Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,900cataloged exploits

36,847CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,475Referência 23,360GitHub PoC 15,228VulnCheck XDB 8,946Nuclei 4,390Metasploit 3,501✓ verified onlyrecent popular risk

79,900 exploits

GitHub PoC★ 1

ThorVG NULL pointer dereference via malformed SVG — AFL++ fuzzing writeup

CVE-2026-45729MEDIUM22 Jul 2026

ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input

33RISK

open ↗

GitHub PoC

CVE-2026-63030 & CVE-2026-60137 Wp2shell Poc

CVE-2026-63030CRITICALunder attack22 Jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISK

open ↗

GitHub PoC★ 3

CVE-2026-14266 - XZ Heap Buffer Overflow PoC Generator for 7-Zip

CVE-2026-14266HIGH22 Jul 2026

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

41RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-58138CRITICAL22 Jul 2026

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

63RISK

open ↗

Metasploit600

Check Point SmartConsole Authentication Bypass Run Script RCE

CVE-2026-16232CRITICALunder attack22 Jul 2026

Authentication Bypass in the SmartConsole Login Process Using an Application Token

100RISK

open ↗

GitHub PoC★ 12

CVE-2026-46331 and CVE-2026-43503

CVE-2026-46331HIGH22 Jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-60137MEDIUMunder attack22 Jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

100RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-60137MEDIUMunder attack22 Jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

100RISK

open ↗

GitHub PoC★ 1

CVE-2026-16540 — Simply Schedule Appointments < 1.6.12.6 Unauthenticated Appointment Data Disclosure and Mass Deletion

CVE-2026-16540HIGH22 Jul 2026

Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

41RISK

open ↗

GitHub PoC

PoC reproducer for CVE-2026-55993 (Apache Camel camel-atmosphere-websocket): the WebSocket consumer copies connection query parameters onto the Exchange unfiltered, so an injected CamelHttpUri drives a server-side request (SSRF) and leaks resolved property placeholders. Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-55993HIGH22 Jul 2026

Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling influencing internal behaviour

41RISK

open ↗

GitHub PoC★ 17

CVE-2026-43499 PoC Scanner

CVE-2026-43499HIGH22 Jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

open ↗

VulnCheck XDB

denial-of-service

CVE-2026-41089CRITICAL22 Jul 2026

Windows Netlogon Remote Code Execution Vulnerability

70RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-63030CRITICALunder attack22 Jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISK

open ↗

GitHub PoC

CVE-2026-58138 - Conductor (3.21.21..<3.30.2) unauthenticated RCE via INLINE GraalVM evaluator

CVE-2026-58138CRITICAL22 Jul 2026

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

63RISK

open ↗

VulnCheck XDB

local

CVE-2023-32629HIGH22 Jul 2026

Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks

61RISK

open ↗

VulnCheck XDB

local

CVE-2023-2640HIGH22 Jul 2026

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlay

61RISK

open ↗

GitHub PoC★ 15

Pre-auth RCE PoC for WordPress core — chains CVE-2026-63030 (REST /batch/v1 route-confusion desync) with CVE-2026-60137 (author__not_in SQLi) into an unauthenticated shell. Authorized testing only.

CVE-2026-63030CRITICALunder attack22 Jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISK

open ↗

VulnCheck XDB

local

CVE-2026-46331HIGH22 Jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISK

open ↗

GitHub PoC

full javascript reproduction of CVE-2026-63030 (author_exclude, author__not_in and misalignment between validations and matches)

CVE-2026-63030CRITICALunder attack22 Jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISK

open ↗

GitHub PoC

Full ML-KEM-1024 key recovery from a partial Fujisaki-Okamoto comparison in wolfSSL (CVE-2026-6330 NEON, CVE-2026-10097 AVX2)

CVE-2026-6330MEDIUM22 Jul 2026

ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

33RISK

open ↗

GitHub PoC★ 1

Scan Windows Domain Controllers for CVE-2026-41089 to detect unauthenticated remote code execution vulnerabilities in the Netlogon service.

CVE-2026-41089CRITICAL22 Jul 2026

Windows Netlogon Remote Code Execution Vulnerability

70RISK

open ↗

GitHub PoC

PoC reproducer for CVE-2026-56139 (Apache Camel camel-undertow Rest DSL): the Rest DSL binding hard-codes muteException=false, so a configured muteException=true is ignored and an uncaught exception's full stack trace is returned to the client (CWE-209). Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-56139MEDIUM22 Jul 2026

Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients

33RISK

open ↗

GitHub PoC

CVE-2026-50522

CVE-2026-50522CRITICALunder attack22 Jul 2026

Microsoft SharePoint Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC

This repository documents the process of identifying, analyzing, and gathering Open Source Intelligence (OSINT) on a specific security vulnerability detected during a target network scan.

CVE-2012-1823CRITICALunder attack22 Jul 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RISK

open ↗

GitHub PoC★ 1

Vulnerabilidad en NGINX

CVE-2026-42533CRITICAL22 Jul 2026

NGINX Map directive and Regex matching vulnerability

48RISK

open ↗

GitHub PoC

my exploit for GLPI

CVE-2022-35914CRITICALunder attack21 Jul 2026

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

100RISK

open ↗

GitHub PoC

WhatsWrongAndWhy/CVE-2021-22555

CVE-2021-22555HIGHunder attack21 Jul 2026

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

100RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-9198CRITICALunder attack21 Jul 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

100RISK

open ↗

GitHub PoC

mass_cve-2021-41773

CVE-2021-41773HIGHunder attackransomware21 Jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

open ↗

GitHub PoC

CVE-2026-13156 Vulnerability Advisory & PoC — Discovered by Huynh Kien Minh (MinhHK).

CVE-2026-13156MEDIUM21 Jul 2026

MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.