Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,513cataloged exploits
40,739CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,194VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,515 exploits
GitHub PoC★ 4
Unofficial rebuild of PHP 7.4 for EL7 (CentOS/RHEL 7) with the php2shell fix (CVE-2026-109618/109619). A stopgap for EOL stacks — upgrading is the real fix.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Security Ways for AI coding agents. First member audits Node.js repos for the Oct 21, 2026 security release (CVE-2026-111497 Brotli RCE) and opens a patch PR only if affected.
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC★ 1
Honeypot to attract attacks for php2shell (CVE-2026-109618 and CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Detecteur CVE-2026-109618 / CVE-2026-109619 (php2shell) pour image Docker ou binaire PHP
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP2Shell (CVE-2026-109618/109619) one-click detect & fix tool
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 3
CVE-2026-111497: Node.js Brotli decoder OOB write — analysis, PoC, Docker lab
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Rebuilds of patched ondrej/php PHP 8.1, 8.0, 7.4, 7.3 and 5.6 packages for Ubuntu 20.04 (CVE-2026-109618, CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Nuclei template for php2shell (CVE-2026-109618 / CVE-2026-109619) - version-based detection, no exploitation
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
initial-access
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
100RISK
open ↗GitHub PoC★ 194
PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Security advisory and PoC for CVE-2026-107079 affecting Systrome Validation & Certification 1.0.
An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parame
33RISK
open ↗GitHub PoC★ 1
Agent skill + zero-dependency script: check a Node.js project against the Oct 2026 Node.js security release (Brotli RCE CVE-2026-111497 and 9 more) and bump version pins to the patched release
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Chrome extension for Blue Teams: passively identify a site's PHP version and PHP2Shell (CVE-2026-109618/109619) exposure.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
CVE-2026-110264 — GitLab Unauthenticated RCE (Onigmo regex repeat-ID overflow, CVSS 10.0). Docker-verified crash PoC on ruby 3.4.11 + measured heap analysis. Crash-level, non-weaponized.
Integer Overflow or Wraparound in GitLab
48RISK
open ↗GitHub PoC
Go app using Coraza WAF (CVE-2026-114101 bypass)
Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
33RISK
open ↗GitHub PoC
Node.js app using adm-zip (CVE-2026-114102 DoS)
adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
41RISK
open ↗GitHub PoC
Quick and dirty hunting script for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on ISPConfig servers.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Detect PHP2Shell (CVE-2026-109618, CVE-2026-109619) PHP RCE exploitation attempts by inspecting POST request bodies with nginx mirror
RCE via OOM corruption
100RISK
open ↗GitHub PoC
php2shell-checker Checks any website or internal service for PHP vulnerabilities relating to CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.