Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,900cataloged exploits
36,847CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,475Referência 23,360GitHub PoC 15,228VulnCheck XDB 8,946Nuclei 4,390Metasploit 3,501✓ verified onlyrecentpopularrisk
79,900 exploits
GitHub PoC
kxom9ks/CVE-2024-27198
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISK
open ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
100RISK
open ↗GitHub PoC★ 1
Security Advisory: Out-of-Bounds Read in facil.io MIME Parser leads to Server crash
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
41RISK
open ↗GitHub PoC
Pedit COW – Linux Kernel Local Privilege Escalation (CVE-2026-46331)
net/sched: fix pedit partial COW leading to page cache corruption
41RISK
open ↗GitHub PoC★ 1
Security Advisory: Camaleon CMS - Authenticated RCE via `select_eval` Custom Field
Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field
41RISK
open ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
blue-chocolates/CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗GitHub PoC
Giangdurian/CVE-2026-63030-CVE-2026-60137
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RISK
open ↗GitHub PoC
kxom9ks/CVE-2024-27198-TeamCity
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISK
open ↗GitHub PoC
Legacy HPE iMC vuln
A disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than ve
23RISK
open ↗GitHub PoC
CVE Reproduction: cve-2025-2783-chrome_sandbox_escape_reproduction
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allow
71RISK
open ↗GitHub PoC
ghostpels/CVE-2026-13001
Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
63RISK
open ↗GitHub PoC★ 328
Certighost POC
Active Directory Certificate Services Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC
0xdak/CVE-2026-63766_exploit
GPT-SoVITS 20250606v2pro OS Command Injection via webui.py
48RISK
open ↗GitHub PoC★ 1
Metabase CVE-2026-59827 Vulnerability Scanner
Metabase: Unsafe Deserialization of H2 Query Results
48RISK
open ↗VulnCheck XDB
initial-access
PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
100RISK
open ↗GitHub PoC
finding by nvth
Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
21RISK
open ↗GitHub PoC
CVE Reproduction: cve-2026-0770-langflow_rce_reproduction
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC
CVE Reproduction: cve-2025-5777-citrixbleed2_reproduction
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISK
open ↗GitHub PoC★ 1
CVE Reproduction: cve-2026-41940-cpanel_authbypass_reproduction
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC
Security analysis and report of CVE-2024-6387 OpenSSH vulnerability, including vulnerability details, CVSS evaluation, and mitigation recommendations.
Openssh: regresshion - race condition in ssh allows rce/dos
63RISK
open ↗GitHub PoC
CVE-2026-64600 - Draft - Check todo
xfs: resample the data fork mapping after cycling ILOCK
41RISK
open ↗GitHub PoC
CVE-2026-66374: Knot Resolver 6.3.0 DNS-over-QUIC heap overflow (RCE)
Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) rece
41RISK
open ↗GitHub PoC
Dynamo2k1/CVE-2026-33017
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.