Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,337cataloged exploits
39,873CVEs with public exploitation
24,696lab-tested
AllReferência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecentpopularrisk
17,115 exploits
GitHub PoC
Redacted notes on CVE-2026-28618 / StreamBox APV lab — heap write into a session object via FRAME height mismatch
In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote cod
41RISK
open ↗GitHub PoC★ 31
Proof of concept for CVE-2026-43786, a local privilege escalation vulnerability in macOS CoreServices that allows an application to gain root privileges.
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia
41RISK
open ↗GitHub PoC
Craft CMS CVE-2026-72781 Twig sandbox escape RCE PoC
Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
41RISK
open ↗GitHub PoC★ 1
PoC exploit and scanner for CVE-2026-89026, targeting the Issabel PBXAPI authentication vulnerability
Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
63RISK
open ↗GitHub PoC★ 7
POC for CVE-2026-94128
BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where
48RISK
open ↗GitHub PoC★ 1
XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638)
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
56RISK
open ↗GitHub PoC
Security research lab — Unauthenticated RCE via insecure deserialization in ComfyUI v0.23.0 (CVSS 9.8). Isolated Docker environment, technical analysis and documentation.
ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization
48RISK
open ↗GitHub PoC
ExDev994/CVE-2026-90817
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
63RISK
open ↗GitHub PoC
A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header — no credentials required.
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
33RISK
open ↗GitHub PoC
Mass check/research exploit for HP HPLIP CVE-2026-91097–91106 (<3.26.6), PAPPL :8000 IPP probes + hpssd templates
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
41RISK
open ↗GitHub PoC★ 1
Netcore NBR200V2 traceroute command injection PoC (CVE-2026-94095); ubus JSON-RPC -> system() root RCE; for authorized testing
Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection
48RISK
open ↗GitHub PoC
Arbitrary File Upload Under
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
63RISK
open ↗GitHub PoC★ 1
Technical details, proof of concept, and responsible disclosure timeline for CVE-2026-93528 (Unauthenticated Order Data Disclosure in NP Quote Request for WooCommerce).
NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page
28RISK
open ↗GitHub PoC
Linux CVE-2026-43284 & CVE-2026-43500
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
open ↗GitHub PoC★ 8
Proof-of-concept and instrumented reproduction harness for CVE-2026-28609, an out-of-bounds write in Android's MatroskaExtractor reachable via a crafted WebM file with a big-endian PCM audio track.
In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to re
41RISK
open ↗GitHub PoC★ 2
D-Link R95 (BE9500) DHMAPI SetTimeSettings command injection -> root RCE PoC (CVE-2026-93958); for authorized testing
D-Link R95 DHMAPI ssi system os command injection
48RISK
open ↗GitHub PoC
mfahdk/CVE-2026-39987_RCE_PoC
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
open ↗GitHub PoC
CVE-2026-36213: MEmu Android Emulator 9.2.7.0 Local Privilege Escalation
An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.e
41RISK
open ↗GitHub PoC★ 1
DJI Drone Cleartext Bluetooth Transmission of Wi-Fi PSK and Session UUID — Proof of Concept for CVE-2026-77812.
Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE
48RISK
open ↗GitHub PoC
Unauthenticated Arbitrary Shortcode Execution
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
48RISK
open ↗GitHub PoC★ 2
CVE-2026-88854 — OrdaSoft Joomla Gallery unauth SQLi PoC (check / mass scan / EXTRACTVALUE read)
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
48RISK
open ↗GitHub PoC★ 19
DJI Drone DUML Command Injection over Bluetooth — Proof of Concept for CVE-2026-78306
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
41RISK
open ↗GitHub PoC
CVE-2021-43798 Grafana Unauthenticated Path Traversal - Security Lab | Shivam Gupta | 23104003
Grafana path traversal
100RISK
open ↗GitHub PoC
CVE-2026-36213: MEmu Android Emulator 9.2.7.0 Local Privilege Escalation
An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.e
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.