Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC
Find and fix PHP2Shell (CVE-2026-109618, CVE-2026-109619) on Linux, Windows and Docker without changing the PHP minor version. Same-branch patching, admin-locked mitigations, automatic rollback.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Standalone defensive checker project for Sharp/librsvg CVE-2026-96889. One exploit per repository; evidence-based assessment without exploit payloads.
Librsvg: use-after-free when xml includes have duplicated entities
41RISK
open ↗GitHub PoC
PHP2Shell — CVE-2026-109618 & CVE-2026-109619 research hub
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Free read-only self-check scripts for PHP2Shell (CVE-2026-109618), the LiteLLM 1.107.0 compromise and the eMudhra CA keys. Runs on your machine; nothing leaves your network.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Check a Next.js project against the October 14, 2026 security advisories (CVE-2026-96889, use cache RCE, Server Actions DoS). No dependencies.
Librsvg: use-after-free when xml includes have duplicated entities
41RISK
open ↗GitHub PoC
🚨 Emergency toolkit for PHP2Shell (CVE-2026-109618 & CVE-2026-109619) CVSS 9.2 - Unauthenticated RCE in PHP Core. Scanner + Temporary Mitigation + Permanent Fix Guide. Fixed: 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP 7.1 security backport for Debian 9 (stretch / buster 2018) fixing CVE-2026-109618 & CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88774. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Feature policy bypass due to improper HTTP URL based expression usage
41RISK
open ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58045: zlib synchronous API spoofed TypedArray crash. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:z
33RISK
open ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58041: SQLite cached iterator write replay. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to cont
33RISK
open ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-106073: Permission Model realpathSync read bypass. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissio
28RISK
open ↗GitHub PoC
Standalone defensive checker project for CVE-2026-58043: Node.js: Permission Model path-prefix over-grant. One exploit per repository; implementation pending.
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
41RISK
open ↗GitHub PoC
Standalone defensive checker project for CVE-2026-56850: Node.js: HTTPS Agent PFX client identity collision. One exploit per repository; implementation pending.
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cli
33RISK
open ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-105481: HTTP keep-alive premature-response acceptance. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the
33RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88771. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RISK
open ↗GitHub PoC
Standalone defensive checker project for Tinypool CVE-2026-104849. One exploit per repository; implementation pending.
Tinypool: Prototype Pollution Gadget to RCE in run() options
48RISK
open ↗GitHub PoC
Standalone defensive checker project for CVE-2026-21589: Atlassian self-managed products: Data Center arbitrary file access. One exploit per repository; implementation pending.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISK
open ↗GitHub PoC★ 3
Detect systems affected by Node2Shell (CVE-2026-111497) on Unix and Windows
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
An educational PHP2Shell (CVE-2026-109618 / CVE-2026-109619) learning lab demonstrating HTTP upload handling, memory-safety concepts, safe request simulation, and defensive monitoring. Includes Python examples, Docker setup, unit tests, and a beginner-friendly guide. No exploit payloads or real-world attacks.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
scanner CVE-2026-109618/CVE-2026-109619. write with bun
RCE via OOM corruption
100RISK
open ↗GitHub PoC
This is made for php2shell-CVE-2026-109618-CVE-2026-109619-PoC.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Standalone defensive checker project for Flowise CVE-2026-69254 (nodeVMOptions sandbox override). One exploit per repository; implementation pending.
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
48RISK
open ↗GitHub PoC★ 8
ZeroHack: Node2Shell (CVE-2026-111497) Docker Lab & PoC Framework
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC★ 1
Defense guide + static scanner for CVE-2026-108551 (openapi-typescript-codegen code injection).
openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates
48RISK
open ↗GitHub PoC
Standalone defensive checker project for CVE-2026-58040: Node.js: HTTPS Agent TLS session identity-policy bypass. One exploit per repository; implementation pending.
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across ident
33RISK
open ↗GitHub PoC
CVE-2026-109618 / CVE-2026-109619 本地复现笔记：UAF 原语验证、利用链边界分析、加固方案
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Single-file PoC for CVE-2026-109618/109619 (PHP session upload_progress OOM UAF -> RCE). Authorized internal testing only.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-106070: ZipFile invalid-header content substitution. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after th
28RISK
open ↗GitHub PoC
CentOS 7 Remi PHP 7.4/8.3 rebuild for CVE-2026-109618/109619
RCE via OOM corruption
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.