Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,900cataloged exploits

36,847CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,475Referência 23,360GitHub PoC 15,228VulnCheck XDB 8,946Nuclei 4,390Metasploit 3,501✓ verified onlyrecent popular risk

79,900 exploits

GitHub PoC★ 101

Proof-of-concept exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining a broken access, CAB arbitrary-write path traversal, certificate verification bypass, and DLL hijacking to achieve SYSTEM-level code execution.

CVE-2026-47301HIGH03 Aug 2026

Configuration Manager Elevation of Privilege Vulnerability

41RISK

VulnCheck XDB

initial-access

CVE-2022-22965CRITICALunder attack03 Aug 2026

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

VulnCheck XDB

initial-access

CVE-2026-16232CRITICALunder attack03 Aug 2026

Authentication Bypass in the SmartConsole Login Process Using an Application Token

100RISK

GitHub PoC

fastjson vulnerability scanner - detect fastjson in JARs and Spring Boot fat-JARs, check exposure to CVE-2026-16723, and verify whether you already run the official patch 1.2.84. Zero-dependency offline CLI. fastjson 漏洞检测与排查工具：一条命令扫描依赖，支持 fat-JAR 与 shaded 依赖，并判定是否已升到官方补丁版本 1.2.84。

CVE-2026-16723CRITICAL03 Aug 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

53RISK

GitHub PoC★ 60

villager1314/CVE-2026-64560-Analysis

CVE-2026-64560HIGH03 Aug 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISK

GitHub PoC

siboy17/CVE-2022-21907-http.sys

CVE-2022-21907CRITICAL03 Aug 2026

HTTP Protocol Stack Remote Code Execution Vulnerability

70RISK

GitHub PoC

George0Papasotiriou/CVE-2026-6666-XPC-Service-NSKeyedUnarchiver-Deserialization-Attack-macOS-iOS-simulation-

CVE-2026-6666MEDIUM03 Aug 2026

PgBouncer crash in kill_pool_logins_server_error

33RISK

GitHub PoC

Path traversal (Tar Slip) in Cornac via _extract_archive (CVE-2026-43637)

CVE-2026-43637HIGH03 Aug 2026

Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py

41RISK

GitHub PoC★ 2

Kangaroo is a exploit built on CVE-2026-32746. i made this for security researchers, IT professionals, DevOps. so they can understand it better. DO NOT USE THIS FOR ILLEGAL USE, IF YOU DO... YOU MAY BE SUBJECT TO ARREST, AND FINES.

CVE-2026-32746CRITICAL02 Aug 2026

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption

53RISK

GitHub PoC

Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

CVE-2026-13714CRITICAL02 Aug 2026

Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

48RISK

GitHub PoC

Mass vulnerability scanner for CVE-2026-49049 – Unauthenticated Remote Code Execution in Joomla Helix3 plugin. Multi‑threaded, detects both executed and raw PHP payloads.

CVE-2026-49049HIGH02 Aug 2026

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

56RISK

GitHub PoC

CVE-2026-9809 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting Mautic 7 (versions 7.0.0 through 7.1.1).

CVE-2026-9809HIGH02 Aug 2026

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project

41RISK

GitHub PoC

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

CVE-2026-59941MEDIUM02 Aug 2026

Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

33RISK

GitHub PoC★ 3

WordPress CVE-2026-63030 and CVE-2026-60137 security tool for detecting exposure to the WP2Shell pre-authentication RCE chain.

CVE-2026-63030CRITICALunder attack02 Aug 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISK

GitHub PoC★ 1

TryHackMe Dirty Frag (CVE-2026-43284) — Linux LPE writeup

CVE-2026-43284HIGH02 Aug 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RISK

GitHub PoC★ 2

A flaw in Gitea Open Source Git Server’s approval‑gate logic allows a pull request that originates from a permanent fork to merge without satisfying the repository’s configured approval gates.

CVE-2026-58424HIGH02 Aug 2026

Permanent Fork PR Workflow Approval Gate Bypass

41RISK

GitHub PoC★ 3

CVE-2026-43499 for the Meta Quest

CVE-2026-43499HIGH02 Aug 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

GitHub PoC

VMware vCenter Server CVE-2021-21972 (RCE) — vulnerability analysis, detection, and mitigation

CVE-2021-21972CRITICALunder attackransomware02 Aug 2026

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor

100RISK

GitHub PoC

Log4Shell (CVE-2021-44228) research report — technical breakdown, root cause analysis, and end-to-end lab-reproduced exploit chain with evidence screenshots.

CVE-2021-44228CRITICALunder attackransomware02 Aug 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

CVE-2026-9811 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting Mautic 7 (versions 7.0.0 through 7.1.1).

CVE-2026-9811MEDIUM02 Aug 2026

A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering s

33RISK

GitHub PoC★ 20

the CVE-2026-43499 by iqooneo11

CVE-2026-43499HIGH02 Aug 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

GitHub PoC★ 9

Unauthenticated File Upload → RCE PoC for CVE-2026-57827 (RSFiles! Joomla < 1.17.12). Authorized security research use only.

CVE-2026-57827CRITICAL02 Aug 2026

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

63RISK

GitHub PoC

CVE-2026-9806 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting CTI Transmute versions prior to the patched release.

CVE-2026-9806MEDIUM02 Aug 2026

Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Names

33RISK

GitHub PoC

Simple POC for CVE-2026-39987

CVE-2026-39987CRITICALunder attack02 Aug 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISK

GitHub PoC

CVE-2026-39987 poc

CVE-2026-39987CRITICALunder attack02 Aug 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISK

GitHub PoC

Marimo exploit prior to 0.23.0. Pre-Auth RCE vulnerability via websocket endpoint : /terminal/ws.

CVE-2026-39987CRITICALunder attack02 Aug 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISK

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALunder attack02 Aug 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISK

GitHub PoC★ 170

Jailbreak supported Google Pixel phones with CVE-2026-43499

CVE-2026-43499HIGH02 Aug 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALunder attack02 Aug 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISK

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALunder attack02 Aug 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.