Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC
Standalone defensive checker project for CVE-2026-88774: Citrix NetScaler ADC / Gateway: URL-expression policy bypass. One exploit per repository; implementation pending.
Feature policy bypass due to improper HTTP URL based expression usage
41RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-19490. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
90RISK
open ↗GitHub PoC★ 1
Engine-level PHP2SHELL (CVE-2026-109618/109619) lab: stock PHP RCE, interactive exploit, multi-worker/TLS/OOB, Docker evidence.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Detection-only scanner for CVE-2026-109618 & CVE-2026-109619 (PHP). Authorized testing only.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
BotProtection, blocking reconnaissance scans used in exploits like PHP2Shell (CVE-2026-109618 / CVE-2026-109619) before malicious payloads reach the PHP runtime.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
php2shell CVE-2026-109618 CVE-2026-109619 detection tooling for Linux and Windows
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Standalone defensive checker project for CVE-2026-58040: Node.js: HTTPS Agent TLS session identity-policy bypass. One exploit per repository; implementation pending.
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across ident
33RISK
open ↗GitHub PoC
Offline Docker CopyEscape evidence checker for CVE-2026-17106. Docker version and build-configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Tar extraction in moby/go-archive can write outside the destination directory via link following
41RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88773. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
HTTP Request Smuggling
63RISK
open ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88775. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
41RISK
open ↗GitHub PoC
Standalone defensive checker project for CVE-2026-19489: Citrix NetScaler ADC / Gateway: LSN SIP ALG memory corruption. One exploit per repository; implementation pending.
Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: from 14.1 through 73.32 and from 13.1 thr
41RISK
open ↗GitHub PoC
Offline SonicWall SMA1000 evidence checker for CVE-2026-102256. Reported build and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi
41RISK
open ↗GitHub PoC
Offline SonicWall SMA1000 evidence checker for CVE-2026-102257. Reported build and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extrac
41RISK
open ↗GitHub PoC★ 1
Find every PHP install vulnerable to PHP2Shell (CVE-2026-109618, CVE-2026-109619) on hosts and container images. Single static binary, backport-aware, defensive only.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Standalone defensive checker project for CVE-2026-19490: Citrix NetScaler ADC / Gateway: Gateway / AAA alternate-path authentication bypass. One exploit per repository; implementation pending.
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
90RISK
open ↗GitHub PoC
Offline vm2 evidence checker for CVE-2026-92935. Sandbox package and nesting evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
vm2 NodeVM Remote Code Execution via Array-Shaped Require
48RISK
open ↗GitHub PoC
php2shell rce proof of concept for cve-2026-109618 and cve-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline Sharp / librsvg evidence checker for CVE-2026-96889. Sharp and librsvg version and build evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Librsvg: use-after-free when xml includes have duplicated entities
41RISK
open ↗GitHub PoC
Offline BeyondTrust Remote Support evidence checker for CVE-2026-102764. Remote Support version and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
100RISK
open ↗GitHub PoC
Offline SonicWall SMA1000 evidence checker for CVE-2026-102258. Reported build and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Managem
33RISK
open ↗GitHub PoC
POC for CVE-2022-24707, an authenticated SQL injection in Anuko Time Tracker’s Puncher plugin before 1.20.0.5642, caused by an unsanitized date POST parameter. It allows UNION-based and time-based blind SQL injection, enabling a logged-in user to dump the database
SQL injection in anuko timetracker
41RISK
open ↗GitHub PoC
Unofficial backports of PHP CVE-2026-109618/109619 (OOM RCE) for legacy PHP 5.4, 5.5 and 7.2 + Apache/FPM mitigations
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Root-cause analysis and PoC for CVE-2026-109715: an unguarded CacheIR stub for global-lexical SetGName in Firefox's SpiderMonkey JIT, yielding a cross-object slot-confused Value write from plain JavaScript.
Incorrect boundary conditions in the JavaScript Engine component
41RISK
open ↗GitHub PoC
Offline Ivanti Connect Secure evidence checker for CVE-2026-104935. Connect Secure build and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb
100RISK
open ↗GitHub PoC
Offline Docker Hub PAT evidence checker for CVE-2026-105445. Supplied evidence only; no token collection, login or API requests. JSON/CSV/HTML reports.
Docker Hub account conversion could reassign an active personal access token to another user
48RISK
open ↗GitHub PoC★ 8
PHP2Shell proof of concept for CVE-2026-109618 and CVE-2026-109619, with Docker labs and build-specific profiles for security research.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline SonicWall SMA1000 evidence checker for CVE-2026-102258. Reported build and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Managem
33RISK
open ↗GitHub PoC★ 1
CVE-2026-109618/109619 (php2shell) PHP exposure classifier and remediation planner. BSD-2-Clause.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-106069: TLS leading-zero IPv4 resolver mismatch. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addres
41RISK
open ↗GitHub PoC
Hardik007007/CVE-2026-31158-Boolean-Based-SQL-Injection-in-CRM-Login
SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbit
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.