Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,809cataloged exploits
40,763CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,234VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,809 exploits
VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC
CVE-2026-109619: cross-request UAF in PHP session.upload_progress — reproduction, root-cause analysis and full chain to RCE
RCE via stale global state
100RISK
open ↗GitHub PoC
Detection and inventory tool for PHP core CVE-2026-109618 and CVE-2026-109619: finds PHP installs, checks versions and mitigating settings, never triggers the bugs. Python 3 standard library only.
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
open ↗GitHub PoC
Notbetrieb für PHP, das sich nicht patchen lässt. Kein Fix für CVE-2026-109618 und CVE-2026-109619.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
php:7.4-fpm drop-in rebuilt with the CVE-2026-109618/109619 fix (PHP2Shell)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 3
Pre-auth remote code execution & reverse shell PoC for CVE-2026-109618 / CVE-2026-109619 - PHP core session upload-progress. One URL in, a reverse shell out.
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
client-side
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
93RISK
open ↗GitHub PoC★ 111
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP Serializable var_hash UAF -> RCE (CVE-2026-109618/619): independent reproduction, 7.4-8.5 weaponization matrix, session-decode path, offset probe, ASAN evidence, and the fake-writeup falsification
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Reproducer for CVE-2026-85316 — Apache Camel camel-platform-http unintended proxy mode from a path prefix (CWE-1220). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching
33RISK
open ↗GitHub PoC
PHP Portal Audit: URL-only risk signals for CVE-2026-109618 / CVE-2026-109619, runtime assessment and optional multipart reachability evidence. No exploitation.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
dave-ojumoola/CYB-401-CVE-2021-44228-Log4Shell
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
Passive check for Claude whether a website or server runs a PHP version affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Non-destructive detection toolkit + version-differential oracle for PHP2Shell (CVE-2026-109618/109619). Leak oracle verified 4/4 on PHP 8.5.11 vs 0/4 on 8.5.12. Docker lab included.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Security patch backports for EOL PHP (7.3/7.4): CVE-2026-109618/109619 full backport, Tier1/Tier2 CVEs. Unofficial, community effort.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Cybersecurity research and vulnerability analysis
Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.