Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,062cataloged exploits

31,617CVEs with public exploitation

0lab-tested

All Exploit-DB 22,467Referência 19,791GitHub PoC 13,086VulnCheck XDB 8,069Nuclei 4,187Metasploit 3,462✓ verified onlyrecent popular risk

71,062 exploits

GitHub PoC

Reproducer for CVE-2026-40473: Apache Camel camel-mina MinaConverter.toObjectInput unsafe deserialization (RCE over TCP/UDP)

CVE-2026-40473HIGH09 Jul 2026

Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP

41RISK

open ↗

GitHub PoC

Laboratory validation of CVE-2026-48908 in Joomla SP Page Builder, covering unauthorized icon upload, PHP file write, code execution as www-data, auditd and PCAP evidence, event timeline reconstruction, and SOC detection recommendations. Includes Polish and English reports.

CVE-2026-48908CRITICAL09 Jul 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

48RISK

open ↗

GitHub PoC

PoC for CVE-2026-49230: Apache APISIX jwe-decrypt authentication bypass (missing AES-GCM tag validation, CWE-354, CVSS 9.1)

CVE-2026-49230MEDIUM09 Jul 2026

Apache APISIX: Authentication bypass in jwe-decrypt

33RISK

open ↗

GitHub PoC

cazzysoci/cve-2026-48908

CVE-2026-48908CRITICAL09 Jul 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

48RISK

open ↗

GitHub PoC★ 2

tc3650/CVE-2026-43499-armv7

CVE-2026-43499HIGH09 Jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

open ↗

GitHub PoC★ 1

Offical PoC for this cve

CVE-2026-56876HIGH09 Jul 2026

extract-zip unvalidated symlink path traversal

41RISK

open ↗

GitHub PoC★ 1

CVE-2026-53571 `server.fs.deny` bypass on Windows alternate paths PoC.

CVE-2026-53571HIGH09 Jul 2026

Vite: `server.fs.deny` bypass on Windows alternate paths

41RISK

open ↗

GitHub PoC

包括能执行的命令探测和一键getshell（需要服务器部署服务）

CVE-2026-8037CRITICAL09 Jul 2026

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

75RISK

open ↗

VulnCheck XDB

initial-access

CVE-2021-42013CRITICALunder attackransomware08 Jul 2026

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RISK

open ↗

GitHub PoC

zero-trace7/CVE-2026-50229

CVE-2026-50229MEDIUM08 Jul 2026

Apache Tomcat: XSS in number guess example

48RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-56290CRITICAL08 Jul 2026

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

48RISK

open ↗

Exploit-DB

Joomla Page Builder CK 3.5.10 - Arbitrary File Upload

CVE-2026-56290CRITICALwebappsmultiple08 Jul 2026

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

48RISK

open ↗

VulnCheck XDB

initial-access

CVE-2022-24706CRITICALunder attack08 Jul 2026

Remote Code Execution Vulnerability in Packaging

100RISK

open ↗

GitHub PoC

Proof of concept exploit for CVE-2026-3775/CVE-2026-3780 and CVE-2026-57239 which lets you obtain NT AUTHORITY\SYSTEM rights via the Foxit PDF Reader updater service.

CVE-2026-57239HIGH08 Jul 2026

Foxit PDF Editor/Reader Local Privilege Escalation

41RISK

open ↗

GitHub PoC★ 1

Blocking the DirtyFrag Linux LPE chain (CVE-2026-43284 / CVE-2026-43500) at runtime with a Cilium Tetragon TracingPolicy

CVE-2026-43284HIGH08 Jul 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-40048: Apache Camel camel-pqc FileBasedKeyLifecycleManager unsafe deserialization (RCE)

CVE-2026-40048HIGH08 Jul 2026

Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

41RISK

open ↗

GitHub PoC★ 2

Reproducer for CVE-2026-40047: Apache Camel camel-docling CLI argument injection / path traversal

CVE-2026-40047CRITICAL08 Jul 2026

Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

48RISK

open ↗

GitHub PoC

CVE-2026-43499 - Draft

CVE-2026-43499HIGH08 Jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

open ↗

GitHub PoC★ 6

CVE-2026-43499

CVE-2026-43499HIGH08 Jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

open ↗

GitHub PoC★ 3

CVE-2026-56290 - Mass Exploit for Joomla Com_pagebuilderck component (Unrestricted File Upload → RCE). Multi-threaded, automatic CSRF bypass, PHP shell uploader.

CVE-2026-56290CRITICAL08 Jul 2026

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

48RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-40453: Apache Camel case-variant Camel header injection (incomplete fix of CVE-2025-27636)

CVE-2026-40453CRITICAL08 Jul 2026

Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

48RISK

open ↗

GitHub PoC

Automated exploit for Krayin CRM ≤ 2.2.x.

CVE-2026-38526CRITICAL08 Jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RISK

open ↗

Exploit-DB

Krayin CRM v2.2.x - Authenticated Remote Code Execution

CVE-2026-38526CRITICAL08 Jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RISK

open ↗

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALunder attackransomware08 Jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

open ↗

GitHub PoC★ 1

CVE-2026-8206 - Kirki WordPress Plugin Unauthenticated Account Takeover - PoC & Analysis | CVSS 9.8 CRITICAL | AMN SECURITY

CVE-2026-8206CRITICAL08 Jul 2026

Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

48RISK

open ↗

GitHub PoC★ 1

CVE-2026-49777 - WooCommerce Product Slider Pro Malicious Software Implantation RCE - PoC & Analysis | CVSS 10.0 CRITICAL | AMN SECURITY

CVE-2026-49777CRITICAL08 Jul 2026

WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability

63RISK

open ↗

GitHub PoC★ 1

CVE-2026-0257 - Palo Alto PAN-OS GlobalProtect Auth Override Cookie Forgery - PoC & Analysis | CVSS 9.1 CRITICAL CISA KEV | AMN SECURITY

CVE-2026-0257HIGHunder attack08 Jul 2026

PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

100RISK

open ↗

GitHub PoC★ 2

Verificador de Vulnerabilidad: Bad Epoll (CVE-2026-46242)

CVE-2026-46242HIGH08 Jul 2026

eventpoll: fix ep_remove struct eventpoll / struct file UAF

41RISK

open ↗

GitHub PoC★ 11

Apache Solr instances that may be affected by CVE-2026-44825, related to Velocity Template Remote Code Execution (RCE) conditions.

CVE-2026-44825HIGH08 Jul 2026

Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users

41RISK

open ↗

GitHub PoC★ 2

CVE-2026-48908 — PoC exploit for unauthenticated RCE in SP Page Builder (Joomla) via arbitrary file upload. Multi‑threaded, case‑bypass, shell verification. For authorized security testing only.

CVE-2026-48908CRITICAL07 Jul 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

48RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.