Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,337cataloged exploits
39,873CVEs with public exploitation
24,696lab-tested
AllReferência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecentpopularrisk
17,115 exploits
GitHub PoC
SAP-system-update/CVE-2026-58231
Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)
48RISK
open ↗GitHub PoC
CVE-2026-9335: KerasFileEditor and load_weights follow h5py ExternalLinks, disclosing arbitrary local HDF5 file contents in keras ≤ 3.14.0. Advisory + verified PoCs.
Improper Handling of HDF5 ExternalLinks in keras-team/keras
33RISK
open ↗GitHub PoC
Proof of concept exploit code for CVE-2026-5027
Langflow - Path Traversal Arbitrary File Write via upload_user_file
56RISK
open ↗GitHub PoC★ 1
Using TCP Fast Open to bypass syscall-based networking rules (CVE-2026-63828/CVE-2026-72243 PoC)
apparmor: mediate the implicit connect of TCP fast open sendmsg
41RISK
open ↗GitHub PoC
CVE-2026-82329 - Draft or TODO
Potential authentication bypass leading to administrative access in Artifactory
98RISK
open ↗GitHub PoC★ 1
Poc of CVE-2026-13753
Certain HP DeskJet All in One – Potential Information Disclosure
41RISK
open ↗GitHub PoC★ 12
CVE-2026-82329 JFrog Artifactory unauthenticated auth-bypass: reproducible Docker lab + URL-parameter validator PoC + patch-diff analysis
Potential authentication bypass leading to administrative access in Artifactory
98RISK
open ↗GitHub PoC
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory.
ArcadeDB before 26.8.1 Path Traversal via create/drop database
41RISK
open ↗GitHub PoC
PoC for Unauthenticated Reflected Cross-Site Scripting (XSS) in RegistrationMagic WordPress Plugin
WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability
41RISK
open ↗GitHub PoC
PostgreSQL の全文検索(tsvector/tsquery)に見つかった範囲外書き込み脆弱性 CVE-2026-14662 を、修正前(18.4)と修正後(18.6)を Docker で並べて動かして検証した記録と発表資料
PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound
41RISK
open ↗GitHub PoC★ 18
Keycloak reset-credentials flow bypass
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISK
open ↗GitHub PoC★ 1
Ghxstsec/CVE-2026-39987
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
open ↗GitHub PoC
CVE-2026-24061 GNU Inetutils Telnetd Authentication Bypass
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISK
open ↗GitHub PoC
CVE-2025-62593 — Ray Unauthenticated RCE Exploit is an unauthenticated remote code execution vulnerability in the Ray distributed AI compute engine.
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
98RISK
open ↗GitHub PoC★ 2
D-Link DIR-825M formDiskFormat stack overflow + command injection RCE PoC (CVE-2026-82592); for authorized security testing
D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub_46725C stack-based overflow
48RISK
open ↗GitHub PoC
CVE-2021-44228 (Log4Shell) 漏洞复现靶场 | SpringBoot + Log4j2 2.14.1 | 3 个攻击向量 PoC 验证
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
Reflected XSS via search GET Parameter in Phoca Download
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4
33RISK
open ↗GitHub PoC★ 1
Metasploit modules, Python PoCs and throwaway Docker labs for four platform CVEs: Keycloak (CVE-2026-18963), Apache NiFi (CVE-2026-39816), HashiCorp Vault (CVE-2026-5006), HashiCorp Nomad (CVE-2026-7474).
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISK
open ↗GitHub PoC
GiveWP <= 4.16.7.1 Unauthenticated PHP Object Injection → RCE
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RISK
open ↗GitHub PoC
boomerangBS/CVE-2026-65647-PoC
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as r
41RISK
open ↗GitHub PoC
Weak-RNG stream-sweep research (CVE-2026-71851 class): PRNG schemes x seeds -> BIP39 -> victim set membership
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
48RISK
open ↗GitHub PoC★ 1
Public PoC for CVE-2026-82222
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RISK
open ↗GitHub PoC
CVE-2026-76581
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
48RISK
open ↗GitHub PoC
Safe passive detector for identifying WPMU DEV Dashboard versions affected by CVE-2026-76581.
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
48RISK
open ↗GitHub PoC★ 1
PoC CVE-2026-18741
Worksuite SaaS version prior to 6.0.14 Stored XSS via Asset Management Location and Description Fields
33RISK
open ↗GitHub PoC
CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing.
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISK
open ↗GitHub PoC
Automated PoC for CVE-2026-48611 — phpBB OAuth login_link authentication bypass
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or
63RISK
open ↗GitHub PoC
CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing.
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
71RISK
open ↗GitHub PoC
Read-only CLI to check whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 / CVE-2026-60137)
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
open ↗GitHub PoC★ 4
CBDC Infrastructure Vulnerability Research. CVE-2026-78904: Infinite mint and redemption bypass in central bank digital currency APIs.
Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitra
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.