Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,039cataloged exploits
39,796CVEs with public exploitation
24,695lab-tested
AllReferência 25,790Exploit-DB 24,487GitHub PoC 16,910VulnCheck XDB 9,820Nuclei 4,504Metasploit 3,528✓ verified onlyrecentpopularrisk
16,910 exploits
GitHub PoC★ 19
Am I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778), CTX697174, CTX697191 (SAML RCE) and php2shell (management GUI): build, CVE preconditions, SAML, mgmt exposure, MFA, upgrade risks + IoC sweep with every public IoC (webshells, implants, 133 attacker IPs).
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
93RISK
open ↗GitHub PoC★ 1
CVE-2026-87902 — WordPress Core LFI → RCE
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
Hands-on cybersecurity and CTF labs covering port reconnaissance, CMS stack discovery, VulnCMS, CVE-2026-58225, shell-to-root paths, Python, sudo, user switching, passwords, and post-exploitation.
SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service
28RISK
open ↗GitHub PoC★ 169
🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
63RISK
open ↗GitHub PoC
Proof-of-Concept for CVE-2026-18110
Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username
41RISK
open ↗GitHub PoC
CVE-2026-38526 - Authenticated RCE exploit for Krayin CRM <= 2.2.x. Upload arbitrary PHP via /admin/tinymce/upload and gain remote code execution. Python PoC for security researchers, CTF players and bug bounty hunters. Tested on HTB Nexus.
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a
48RISK
open ↗GitHub PoC★ 1
CVE-2026-38526 - Authenticated RCE exploit for Krayin CRM <= 2.2.x. Upload arbitrary PHP via /admin/tinymce/upload and gain remote code execution. Python PoC for security researchers, CTF players and bug bounty hunters. Tested on HTB Nexus.
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a
48RISK
open ↗GitHub PoC★ 28
ZeroDayEvil/CVE-2026-41940-PoC
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC★ 8
One-click temporary KernelSU root (late-load) for Samsung Galaxy via DirtyFrag (CVE-2026-43284). No Shizuku/PC/ADB.
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
open ↗GitHub PoC
CVE-2026-88772 - Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS)
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
93RISK
open ↗GitHub PoC
Thesis scenario test (research only): Scenario C: EPSS-BLOCK path - node-serialize@0.0.4 CVE-2017-5941
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() fu
35RISK
open ↗GitHub PoC★ 29
GitLab Unauthenticated Arbitrary File Read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISK
open ↗GitHub PoC★ 26
ZeroDayEvil/CVE-2026-54121
Active Directory Certificate Services Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC
CVE-2026-93958 PoC: D-Link R95 BE9500 DHMAPI SetTimeSettings NTPServer authenticated root command injection. DHMAPI login, RCE verify, mass bulk exploit mode, colored CLI. https://pocbit.org/pocs/cve-2026-93958
D-Link R95 DHMAPI ssi system os command injection
48RISK
open ↗GitHub PoC★ 3
CVE-2026-87902 — WordPress Core LFI → RCE by Hackfut
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC★ 1
jvidhan/cve-2026-28912
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.7
41RISK
open ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
93RISK
open ↗GitHub PoC
Hasyros/CVE-2026-101162-xss-wp-ultimate-review
WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings
33RISK
open ↗GitHub PoC
Hasyros/CVE-2026-101161-dos-wp-ultimate-review-shortcode
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode
41RISK
open ↗GitHub PoC★ 2
Out-of-bounds Write (CWE-787)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2
71RISK
open ↗GitHub PoC
Unauthenticated reflected XSS in WPForms <= 2.0.2.1 — bypass of the CVE-2026-88996 Smart Tag escaping at attribute-name position
WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter
33RISK
open ↗GitHub PoC
Improper Input Validation (CWE-20) SSVC Scores Exploitation: Active Technical Impact: Total
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
93RISK
open ↗GitHub PoC★ 1
Tooling related to CVE-2026-88771 and CVE-2026-88772
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
93RISK
open ↗GitHub PoC★ 1
craigsblackie/cve-2026-88771-netscaler
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
93RISK
open ↗GitHub PoC
CVE-2026-85984 PoC: WordPress miniOrange OTP ≤5.5.5 unauth admin bypass (mo_wp_login_intent=otp + empty password). Check/exploit, user enum, colored CLI. https://pocbit.org/pocs/cve-2026-85984
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter
48RISK
open ↗GitHub PoC
Hasyros/CVE-2026-101160-dos-wp-ultimate-review-rating
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating
41RISK
open ↗GitHub PoC★ 1
CVE-2026-100740 PoC: D-Link DIR-895L A1_102b07 L2TP Host Name AVP out-of-bounds write in tunnel_set_params (UDP 1701). Device fingerprint + optional OOB trigger packet for authorized lab testing. https://pocbit.org/pocs/cve-2026-100740
D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write
48RISK
open ↗GitHub PoC
PHP Object Injection in Profile Builder < 4.0.1
Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export
33RISK
open ↗GitHub PoC
CVE-2026-100835 PoC: Edgeless Contrast <1.16.0 remote attestation relay (aTLS / CWE-295). Manifest audit (AllowedChipIDs/AllowedPIIDs), version & coordinator probe. https://pocbit.org/pocs/cve-2026-100835
Contrast before 1.16.0 Remote Attestation Relay Attack
48RISK
open ↗GitHub PoC
CVE-2026-71963 - Hermes Agent 0.18.2-0.21.0 RCE via a repository-delivered .git/config (core.fsmonitor). Stdlib-only Python, verified on real 0.21.0 with a clean negative control on the fixed build.
Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.