Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,660cataloged exploits
40,937CVEs with public exploitation
24,696lab-tested
AllReferência 26,570Exploit-DB 24,489GitHub PoC 18,413VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
88,662 exploits
Exploit-DB
Linux nf_tables 6.19.3 - Local Privilege Escalation
netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
41RISK
open ↗VulnCheck XDB
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
open ↗GitHub PoC★ 4
Read-only Bash checker for the Copy Fail Linux kernel vulnerability (CVE-2026-31431)
crypto: algif_aead - Revert to operating out-of-place
100RISK
open ↗GitHub PoC
Controlled virtual attack & defense lab — CVE-2011-2523 exploitation, Nmap recon, Nikto scanning, UFW hardening on Metasploitable 2
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗GitHub PoC
Mrhudson69/cve-2026-31431
crypto: algif_aead - Revert to operating out-of-place
100RISK
open ↗GitHub PoC
kaleth4/CVE-2025-60751
GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.
41RISK
open ↗GitHub PoC
Exploit CVE-2026-41940 auto exploit
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC
Xmyronn/CVE-2026-10170-RCE
code-projects Visitor Management System phone_0.php sql injection
33RISK
open ↗GitHub PoC
CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC
kaleth4/CVE-2025-69985
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnera
48RISK
open ↗Exploit-DB
Linksys E1200 2.0.04 - Authenticated Stack Buffer Overflow (RCE)
A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (F
41RISK
open ↗GitHub PoC★ 1
CVE-2026-41940: detect and exploit cpanel vuln
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC
kaleth4/CVE-2026-42167
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where th
56RISK
open ↗Metasploit600
OpenCTI Authentication Bypass and Notifier EJS Remote Code Execution
OpenCTI privilege escalation and unauthenticated access via default admin account
43RISK
open ↗GitHub PoC★ 1
rootdirective-sec/CVE-2026-39987-Lab
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
open ↗Metasploit600
OpenCTI Authentication Bypass and Notifier EJS Remote Code Execution
OpenCTI affected by RCE via notifier template
43RISK
open ↗GitHub PoC
LetsDefend SOC336 case study on CVE-2025-21298
Windows OLE Remote Code Execution Vulnerability
70RISK
open ↗VulnCheck XDB
initial-access
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnera
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.