Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC
CVE-2026-111497 brotli decoder firing range (RoE: loopback lab targets only)
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
48RISK
open ↗GitHub PoC
Independent reproduction of the Brotli decoder out-of-bounds write behind CVE-2026-111497 (Node2Shell): payload built from first principles, A/B against the patched release, and a measured ceiling that rules out the advertised RCE path.
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Unofficial patched PHP RPMs for EL7/EL8 mitigating php2shell (CVE-2026-109618, CVE-2026-109619), including legacy Remi SCL and AppStream builds.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
A remote denial of service vulnerability in CrowCPP due to uncontrolled recursion.
Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
41RISK
open ↗GitHub PoC★ 52
CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Log4Shell (CVE-2021-44228) remediation tracking for the quarterly security briefing
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
Defensive checker, preventer & log scanner for the PHP2Shell RCE flaws (CVE-2026-109618 / CVE-2026-109619). Zero dependencies, stdlib-only, no remote probing.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Emergency PHP2Shell hotfix (CVE-2026-109618 / CVE-2026-109619): apt if possible, else build fixed PHP from source
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Check PHP2Shell (CVE-2026-109618, CVE-2026-109619) from inside your server: distribution backports, missed restarts and interim mitigations, verdicts computed in the browser.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline BeyondTrust Remote Support evidence checker for CVE-2026-102764. Remote Support version and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
100RISK
open ↗GitHub PoC
Temproot for Skyworth 65G60 / Coocaa 9S60 (Android 8.0, kernel 4.9.44) via CVE-2019-2215 - port notes for the archived Bravia PoC
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RISK
open ↗GitHub PoC★ 2
Educational Docker lab for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP 8.4.x
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88772. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
100RISK
open ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-105483: TLS fullwidth-IP hostname validation bypass. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a con
41RISK
open ↗GitHub PoC★ 2
Script que detecta si tu versión de PHP es vulnerable a PHP2Shell (CVE-2026-109618 / 109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-106071: Permission Model wildcard path over-grant. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allo
28RISK
open ↗GitHub PoC
PHP 8.2.34 session UAF (CVE-2026-109618/619): x86_64 lab exploit, 5/5 on instrumented -g and clean -O2
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88776. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
41RISK
open ↗GitHub PoC
Offline SonicWall SMA1000 evidence checker for CVE-2026-102258. Reported build and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Managem
33RISK
open ↗GitHub PoC
Offline Atlassian Data Center evidence checker for CVE-2026-21589. Self-managed product and version evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISK
open ↗GitHub PoC
Offline Tinypool evidence checker for CVE-2026-104849. Worker-pool package and options evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Tinypool: Prototype Pollution Gadget to RCE in run() options
48RISK
open ↗GitHub PoC
Offline FortiMail evidence checker for CVE-2026-104286. FortiMail version and deployment evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
78RISK
open ↗GitHub PoC★ 1
php7-security-backports-for-PHP2Shell，(CVE-2026-109618 、 CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88778. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
TCP Initial Sequence Number (ISN) prediction
41RISK
open ↗GitHub PoC
Offline simple-git evidence checker for CVE-2026-102826. Git configuration and package evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
simple-git allows command execution through unblocked Git configuration includes
41RISK
open ↗GitHub PoC
Offline Sharp / librsvg evidence checker for CVE-2026-96889. Sharp and librsvg version and build evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Librsvg: use-after-free when xml includes have duplicated entities
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.