Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,035cataloged exploits
39,531CVEs with public exploitation
24,695lab-tested
AllReferência 25,557Exploit-DB 24,485GitHub PoC 16,313VulnCheck XDB 9,678Nuclei 4,478Metasploit 3,524✓ verified onlyrecentpopularrisk
16,313 exploits
GitHub PoC
Reproducer for CVE-2026-78165 (Apache Camel camel-spring-redis): default JdkSerializationRedisSerializer deserializes Redis PUBLISH payloads with no ObjectInputFilter (RCE) — Camel Spring Boot + Camel Quarkus
Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads
38RISK
open ↗GitHub PoC★ 1
Reproducer for CVE-2026-79983 (Apache Camel camel-ftp): the consumer builds the remote path from the server's directory listing without containment, escaping the polled directory — Camel Spring Boot + Camel Quarkus
Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
38RISK
open ↗GitHub PoC
Reproducer for CVE-2026-79985 (Apache Camel camel-smb): the SMB consumer builds the remote path from the share listing without containment (author-only; see CVE-2026-79983/79984 for the runnable mechanism) — Camel Spring Boot + Camel Quarkus
Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
38RISK
open ↗GitHub PoC
Reproducer for CVE-2026-79986 (Apache Camel camel-azure-files): the consumer builds the remote path from the share listing without containment (author-only; see CVE-2026-79983/79984 for the runnable mechanism) — Camel Spring Boot + Camel Quarkus
Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
38RISK
open ↗GitHub PoC
Frappe HRMS missing input validation SQL injection vulnerability
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
41RISK
open ↗GitHub PoC
Wheels SQL injection on MySQL/MariaDB with backslash escaping enabled
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent)
48RISK
open ↗GitHub PoC★ 1
CVE-2026-97229: GitLab RCE Unauthenticated via CI Lint
Integer Overflow or Wraparound in GitLab
48RISK
open ↗GitHub PoC★ 3
CVE-2026-102764 BeyondTrust Remote Support unauthenticated file write / RCE proof of concept
Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
78RISK
open ↗GitHub PoC
ExifToolExploit CVE-2021-22204 \\ Arbitrary Code Execution
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISK
open ↗GitHub PoC
Ferramentas de auditoria em segurança da informação, reconhecimento de superfície com RDAP/DNS e análise defensiva web (CVE-2024-10924).
Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
85RISK
open ↗GitHub PoC★ 2
Neterbit NW-431F unauthenticated SMS disclosure
Neterbit NW-431F Embedded Web Server sms.json information disclosure
33RISK
open ↗GitHub PoC
POC for the CVE-2026-104711 - New Variant
Apache Struts: OGNL injection in the legacy RESTful action mapper
48RISK
open ↗GitHub PoC
CVE-2026-12118 POC
IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data
48RISK
open ↗GitHub PoC
Free CLI: check a Nextcloud instance for CVE-2026-110447 exposure. Stdlib only, honest verdicts. By Ingenious AI.
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution
48RISK
open ↗GitHub PoC
CTF writeup: rooting a Linux box via CVE-2024-23334 (directory traversal) and CVE-2025-32463 (sudo privilege escalation)
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
70RISK
open ↗GitHub PoC
BlindLlama: CVE-2026-102697 Reproduction
Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization
41RISK
open ↗GitHub PoC
Detection-only check for the Ivanti Connect Secure authentication bypass (CVE-2026-104935)
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb
91RISK
open ↗GitHub PoC
A PoC for CVE-2026-110912 'arpbleed'
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.
41RISK
open ↗GitHub PoC★ 1
CVE-2026-85097 — Bricksforge <= 3.1.8.9 unauth file upload to RCE. GIF/PHP polyglot + temporaryFileUploads.url mismatch. python3 exploit.py --url http://TARGET
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
48RISK
open ↗GitHub PoC
CVE-2026-0322
PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
71RISK
open ↗GitHub PoC
CVE-2026-64507 — PoC: IBPB flush on BPF JIT allocation
x86/bugs: Enable IBPB flush on BPF JIT allocation
23RISK
open ↗GitHub PoC★ 1
CVE-2026-110912
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.
41RISK
open ↗GitHub PoC
Proof of concept and vulnerability checker for CVE-2026-18963, an unauthenticated account takeover in the Keycloak reset-credentials flow. Single-file Python, optional Playwright browser component.
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISK
open ↗GitHub PoC
CVE-2026-104715: cifs-utils credentials-file option injection (local root)
Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
41RISK
open ↗GitHub PoC★ 25
一加 15T（PLZ110）临时 root + KernelSU per-boot 接管：CVE-2026-64560 移植，不写分区、重启即失效。内核 6.12.69-android16-6-g242e1a07f878。
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISK
open ↗GitHub PoC
Benign, self-contained reproduction of CVE-2026-77521 (MaxKB prompt-injectable command execution)
MaxKB: Prompt-injectable agent can lead to command execution
48RISK
open ↗GitHub PoC
Unauthenticated RCE via Velocity Template Language (VTL) injection in Floci API Gateway mapping templates (versions 1.1.0–2.2.0). CVSS 9.8 Critical.
Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates
48RISK
open ↗GitHub PoC
CTF writeup: rooting a Linux box via CVE-2024-23334 (directory traversal) and CVE-2025-32463 (sudo privilege escalation)
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.