Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,899cataloged exploits
40,763CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,324VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,899 exploits
GitHub PoC
Incident-response tabletop exercise artifacts for the Log4Shell (CVE-2021-44228) drill
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
Notbetrieb für PHP, das sich nicht patchen lässt. Kein Fix für CVE-2026-109618 und CVE-2026-109619.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
WAF rules, PHP hardening & detection for CVE-2026-109618/109619 (PHP2Shell). Lab-tested bridge until you patch - review before production use.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
CVE-2026-86478 - JetBrains YouTrack Helpdesk unauthenticated account takeover via self-asserted email (CVSS 9.8)
In JetBrains YouTrack before 2025.3.161254,
2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthent
48RISK
open ↗GitHub PoC★ 6
Non-operational analysis and defensive guidance for CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Plex2Shell (CVE-2026-96652/54/55/56) IOC/IOA dossier and read-only Windows hunt script
Plex Media Server SSRF
83RISK
open ↗Exploit-DB
Keycloak 26.7.2 - Unauthenticated Account Takeover
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISK
open ↗GitHub PoC★ 132
php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for vanilla php.net and Remi Collet trees. Restores safe file uploads & progress bars without RCE. Fleet-tested on OpenCart, WordPress, HestiaCP, aaPanel.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 2
Pre-auth RCE lab for CVE-2026-109618/CVE-2026-109619 - PHP session.upload_progress heap chain
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Serverbrede noodblokkade voor PHP2Shell (CVE-2026-109618 / CVE-2026-109619) voor DirectAdmin, Plesk, cPanel en kale Apache/nginx/LiteSpeed-servers
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP の重大な脆弱性(CVE-2026-109618 / CVE-2026-109619)の確認の手順。読むだけで何も変更しない
RCE via OOM corruption
100RISK
open ↗GitHub PoC
BIBILZERODAY/CVE-2026-110372-MASS-EXPLOIT-WEBSHELL.STORE
WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability
43RISK
open ↗GitHub PoC★ 10
CVE-2026-109618 / CVE-2026-109619 Pre-auth RCE through PHP (session.upload_progress)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Non-destructive affected-version checker for CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) PHP OOM/longjmp UAF
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP2Shell Evaluación de CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Cybersecurity assignment on CVE-2026-97859, severity analysis, patching, and the Cyber Kill Chain.
Gitea API disclosure of private user social graph, keys and stars
33RISK
open ↗GitHub PoC
Audit and interim mitigation scripts for PHP2Shell (CVE-2026-109618/109619) on Forge-managed Ubuntu servers
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
local
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗GitHub PoC★ 2
Local Docker trigger reproductions for PHP CVE-2026-109618 and CVE-2026-109619 advisories
RCE via OOM corruption
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.