Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC
Read-only audit for CVE-2026-109518: APT HTTP backend hard-link reuse lets an on-path attacker swap a verified package (Debian/Ubuntu)
APT RCE via hard link reuse
41RISK
open ↗GitHub PoC
t0ge-kun/CVE-2026-98432-check
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗VulnCheck XDB
initial-access
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running In
48RISK
open ↗VulnCheck XDB
info-leak
LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion
63RISK
open ↗GitHub PoC
GIMP 3.2.2 contains a stack-based buffer overflow in its APNG loader (load_apng_image) when processing the tRNS (transparency) chunk. This writeup demonstrates a proof of concept for remote code execution leveraging this vulnerability.
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
41RISK
open ↗GitHub PoC
Script that applies the Ubuntu-published nftables mitigation for CVE-2026-98432 (Linux kernel IPv4 TCP use-after-free).
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗VulnCheck XDB
initial-access
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
71RISK
open ↗GitHub PoC
Read-only scanner for Node2Shell / CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
sam00/Node2Shell-CVE-2026-111497-POC
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗VulnCheck XDB
remote-with-credentials
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISK
open ↗GitHub PoC
Unauthenticated RCE exploit for PHP-FPM 8.4.26 via php2shell (CVE-2026-109618 / CVE-2026-109619) - phpMyAdmin 5.2.3, pure-HTTP PoC, defeats ASLR in-band.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
This nftables configuration ruleset can help mitigate attacks on your hosts that are vulnerable to CVE-2026-98432. The rule can help block incoming IPv4 TCP connections that contain IP options. Regular TCP connections without IP options can still go through. This is a temporary solution until the Linux Kernels are fully patched.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
Research writeup: php2shell (CVE-2026-109618/109619) vs the Cloudflare PHP CTF — complete local chain, WAF lock analysis, original findings
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) 분석과 패치 기준 확인 예제
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Säkerhetsvägledning för GIS-miljöer om Broccoli2Shell (CVE-2026-111497).
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
High-level notes for CVE-2026-109618 in PHP mod_php. Exploit code is not included.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
CVE-2026-58115: Siemens SIMATIC IoT2050 Node-RED unauthenticated root RCE. PoC, scanner, PCAP, detection rules.
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running In
48RISK
open ↗GitHub PoC
saretawa/CVE-2026-86583
Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields
41RISK
open ↗GitHub PoC★ 1
CVE-2026-118306: Chromium FileSystemAccessManagerImpl Use-After-Free (CVSS 9.6) - PoC, checker, detection rules
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code
48RISK
open ↗GitHub PoC★ 12
Haor/CVE-2026-98260-OPD2513
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 1
CVE-2026-98260 adb runner with Termux one-tap root
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 7
CVE-2026-86596 - s2Member <= 260927 Weaponized RCE
s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
48RISK
open ↗GitHub PoC★ 6
Worthes/CVE-2026-119977-WordPress-Upgrade-RCE-Bypasses-7.1.4
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
71RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.