Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,513cataloged exploits
40,739CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,194VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,510 exploits
VulnCheck XDB
initial-access
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
100RISK
open ↗GitHub PoC★ 1
AdapptOnAzure/cve-2026-111497-mitigation
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC★ 7
Node.js Brotli Decoder OOB Write to RCE
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC★ 1
Detect systems affected by PHP2Shell (CVE-2026-109618 / CVE-2026-109619) on Unix and Windows
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PoC and verification material for CVE-2026-63077 (JetBrains TeamCity agent-polling deserialization RCE)
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RISK
open ↗GitHub PoC★ 4
Patches and Windows build scripts for PHP 5.6-7.4 fixing CVE-2026-109618 / CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
AriaWave PHP2Shell (CVE-2026-109618 & CVE-2026-109619) Defensive Readiness, SAPI, Apache RLimitMEM & INI Override Scanner + Autonomous Agent Skill (SKILL.md)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Log4Shell (CVE-2021-44228) audit, research notes, and remediation tracking for quarterly security briefing
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC★ 194
PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Test fixture: pins PHP versions vulnerable to php2shell (CVE-2026-109618/109619) on purpose. Do not deploy.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Writeup + PoC for CVE-2026-104068: JetBackup (WordPress) symlink arbitrary file write via backup restore (fixed 3.1.24.10)
JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore
41RISK
open ↗VulnCheck XDB
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.