Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,035cataloged exploits
39,531CVEs with public exploitation
24,695lab-tested
AllReferência 25,557Exploit-DB 24,485GitHub PoC 16,313VulnCheck XDB 9,678Nuclei 4,478Metasploit 3,524✓ verified onlyrecentpopularrisk
16,313 exploits
GitHub PoC★ 2
Wazuh PoC chaining CVE-2026-74034 file read and CVE-2026-74041 command execution; fixed in 4.14.8. Python standard library only.
Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
41RISK
open ↗GitHub PoC
Test d’intrusion sur Kioptrix Level 1 : exploitation d’une faille Apache/mod_ssl (OpenFuck, CVE-2002-0082) jusqu’à l’accès root, en environnement de laboratoire isolé.
The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly
28RISK
open ↗GitHub PoC
PoCs for CVE-2026-102262 & CVE-2026-101893 — code execution and XXE in DYMO ID (reported & fixed)
Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control
41RISK
open ↗GitHub PoC
POC for the CVE-2026-104711
Apache Struts: OGNL injection in the legacy RESTful action mapper
48RISK
open ↗GitHub PoC
POC EXPLOIT CVE-2026-104711
Apache Struts: OGNL injection in the legacy RESTful action mapper
48RISK
open ↗GitHub PoC
Test d’intrusion sur Metasploitable 2 : exploitation de la backdoor vsftpd 2.3.4 (CVE-2011-2523) pour obtenir un accès root sans authentification.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗GitHub PoC★ 1
Write-up for CVE-2026-109721
Incorrect boundary conditions in the JavaScript Engine: JIT component
33RISK
open ↗GitHub PoC★ 1
POC for CVE-2026-104711 - New
Apache Struts: OGNL injection in the legacy RESTful action mapper
48RISK
open ↗GitHub PoC
anaskalt/CVE-2026-104945
Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500
33RISK
open ↗GitHub PoC
CVE-2026-110025: bilingual analysis and safe local PoC for phpwcms unrestricted upload to RCE
slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
33RISK
open ↗GitHub PoC
CVE-2026-108924: didactic PoC for Kirby dynamic option authorization bypass
getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
33RISK
open ↗GitHub PoC★ 35
CVE-85884 POC
Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC
Exploits CVE-2026-58222 to recover Samba KDS root keys and derive gMSA credentials from a low-privilege domain account.
Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes
41RISK
open ↗GitHub PoC
PoC for CVE-2026-68582 / GHSA-rj9j-8772-4h6c — Vikunja link-share BOLA
Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
48RISK
open ↗GitHub PoC
CVE-2026-72898 Metabase Security Tools
Metabase SQL injection via password reset endpoint
100RISK
open ↗GitHub PoC
Automated Ruby on Rails doubletap RCE (CVE-2019-5418 + CVE-2019-5420) in pure Python, using the ERB#def_module gadget for modern Ruby.
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe
100RISK
open ↗GitHub PoC★ 59
GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image
Integer Overflow or Wraparound in GitLab
48RISK
open ↗GitHub PoC★ 1
CVE-2026-107181 Proof Of Concept for telegram Desktop account take over in windows
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
41RISK
open ↗GitHub PoC
CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE
Integer Overflow or Wraparound in GitLab
48RISK
open ↗GitHub PoC★ 9
CVE-2026-76268 PoC: Splunk Enterprise SHC Patroni REST unauth RCE — PATCH /config archive_command + POST /restart. Check + mass exploit, OOB POCBIT-76268-OK, CVSS 9.8. https://pocbit.org/pocs/cve-2026-76268
Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
48RISK
open ↗GitHub PoC
SSRF in Hyperledger FireFly Webhook Subscriptions (CVE-2026-82957)
hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery
33RISK
open ↗GitHub PoC★ 2
Command execution and patch bypass of CVE-2026-28291 in git-js.
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
41RISK
open ↗GitHub PoC
anaskalt/CVE-2026-104944
Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500
41RISK
open ↗GitHub PoC
Bilingual PoC and technical analysis for CVE-2026-105950 — Formwork formaction URI sanitizer bypass
getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
33RISK
open ↗GitHub PoC★ 1
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length.
hey,
`_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length agains
41RISK
open ↗GitHub PoC★ 1
POC CVE-2026-85097
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
48RISK
open ↗GitHub PoC
POC for CVE-2026-104711-Advanced-Variant
Apache Struts: OGNL injection in the legacy RESTful action mapper
48RISK
open ↗GitHub PoC★ 1
MiniUPnPd <= 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header
MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header
41RISK
open ↗GitHub PoC★ 1
Unauthenticated remote code execution in Ivanti Connect Secure (CWE-290, CVSS 8.6)
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb
91RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.