Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,464 exploits
GitHub PoC
High-level notes for CVE-2026-109618 in PHP mod_php. Exploit code is not included.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Read-only scanner for Node2Shell / CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
sam00/Node2Shell-CVE-2026-111497-POC
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Säkerhetsvägledning för GIS-miljöer om Broccoli2Shell (CVE-2026-111497).
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Lingkungan laboratorium berbasis Docker Compose serta isolasi toolchain mise + uv untuk materi kuliah dan pembuatan video pembelajaran Keamanan Komputer mengenai CVE-2026-109618 dan CVE-2026-109619 (PHP2Shell).
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
remote-with-credentials
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISK
open ↗GitHub PoC
Certbn/Brotli-Node.js-CVE-2026-111497-Broccoli2Shell-Node2Shell-HTTP2Shell-
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Non-destructive, probabilistic finder for hosts exposed to php2shell (CVE-2026-109618/109619). Blue-team triage; sends no exploit traffic. Authorised use only.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Device-bound CVE-2026-98260 adaptation for RedMi K80pro miro OS 3.0.305.0
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC★ 1
Detection-only local triage scanner for CVE-2026-58115 (CVSS 10.0) in Siemens SIMATIC IoT2050 Node-RED: grades Industrial OS versions against V4.3.4.1 and settings.js for adminAuth. No payloads, no remote probing.
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running In
48RISK
open ↗GitHub PoC
Temporary eBPF/XDP mitigation for CVE-2026-98432 Linux TCP IPv4 header-options vulnerability. Helps protect unpatched systems and custom kernels until an official kernel fix can be deployed.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗VulnCheck XDB
local
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗GitHub PoC
Vulnerability/mitigation tester for Linux-kernel CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
Temporary nftables mitigation for CVE-2026-98432 (Linux IPv4 TCP IP-options use-after-free)
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
Temporary: check a Linux host for CVE-2026-80587 (MPTCP)
mptcp: avoid combining some incoming suboptions
48RISK
open ↗GitHub PoC
One recipe, any unpatched build → RCE in ~30 minutes | CVE-2026-109618 research lab: 4-stage chain gdb-verified, 3 RCE builds (8.3.35/8.4.26/8.5.11), adaptation pipeline + profile DB
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Ansible role to audit Linux hosts for CVE-2026-98432 (critical IPv4 TCP use-after-free). Checks running kernel against known fixed versions, MPTCP status, and active MPTCP listeners across RHEL, Fedora, Debian, and Ubuntu. Produces clear per-host risk reports (high/medium/fixed). Read-only by default; ideal for fleet-wide inventory before patching.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC★ 2
watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
48RISK
open ↗GitHub PoC★ 1
schnied/cve-2026-98432-mitigation-iptables
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
CVE-2026-97229 lab — Onigmo repeat integer overflow RCE (GitLab CE 19.2–19.4)
Integer Overflow or Wraparound in GitLab
100RISK
open ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC★ 1
锁定设备上的内核 CVE 适用性判定：一个有意保持未定论的适用性结论，以及得到该结论的方法。A vulnerability-applicability study on a locked-down HarmonyOS device: a deliberately unresolved verdict, and the methodology to reach it.
exec: Cleanup POSIX timers right after de_thread()
41RISK
open ↗GitHub PoC
Interim mitigation for CVE-2026-98432 (Linux IPv4 TCP handshake use-after-free) on Ubuntu, until a fixed kernel ships
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
0xCyp1337/CVE-2026-116512
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
48RISK
open ↗GitHub PoC
Pardus 21.5 (amd64) için CVE-2026-98432 düzeltmesini Linux 5.10.262 tabanına taşıyan gayriresmî topluluk yaması. Proje, yamalı kaynak kodu, test edilen .deb paketini ve derleme, kurulum ve geri dönüş adımlarını içerir.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISK
open ↗GitHub PoC
Crash-only reproducer for CVE-2026-112689 in Apple's H.264 hardware decoder
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS
41RISK
open ↗VulnCheck XDB
initial-access
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISK
open ↗VulnCheck XDB
initial-access
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.