Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,035cataloged exploits

39,531CVEs with public exploitation

24,695lab-tested

All Referência 25,557Exploit-DB 24,485GitHub PoC 16,313VulnCheck XDB 9,678Nuclei 4,478Metasploit 3,524✓ verified onlyrecent popular risk

16,313 exploits

GitHub PoC

SQL Injection via unquoted numeric concatenation in SLiMS 9.8.0 admin modules (subscription.php & dl_detail.php). CVE-2026-107083.

CVE-2026-107083CRITICAL17 Oct 2026

SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/r

45RISK

open ↗

GitHub PoC

SQL Injection via opac_hide / promoted GET parameters in SLiMS 9.8.0 admin bibliography module. CVE-2026-107082.

CVE-2026-107082HIGH17 Oct 2026

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection vi

38RISK

open ↗

GitHub PoC

CSRF in SLiMS 9.8.0 loan history maintenance allowing unauthorized data loss (TRUNCATE). CVE-2026-107084.

CVE-2026-107084—17 Oct 2026

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules

20RISK

open ↗

GitHub PoC

WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

CVE-2026-94169CRITICAL17 Oct 2026

WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

48RISK

open ↗

GitHub PoC

CVE-2026-97229 GitLab CI lint regex integer overflow RCE — InstaBox version matrix reproduction & libruby gadget reverse engineering

CVE-2026-97229CRITICAL17 Oct 2026

Integer Overflow or Wraparound in GitLab

48RISK

open ↗

GitHub PoC★ 3

REDMI K90 Max在OS4.0.0.14.XAACNXM利用CVE-2026-64560获取ROOT权限。

CVE-2026-64560HIGH17 Oct 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISK

open ↗

GitHub PoC

songzzzz/CVE-2026-8933

CVE-2026-8933HIGH17 Oct 2026

snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup

41RISK

open ↗

GitHub PoC

PoC for CVE-2026-111823 — Mage AI OAuth session auth bypass (POST /api/sessions). Check + exploit modes. Authorized testing only.

CVE-2026-111823CRITICAL17 Oct 2026

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

48RISK

open ↗

GitHub PoC

PMX110 (OPPO MT6995, kernel 6.18.21) CVE-2026-64560 research: port, evidence, bounded run scripts

CVE-2026-64560HIGH17 Oct 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISK

open ↗

GitHub PoC★ 1

Passive internet-wide discovery + responsible-disclosure helper for CVE-2026-74580 (Linux vhost metadata-cache bug) — queries existing scan data (Sonar/Shodan/Censys), triages exposure, and drafts (never auto-sends) notices to owners.

CVE-2026-74580HIGH17 Oct 2026

vhost: reset the vring metadata cache on vring reconfiguration

41RISK

open ↗

GitHub PoC

Non-destructive behavioral verifier for the MikroTik RouterOS SSH auth-bypass (CVE-2026-67279 / MikroTrick). Measures server reaction only — no exploit payload.

CVE-2026-67279MEDIUMunder attack17 Oct 2026

SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

63RISK

open ↗

GitHub PoC★ 1

Restricted eBPF TC ingress guard, CO-RE detector, verified loader, and C11 VMM launch supervisor for CVE-2026-99999

CVE-2026-99999CRITICAL16 Oct 2026

ipv4: validate checksum_start before completing checksum

48RISK

open ↗

GitHub PoC

PoC for CVE-2026-59970 Blind SSRF in Tandoor Recipes, CWE-918

CVE-2026-59970HIGH16 Oct 2026

Tandoor Recipes: Blind SSRF via AI provider URL (api_base)

41RISK

open ↗

GitHub PoC

ExifToolExploit CVE-2021-22204 \\ Arbitrary Code Execution

CVE-2021-22204MEDIUMunder attack16 Oct 2026

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RISK

open ↗

GitHub PoC

CS50 Cybersecurity Final Project - Analysis of CVE-2025-53770 SharePoint Zero-Day Attacks

CVE-2025-53770CRITICALunder attackransomware16 Oct 2026

Microsoft SharePoint Server Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC★ 1

CVE-2026-97229: GitLab RCE Unauthenticated via CI Lint

CVE-2026-97229CRITICAL16 Oct 2026

Integer Overflow or Wraparound in GitLab

48RISK

open ↗

GitHub PoC

Ferramentas de auditoria em segurança da informação, reconhecimento de superfície com RDAP/DNS e análise defensiva web (CVE-2024-10924).

CVE-2024-10924CRITICAL16 Oct 2026

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RISK

open ↗

GitHub PoC

Exploitation POC for CVE-2026-94134

CVE-2026-94134CRITICAL16 Oct 2026

Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

48RISK

open ↗

GitHub PoC

Frappe HRMS missing input validation SQL injection vulnerability

CVE-2026-111389HIGH16 Oct 2026

Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation

41RISK

open ↗

GitHub PoC

Wheels SQL injection on MySQL/MariaDB with backslash escaping enabled

CVE-2026-111444CRITICAL16 Oct 2026

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent)

48RISK

open ↗

GitHub PoC★ 25

CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656

CVE-2026-96652MEDIUM16 Oct 2026

Plex Media Server SSRF

33RISK

open ↗

GitHub PoC★ 8

CVE-2026-89079 — WordPress Theme My Login multisite unauth password overwrite PoC (check, verify, exploit). Not version-only: requires MS + tml_user_passwords.

CVE-2026-89079CRITICAL16 Oct 2026

Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter

48RISK

open ↗

GitHub PoC

CVE-2026-104745 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0.

CVE-2026-104745HIGH16 Oct 2026

Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter

41RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-79986 (Apache Camel camel-azure-files): the consumer builds the remote path from the share listing without containment (author-only; see CVE-2026-79983/79984 for the runnable mechanism) — Camel Spring Boot + Camel Quarkus

CVE-2026-79986HIGH16 Oct 2026

Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside

38RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-79985 (Apache Camel camel-smb): the SMB consumer builds the remote path from the share listing without containment (author-only; see CVE-2026-79983/79984 for the runnable mechanism) — Camel Spring Boot + Camel Quarkus

CVE-2026-79985HIGH16 Oct 2026

Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside

38RISK

open ↗

GitHub PoC

CVE-2026-111283 - BMC Helix Network Management Local Administrator Account Accepts Any Password

CVE-2026-111283CRITICAL16 Oct 2026

BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration

48RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-79984 (Apache Camel camel-mina-sftp): the consumer builds the remote path from the server's SFTP directory listing without containment, escaping the polled directory — Camel Spring Boot + Camel Quarkus

CVE-2026-79984HIGH16 Oct 2026

Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside

38RISK

open ↗

GitHub PoC

BIBILZERODAY/CVE-2026-104736---Proof-of-Concept-PoC-Exploit-Details

CVE-2026-104736CRITICAL16 Oct 2026

LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter

48RISK

open ↗

GitHub PoC★ 1

Reproducer for CVE-2026-79983 (Apache Camel camel-ftp): the consumer builds the remote path from the server's directory listing without containment, escaping the polled directory — Camel Spring Boot + Camel Quarkus

CVE-2026-79983HIGH16 Oct 2026

Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside

38RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-78165 (Apache Camel camel-spring-redis): default JdkSerializationRedisSerializer deserializes Redis PUBLISH payloads with no ObjectInputFilter (RCE) — Camel Spring Boot + Camel Quarkus

CVE-2026-78165HIGH16 Oct 2026

Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads

38RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.