Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,899cataloged exploits

40,763CVEs with public exploitation

24,696lab-tested

All Referência 26,463Exploit-DB 24,489GitHub PoC 18,324VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecent popular risk

87,899 exploits

GitHub PoC★ 2

Python-based security assessment tool for detecting exposed Vite development servers, identifying sensitive file exposure, and validating filesystem access control weaknesses in authorized environments.

CVE-2025-30208MEDIUM18 Oct 2026

Vite bypasses server.fs.deny when using `?raw??`

70RISK

GitHub PoC

Langflow 미인증 RCE 취약점(CVE-2025-3248) 기반 경량화 웹 해킹 CTF 문제 및 PoC 실습 환경

CVE-2025-3248CRITICALunder attackransomware18 Oct 2026

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RISK

GitHub PoC

a complete exploit chain for CVE-2026-982600,

CVE-2026-98260HIGH18 Oct 2026

exec: Cleanup POSIX timers right after de_thread()

41RISK

GitHub PoC★ 1

fortbridge/cve-2026-108097-research

CVE-2026-108097HIGH18 Oct 2026

Drupal core - Critical - Remote code execution - SA-CORE-2026-014

41RISK

GitHub PoC

CVE-2026-98180 — drm/msm use-after-free of the scheduler-containing ring and VM objects (fixed by 01c8d1f385f7)

CVE-2026-98180HIGH18 Oct 2026

drm/msm: RCU-free the scheduler-containing ring and VM objects

41RISK

GitHub PoC

Fire ChatML/Mistral/Llama control-token literals at your self-hosted agent stack and prove role-forgery before an attacker does (CVE-2026-61732).

CVE-2026-61732CRITICAL18 Oct 2026

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

48RISK

GitHub PoC

Deterministic CVE patch-gap reports for MCP servers (Oct 2026 cluster: Langflow RCE CVE-2026-105697, fetch SSRF CVE-2026-104120, x64dbg CVE-2026-107824, MCP SDK OAuth theft)

CVE-2026-105697CRITICAL18 Oct 2026

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

48RISK

GitHub PoC

danielakin417/CVE-2017-11882-analysis

CVE-2017-11882HIGHunder attackransomware18 Oct 2026

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RISK

GitHub PoC

Saku0512/CVE-2026-34157-poc

CVE-2026-34157HIGH18 Oct 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

41RISK

GitHub PoC

Reproducer for CVE-2026-80343 (Apache Camel camel-netty-http): security constraint case-sensitivity bypass — altering the path case skips the constraint while routing still dispatches to the protected endpoint — Camel Spring Boot + Camel Quarkus

CVE-2026-80343HIGH18 Oct 2026

Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching

41RISK

GitHub PoC★ 16

Zeek and Suricata Detections for "php2shell" CVE-2026-109618 and CVE-2026-109619

CVE-2026-109618CRITICALunder attack18 Oct 2026

RCE via OOM corruption

100RISK

GitHub PoC

Projet de Cybersécurité (TP1 à TP9) Recherche réseau (Nmap, Scapy) • Attaques DDoS (hping3) • Force brute (Hydra, LaZagne) • Ingénierie sociale (Zphisher, Gophish) • Sécurité Wi-Fi (Airgeddon, Aircrack-ng) • Malwares (msfvenom) • Injection de code (Shellter) • MITM (Ettercap, Yersinia) • Vulnérabilités (CVE-2026-96889).

CVE-2026-96889HIGH17 Oct 2026

Librsvg: use-after-free when xml includes have duplicated entities

41RISK

GitHub PoC

rank03031/CVE-2025-49113-CTF

CVE-2025-49113CRITICALunder attack17 Oct 2026

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

100RISK

GitHub PoC

PoC for CVE-2026-111823 — Mage AI OAuth session auth bypass (POST /api/sessions). Check + exploit modes. Authorized testing only.

CVE-2026-111823CRITICAL17 Oct 2026

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

48RISK

GitHub PoC★ 1

Passive internet-wide discovery + responsible-disclosure helper for CVE-2026-74580 (Linux vhost metadata-cache bug) — queries existing scan data (Sonar/Shodan/Censys), triages exposure, and drafts (never auto-sends) notices to owners.

CVE-2026-74580HIGH17 Oct 2026

vhost: reset the vring metadata cache on vring reconfiguration

41RISK

GitHub PoC★ 2

CVE-2026-97229 GitLab CI lint regex integer overflow RCE — InstaBox version matrix reproduction & libruby gadget reverse engineering

CVE-2026-97229CRITICALunder attack17 Oct 2026

Integer Overflow or Wraparound in GitLab

100RISK

GitHub PoC

CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656

CVE-2026-96652MEDIUMunder attack17 Oct 2026

Plex Media Server SSRF

83RISK

GitHub PoC

songzzzz/CVE-2026-8933

CVE-2026-8933HIGH17 Oct 2026

snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup

41RISK

GitHub PoC

PMX110 (OPPO MT6995, kernel 6.18.21) CVE-2026-64560 research: port, evidence, bounded run scripts

CVE-2026-64560HIGH17 Oct 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISK

GitHub PoC

CSRF in SLiMS 9.8.0 loan history maintenance allowing unauthorized data loss (TRUNCATE). CVE-2026-107084.

CVE-2026-107084HIGH17 Oct 2026

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules

41RISK

GitHub PoC

SQL Injection via opac_hide / promoted GET parameters in SLiMS 9.8.0 admin bibliography module. CVE-2026-107082.

CVE-2026-107082HIGH17 Oct 2026

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection vi

41RISK

GitHub PoC★ 1

0xCyp1337/CVE-2026-48907-RCE

CVE-2026-48907CRITICALunder attack17 Oct 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISK

GitHub PoC

Vulnerability analysis, exploitation, and multi-layered defense hardening for Apache Struts 2 (CVE-2017-5638) & Windows Print Spooler / PrintNightmare (CVE-2021-34527) with ELK SIEM monitoring and Windows Event Log auditing.

CVE-2017-5638CRITICALunder attackransomware17 Oct 2026

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RISK

GitHub PoC

Probe MCP OAuth discovery issuer validation (CVE-2026-104850 class)

CVE-2026-104850HIGH17 Oct 2026

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

41RISK

GitHub PoC★ 22

PoC for CVE-2026-99999 (PwnEscape) on a prepared TAP.

CVE-2026-99999CRITICAL17 Oct 2026

ipv4: validate checksum_start before completing checksum

48RISK

GitHub PoC

WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

CVE-2026-94169CRITICAL17 Oct 2026

WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

63RISK

GitHub PoC

SQL Injection via unquoted numeric concatenation in SLiMS 9.8.0 admin modules (subscription.php & dl_detail.php). CVE-2026-107083.

CVE-2026-107083CRITICAL17 Oct 2026

SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/r

48RISK

GitHub PoC★ 6

REDMI K90 Max在OS4.0.0.14.XAACNXM利用CVE-2026-64560获取ROOT权限。

CVE-2026-64560HIGH17 Oct 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISK

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALunder attack17 Oct 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISK

VulnCheck XDB

initial-access

CVE-2024-32507HIGH17 Oct 2026

WordPress Login with phone number plugin <= 1.7.16 - Privilege Escalation vulnerability

41RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.