Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,337cataloged exploits

39,873CVEs with public exploitation

24,696lab-tested

All Referência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecent popular risk

17,115 exploits

GitHub PoC★ 8

Proof-of-concept and instrumented reproduction harness for CVE-2026-28609, an out-of-bounds write in Android's MatroskaExtractor reachable via a crafted WebM file with a big-endian PCM audio track.

CVE-2026-28609HIGH20 Sep 2026

In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to re

41RISK

GitHub PoC★ 2

D-Link R95 (BE9500) DHMAPI SetTimeSettings command injection -> root RCE PoC (CVE-2026-93958); for authorized testing

CVE-2026-93958CRITICAL20 Sep 2026

D-Link R95 DHMAPI ssi system os command injection

48RISK

GitHub PoC★ 2

CVE-2026-88854 — OrdaSoft Joomla Gallery unauth SQLi PoC (check / mass scan / EXTRACTVALUE read)

CVE-2026-88854CRITICAL20 Sep 2026

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

48RISK

GitHub PoC

o-sec/CVE-2026-41452-poc

CVE-2026-41452CRITICAL20 Sep 2026

Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup

63RISK

GitHub PoC★ 1

CVE-2026-32475 — unauthenticated arbitrary file upload in Elementor Pro <= 4.2.1 (CVSS 9.0, CWE-434). PoC for authorised testing.

CVE-2026-32475CRITICAL19 Sep 2026

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

63RISK

GitHub PoC★ 1

CVE-2026-78159 - stellarwp - Critical 9.8 - Unauthenticated POST /wp-comments-post.php - Remote Code Execution

CVE-2026-78159CRITICAL19 Sep 2026

The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

48RISK

GitHub PoC

PoC for CVE-2026-84434: unauthenticated arbitrary file upload in Gravity Forms ≤3.1.0.4 via hidden File Upload fields. Python check/exploit/mass scan.

CVE-2026-84434CRITICAL19 Sep 2026

Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field

63RISK

GitHub PoC

CVE-2026-81648 - WordPress - CryptoPayment Gateway - Critical 10.0 - Unauthenticated POST /wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax.php - Arbitrary File Deletion

CVE-2026-81648CRITICAL19 Sep 2026

CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router

48RISK

GitHub PoC

CVE-2026-81000

CVE-2026-81000HIGH19 Sep 2026

net: tun: bound receive headroom

41RISK

GitHub PoC★ 1

Trained to Escalate: Forensic Analysis and Local Replication of RLHF-Induced Privilege Escalation in AI Agents (CVE-2026-65616)

CVE-2026-65616HIGH19 Sep 2026

Potential privilege escalation to JFrog administrator privileges

41RISK

GitHub PoC

CVE-2026-68121

CVE-2026-68121HIGH19 Sep 2026

pppoe: reload header pointer after dev_hard_header()

41RISK

GitHub PoC★ 4

CVE-2026-92229 — Forminator ≤1.57.2 unauth shortcode exec (current_url / quiz AJAX). Python 3 PoC.

CVE-2026-92229CRITICAL19 Sep 2026

Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

48RISK

GitHub PoC★ 2

PoC for CVE-2026-89274: unauthenticated arbitrary shortcode execution in WP Recipe Maker ≤10.8.1 via recipe rating comments (JSON-LD). Python check/exploit/verify.

CVE-2026-89274CRITICAL19 Sep 2026

WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

48RISK

GitHub PoC

Stored XSS in Concrete CMS Community Store leads to admin dashboard takeover

CVE-2026-93659HIGH19 Sep 2026

Concrete CMS Community Store before 2.7.8 Stored XSS

41RISK

GitHub PoC

CVE-2026-19952 - DynamiApps - High 7.5 - Unauthenticated POST /wp-admin/admin-ajax.php - Arbitrary File Deletion

CVE-2026-19952HIGH19 Sep 2026

Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag

41RISK

GitHub PoC

CVE-2026-74469

CVE-2026-74469HIGH19 Sep 2026

sctp: prevent peer transport count overflow

41RISK

GitHub PoC

CVE-2026-13447 - WordPress - inspireui - Critical 9.8 - Unauthenticated POST /wp-json/api/flutter_user/firebase_sms_v2 - Authentication Bypass

CVE-2026-13447CRITICAL19 Sep 2026

MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

48RISK

GitHub PoC

CVE-2026-18937 - Broken Link Checker - Critical 9.0 - Unauthenticated GET /?page_id=4&shortcode_tags[blcpoc]=po... - Remote Code Execution

CVE-2026-18937CRITICAL19 Sep 2026

Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection

63RISK

GitHub PoC

MohammadAliMehri/cve-2021-44790-lab

CVE-2021-44790—19 Sep 2026

Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

45RISK

GitHub PoC

djzzlim/CVE-2026-94036

CVE-2026-94036HIGH19 Sep 2026

D-Link DIR-X1860/DIR-X1860Z routerd ubus access control

41RISK

GitHub PoC

Standalone authorized universal HTTP PoC for CVE-2026-75157

CVE-2026-75157HIGH19 Sep 2026

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

41RISK

GitHub PoC

CVE-2026-75816 - Frontend Admin by DynamiApps for Wordpress - Critical 9.8 - Unauthenticated POST /wp-admin/admin-ajax.php - Account Takeover

CVE-2026-75816CRITICAL19 Sep 2026

Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

48RISK

GitHub PoC★ 2

CVE-2026-81294 - WordPress - Critical 9.8 - Unauthenticated Privilege Escalation

CVE-2026-81294CRITICAL19 Sep 2026

WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability

48RISK

GitHub PoC

CVE-2026-77635 - CakePHP - Critical 9.2 - Unauthenticated GET /?path= - SQL Injection

CVE-2026-77635CRITICAL19 Sep 2026

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

48RISK

GitHub PoC

abhaybansal16/cve-2025-55182-lab

CVE-2025-55182CRITICALunder attackransomware19 Sep 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

GitHub PoC

CVE-2026-85721: offline checker for org.asynchttpclient:async-http-client against all 26 repository-level advisories. 3.x is fixed in 3.0.14. The 2.x line is end of life - its last release 2.16.1 is still affected by 5 advisories that will not be fixed. 9 of the 26 are still missing from the GitHub Advisory Database (as of 2026-10-12).

CVE-2026-85721HIGH19 Sep 2026

AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

41RISK

GitHub PoC

CVE-2026-79752 - CakePHP - Critical 9.2 - Unauthenticated GET /?type= - SQL Injection

CVE-2026-79752CRITICAL19 Sep 2026

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

48RISK

GitHub PoC

CVE-2026-80844

CVE-2026-80844—19 Sep 2026

xfrm: ah6: validate routing header segments_left

23RISK

GitHub PoC

IDOR/BOLA in Events Manager <= 7.4.3 REST ticket update endpoint — CVE-2026-93661

CVE-2026-93661LOW19 Sep 2026

Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR

28RISK

GitHub PoC

Enumerate Grafana plugin enumeration PoC for CVE-2021-43798

CVE-2021-43798HIGHunder attack18 Sep 2026

Grafana path traversal

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.