Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC
PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Rust/Verus model, without a bug-specific property
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
CVE-2026-98260 temporary-root runner
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC
PoC and firmware emulation recipe for CVE-2026-122051 — unauthenticated command injection in the Edimax BR-6208AC /goform/mp handler (firmware ≤ 1.32)
Edimax BR-6208AC mp command injection
48RISK
open ↗GitHub PoC
Temporary iptables mitigation for CVE-2026-98432 (CVSS 9.8) on Ubuntu Linux. Filters inbound IPv4 TCP packets containing IP options while awaiting kernel security updates. Not a kernel patch.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
Temporary nftables mitigation + installer for CVE-2026-98432 (Ubuntu)
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
Docker config that patches/builds kernel w/ CVE_2026_98432 fix
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
0xg33k/CVE-2026-18470
Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response
41RISK
open ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗VulnCheck XDB
initial-access
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attac
50RISK
open ↗VulnCheck XDB
initial-access
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `sys
33RISK
open ↗VulnCheck XDB
remote-with-credentials
Redis Lua Use-After-Free may lead to remote code execution
85RISK
open ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗VulnCheck XDB
initial-access
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` a
41RISK
open ↗VulnCheck XDB
initial-access
UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
41RISK
open ↗GitHub PoC★ 1
Scanner CVE-2026-123158 *SSHHole
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC★ 4
CVE-2026-123158 SSHole — OpenSSH authentication bypass via musl crypt() overflow on Alpine Linux (Exploit PoC)
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC★ 1
Audit & interim mitigation for CVE-2026-123158 (*SSHole) — OpenSSH password bypass on musl/Alpine — across Docker containers, images and host
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
PHP CVE-2026-109619 stale session state: calibrated mod_php lab reproduction, evidence, and solver
RCE via stale global state
100RISK
open ↗GitHub PoC
Read-only check for CVE-2026-123158: is your Alpine sshd affected by the password authentication bypass, fixed, or still running the old daemon? Tested on Alpine 3.21 to 3.24 and edge.
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC★ 1
CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
HCL Domino / Notes eMudhra 憑證事件 (CVE-2026-91403) 的最小化清查與移除 SOP，純 keytool，不需大型工具
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE
48RISK
open ↗GitHub PoC
coboliqcom/cve-2026-123158-sshole-safe-rust
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISK
open ↗GitHub PoC
PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Lean 4 model, with the property that catches it
RCE via OOM corruption
100RISK
open ↗GitHub PoC
CVE-2026-114550 / ZDI-CAN-31039: libwebsockets MQTT PUBACK OOB write PoC lab (podman)
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
41RISK
open ↗GitHub PoC
PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Lean 4 model, without a bug-specific property
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Školní projekt: web o kritických zranitelnostech PHP2Shell (CVE-2026-109618/109619)
RCE via OOM corruption
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.