Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
VulnCheck XDB
local
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RISK
open ↗GitHub PoC
Standalone defensive checker project for CVE-2026-58043: Node.js: Permission Model path-prefix over-grant. One exploit per repository; implementation pending.
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
41RISK
open ↗VulnCheck XDB
initial-access
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RISK
open ↗GitHub PoC
Check a PHP install for the PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619), including Ubuntu backports, and show interim mitigations.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Free read-only self-check scripts for PHP2Shell (CVE-2026-109618), the LiteLLM 1.107.0 compromise and the eMudhra CA keys. Runs on your machine; nothing leaves your network.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
48RISK
open ↗GitHub PoC
Multi-method remote PHP version detector with PHP2Shell (CVE-2026-109618/109619) triage
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-19490. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
90RISK
open ↗GitHub PoC
PHP2Shell lab (CVE-2026-109618 / -109619): reach the OOM, read the previous request's stale session state, then measure an attacker-chosen length and an out-of-bounds read. Ships the instrumented-build recipe, not just the conclusion.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Standalone defensive checker project for CVE-2026-102258: SonicWall SMA1000 (6210, 7210, 8200v): AMC stored cross-site scripting. One exploit per repository; implementation pending.
Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Managem
33RISK
open ↗GitHub PoC★ 14
PHP2Shell: version-aware research toolkit for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP session.upload_progress (mod_php). Build profiles, labs, heap calibration and detection guidance for authorized security testing.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Standalone defensive checker project for CVE-2026-102257: SonicWall SMA1000 (6210, 7210, 8200v): AMC archive path traversal. One exploit per repository; implementation pending.
A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extrac
41RISK
open ↗GitHub PoC
Audit Linux hosts for CVE-2026-111497 vulnerable brotli (1.0.3-1.2.0, CVSS 4.0 9.2). dpkg/apk/rpm/Node aware. Verified across live containers.
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Standalone defensive checker project for CVE-2026-58041: Node.js: SQLite cached iterator write replay. One exploit per repository; implementation pending.
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to cont
33RISK
open ↗GitHub PoC
Offline SonicWall SMA1000 evidence checker for CVE-2026-102255. Reported build and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern
48RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88777. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
41RISK
open ↗GitHub PoC
CVE-2026-109618 / CVE-2026-109619 本地复现笔记：UAF 原语验证、利用链边界分析、加固方案
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88776. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
41RISK
open ↗GitHub PoC
Standalone defensive checker project for CVE-2026-102256: SonicWall SMA1000 (6210, 7210, 8200v): Authenticated remote code execution. One exploit per repository; implementation pending.
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi
41RISK
open ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-105482: DNS resolution NUL-name truncation. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() f
41RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88774. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Feature policy bypass due to improper HTTP URL based expression usage
41RISK
open ↗GitHub PoC★ 1
Passive, self-hosted PHP vulnerability exposure scanner (PHP2Shell CVE-2026-109618/109619, CVE-2026-115560) with a plain-English patch report. PWA, CLI, Docker. Zero dependencies.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88773. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
HTTP Request Smuggling
63RISK
open ↗GitHub PoC
Correção e verificação de PHP 7.4 (CVE-2026-109618/109619) por bind, Apache e nginx/FPM
RCE via OOM corruption
100RISK
open ↗GitHub PoC
0xSemizzz/CVE-2026-86476
Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize
41RISK
open ↗GitHub PoC
scanner CVE-2026-109618/CVE-2026-109619. write with bun
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP2Shell patches for PHP 7.0.33 on CentOS 7 (Remi RPMs)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline Atlassian Data Center evidence checker for CVE-2026-21589. Self-managed product and version evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.