Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,899cataloged exploits
40,763CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,324VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,899 exploits
GitHub PoC★ 2
Local Docker trigger reproductions for PHP CVE-2026-109618 and CVE-2026-109619 advisories
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Python HTTP/HTTPS response inspection tool for authorized web security research related to PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Cybersecurity research and vulnerability analysis
Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
33RISK
open ↗GitHub PoC
Incident-response tabletop exercise artifacts for the Log4Shell (CVE-2021-44228) drill
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
open ↗GitHub PoC
Emergency mitigation guide and snippets for PHP CVE-2026-109618 / CVE-2026-109619 (php2shell)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Reproducer for CVE-2026-85315 — Apache Camel camel-grpc consumer exception disclosure (CWE-209). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions
33RISK
open ↗GitHub PoC
CVE-2026-109619: cross-request UAF in PHP session.upload_progress — reproduction, root-cause analysis and full chain to RCE
RCE via stale global state
100RISK
open ↗GitHub PoC
Reproducer for CVE-2026-85317 — Apache Camel camel-http OAuth2 token cache confusion (CWE-524). Camel Spring Boot.
Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache
33RISK
open ↗GitHub PoC
CVE-2026-97629 — nginx TLS session-ticket forgery that can bypass client-certificate (mTLS) authentication. Root cause, one-line patch, proof-of-concept exploit and reproduction evidence. Found and disclosed by PhiNode Labs; credited by F5. Fixed in nginx 1.31.7 / 1.30.6.
NGINX ngx_http_ssl_module vulnerability
41RISK
open ↗GitHub PoC★ 3
Safely verify the October 2026 PHP OOM security fixes by testing patched runtime behaviour
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 17
Unofficial PHP 7.4.33 RPMs for CentOS 7/EL7 with the PHP2Shell (CVE-2026-109618/109619) mitigation
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Live monitor for PHP2Shell exploitation (CVE-2026-109618/109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Ansible Playbook that runs through your PHP-FPM and OpenLiteSpeed PHP files and applies a mitigation against CVE-2026-109619.
RCE via stale global state
100RISK
open ↗GitHub PoC★ 2
Срочное обновление PHP 8.2.34 → 8.2.35 на BitrixVM 9 сборкой из исходников (CVE-2026-109618, CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Reproducer for CVE-2026-91858 — Apache Camel camel-fop XML External Entity (XXE) via a third-party TransformerFactory (CWE-611). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present
33RISK
open ↗GitHub PoC
Reproducer for CVE-2026-88900 — Apache Camel camel-jgroups unsafe Java deserialization of cluster messages (CWE-502, HIGH). Camel Spring Boot.
Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution
41RISK
open ↗GitHub PoC★ 7
Remediation scripts for PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, targeting HestiaCP and Plesk environments. Automates PHP configuration hardening and service reloads to help reduce exposure across supported PHP versions and hosting configurations.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Did php2shell (CVE-2026-109618/109619) already own your servers? One read-only script to find out.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 2
php:7.4-fpm rebuilt from source with the official PHP2Shell backport (CVE-2026-109618 / CVE-2026-109619): the three things that break a 7.4 build in 2026, fixed
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
The supplied report identifies `CVE-2026-109618` and `CVE-2026-109619` and targets PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. At the time this helper was prepared, those claims could not be confirmed from an official PHP advisory; do not treat a script message as proof of mitigation.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Temporary patched PHP base images (CVE-2026-109618/109619) until official images ship
RCE via OOM corruption
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.