NET apps, runtimes and Azure App Service / Functions deployments exposed to CVE-2026-111497 (brotli decoder)
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
CVE-2026-90931: LaraDashboard stored XSS via SVG upload — bilingual analysis and safe PoC
LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload
33RISK
open ↗GitHub PoC★ 1
CVE-2026-90932: LaraDashboard path traversal to arbitrary file deletion/write — bilingual analysis and safe PoC
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE
41RISK
open ↗GitHub PoC
CVE-2026-84589: macOS TCC privacy bypass via FaceTime impersonation. Technical PoC analysis, Apple disclosure timeline, and patch coverage.
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27. An app may
33RISK
open ↗GitHub PoC
Checks that Tenable scanning is set up to detect PHP2Shell (CVE-2026-109618, CVE-2026-109619) on every PHP host: plugin feed, credentials, and scan settings. Lists the hosts to rescan and flags end-of-life PHP. Works with Tenable Vulnerability Management, Security Center, and .nessus files. Claude Code skill or standalone script.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
CVE-2026-109618: Unauthenticated RCE via PHP session upload progress OOM heap corruption (Apache mod_php)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Read-only scanner and config patcher to detect and work around CVE-2026-109618 / CVE-2026-109619 on PHP, with a full detection and harening manual.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
CVE-2026-109618 / 109619 research & exploit tooling (mod_php + FPM Chain-E)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Controlled lab pinned to PHP 8.3.35 for reproducing/patch-verifying PHP2Shell (CVE-2026-109618, CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP2Shell — Unauthenticated RCE chain exploiting CVE-2026-109618 (OOM memory corruption) + CVE-2026-109619 (stale global state) in PHP.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Browser-based terminal-style UI for assetnote's php2shell-scanner (CVE-2026-109618 / CVE-2026-109619), with live per-probe SSE activity log and JSON export. Detection engine by assetnote; original discovery by Calif.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Secure REST API with CI/CD security scanning (Bandit SAST + pip-audit SCA) and a reproducible CVE-2017-1000028 lab (GlassFish 4.1)
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trave
60RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.