Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC★ 1
Unauthenticated RCE in PHP via session.upload_progress use-after-free (CVE-2026-109618 / CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 3
Check whether a website is affected by PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 18
CVE-2026-98260（fs/exec.c POSIX CPU timer UAF）XRING O1 / Android 17 / 6.18.21 研究记录与 PC 一键流程（授权设备安全研究）
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 2
CVE-2026-98260 (exec: posix CPU timer UAF) - one-command temporary root for OnePlus 16 (PYB110) from uid 2000 shell, with KernelSU/FinaSU handover
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗VulnCheck XDB
initial-access
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra
100RISK
open ↗VulnCheck XDB
info-leak
YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId
41RISK
open ↗VulnCheck XDB
initial-access
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
53RISK
open ↗VulnCheck XDB
info-leak
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trave
60RISK
open ↗GitHub PoC★ 1
Target-specific Android CVE-2026-98260 research port for Xiaomi 17 (pudding)
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗VulnCheck XDB
initial-access
Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in ou
35RISK
open ↗VulnCheck XDB
info-leak
An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REG
50RISK
open ↗VulnCheck XDB
initial-access
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RISK
open ↗GitHub PoC★ 2
CVE-2026-109619 (PHP2Shell): Pre-Auth Remote Code Execution (RCE) via PHP-FPM Stale Global State Deserialization UAF. Reproducible Docker lab, interactive shell, reverse shell & WAF/IDS rules.
RCE via stale global state
100RISK
open ↗GitHub PoC
A local Docker environment and proof of concept for Node2Shell (CVE-2026-111497)
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Safe PoC and technical analysis for CVE-2026-116000
Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery
33RISK
open ↗GitHub PoC
Safe PoC and technical analysis for CVE-2026-116004
onyx-dot-app Onyx PreviewTab.tsx cross site scripting
33RISK
open ↗GitHub PoC★ 6
REDMI K90 Max在OS4.0.5.0.XAACNXM利用CVE-2026-98260获取ROOT权限并加载KSU模块。
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗VulnCheck XDB
initial-access
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.