Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,035cataloged exploits
39,531CVEs with public exploitation
24,695lab-tested
AllReferência 25,557Exploit-DB 24,485GitHub PoC 16,313VulnCheck XDB 9,678Nuclei 4,478Metasploit 3,524✓ verified onlyrecentpopularrisk
16,313 exploits
GitHub PoC
POC for the CVE-2026-104711 - New Variant
Apache Struts: OGNL injection in the legacy RESTful action mapper
48RISK
open ↗GitHub PoC
Tarangj07/Wordpress-Lab-CVE-2026-85097
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
48RISK
open ↗GitHub PoC
CVE-2026-104711 POC - Brand New
Apache Struts: OGNL injection in the legacy RESTful action mapper
48RISK
open ↗GitHub PoC★ 2
Wazuh PoC chaining CVE-2026-74034 file read and CVE-2026-74041 command execution; fixed in 4.14.8. Python standard library only.
Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
41RISK
open ↗GitHub PoC
Technical writeup of CVE-2026-109506, a vulnerability I found in multiple TP-Link Wi-Fi Range Extenders
Improper Authentication in Multiple TP-Link WiFi Repeaters
33RISK
open ↗GitHub PoC
For WordPress
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
48RISK
open ↗GitHub PoC
Autonomous submission for "Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability" (MSRC / GitHub Security Advisory)
ASP.NET Core Remote Code Execution Vulnerability
41RISK
open ↗GitHub PoC
CVE-2026-104748 POC
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
48RISK
open ↗GitHub PoC
Defensive exposure checker and poc for cURL CVE-2026-92392
HTTP/2 upload Use-After-Free
41RISK
open ↗GitHub PoC★ 4
A proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
63RISK
open ↗GitHub PoC★ 7
abdugafforov-bobur/cve-2026-107181-poc
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
41RISK
open ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
vhost: reset the vring metadata cache on vring reconfiguration
41RISK
open ↗GitHub PoC
DirtyFrag (CVE-2026-43284) pro Galaxy A57 5G (SM-A576B, A576BXXS6AZI2): gatilho libbase pro One UI 8.5 + dfroot.ko compilado exato pro 6.12.38-android16-5 do aparelho
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
open ↗GitHub PoC★ 47
wkpwn/CVE-2026-83834
Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC
myeongji1/cve-2026-63223-ctf
CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
48RISK
open ↗GitHub PoC
sohel160/Webfig-jsproxy-unauthenticated-file-read-CVE-2026-67281-
Unauthenticated file read in Mikrotik RouterOS
41RISK
open ↗GitHub PoC★ 2
ABC00012345/CVE-2026-74580
vhost: reset the vring metadata cache on vring reconfiguration
41RISK
open ↗GitHub PoC
Unauthenticated remote code execution on Cisco Secure Email Gateway via crafted email attachment. Path traversal in AMP File Reputation handling allows arbitrary file write as root when the service is enabled on a mail policy.
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
78RISK
open ↗GitHub PoC
EndlssNightmare/CVE-2026-18116
Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications
41RISK
open ↗GitHub PoC
Mr-Ochobot/CVE-2016-5195
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗GitHub PoC
V8 inlined Array.prototype.sort elements-kind confusion - PoC + addrof (N-day research)
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside
83RISK
open ↗GitHub PoC
Unauthenticated remote code execution on Cisco Secure Email Gateway via crafted email attachment. Path traversal in AMP File Reputation handling allows arbitrary file write as root when the service is enabled on a mail policy.
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
78RISK
open ↗GitHub PoC
adriyansyah-mf/cve-2026-110447
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution
48RISK
open ↗GitHub PoC★ 1
CVE-2026-97657 – Authentication Bypass & Account Takeover | Pocbit
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
48RISK
open ↗GitHub PoC
CVE-2021-4034 (PwnKit) - Python PoC
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗GitHub PoC★ 2
Unauthenticated privilege escalation in SimpleForm WordPress plugin <= 3.10.0. Registers an administrator account without authentication
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
48RISK
open ↗GitHub PoC
Heartbleed (CVE-2014-0160) reproduction and analysis —CSP Application Security project
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISK
open ↗GitHub PoC
ChakraCore InitProto type confusion - PoC
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
45RISK
open ↗GitHub PoC★ 2
Exploit para explotar la vulnerabilidad CVE-2020-25213 en WPFileManager < 6.9
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra
100RISK
open ↗GitHub PoC★ 1
SQL Injection via identifier injection in SLiMS 9.8.0 admin AJAX endpoints (tableName/tableFields). Any authenticated staff can dump password hashes.
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/A
20RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.