Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC
CVE-2026-118570 — CSRF on the Drupal fasttoggle toggle route
Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283
33RISK
open ↗GitHub PoC★ 1
Dream-Rainy/CVE-2026-98260
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC
CVE-2026-122158: InvoiceShelf cross-tenant privilege escalation analysis and safe local-lab PoC
InvoiceShelf MemberService.php create access control
33RISK
open ↗GitHub PoC
CVE-2026-118423 - WP Libre Form <= 1.5.0.1 unauthenticated upload to RCE (PoC + exploit by thiscitze)
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
48RISK
open ↗GitHub PoC
Vulnerability research, PoC reproduction lab, and technical analysis for Alpine Linux OpenSSH authentication bypass (CVE-2026-123158 / sshole)
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
OpenSSH sshole(CVE-2026-123158) 알파인 sshd 점검을 벨로키와 쉽게 보기
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
CVE-2026-98260 (posix-cpu-timers UAF) to KernelSU on a bootloader-locked OPPO PKT110: exploit core, on-device app, and the research write-up.
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗VulnCheck XDB
client-side
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗VulnCheck XDB
initial-access
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RISK
open ↗GitHub PoC
PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Rust/Verus model, without a bug-specific property
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
initial-access
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RISK
open ↗VulnCheck XDB
initial-access
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RISK
open ↗VulnCheck XDB
initial-access
A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attack
23RISK
open ↗VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗VulnCheck XDB
initial-access
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
100RISK
open ↗GitHub PoC★ 1
CVE-2026-102334 nginx proxy manager Exploit
Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection
48RISK
open ↗GitHub PoC★ 2
Root iQOO Z9 Turbo using CVE-2026-98260
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗VulnCheck XDB
initial-access
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26
63RISK
open ↗VulnCheck XDB
initial-access
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
71RISK
open ↗VulnCheck XDB
initial-access
A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individua
56RISK
open ↗GitHub PoC
CVE-2026-76142 — Genian NAC/ZTNA pre-auth internal IPC routing flaw (gnrpcsvc), CVSS 9.3, fixed in build 148665+
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface
48RISK
open ↗VulnCheck XDB
initial-access
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗GitHub PoC
Docker config that patches/builds kernel w/ CVE_2026_98432 fix
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Lean 4 model, with the property that catches it
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
initial-access
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26
53RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.