Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,899cataloged exploits
40,763CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,324VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,899 exploits
GitHub PoC
For WordPress
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
63RISK
open ↗GitHub PoC★ 2
Wazuh PoC chaining CVE-2026-74034 file read and CVE-2026-74041 command execution; fixed in 4.14.8. Python standard library only.
Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
41RISK
open ↗GitHub PoC★ 8
abdugafforov-bobur/cve-2026-107181-poc
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
41RISK
open ↗GitHub PoC
Penetration test report for the DC-1 VulnHub machine: Drupalgeddon2 (CVE-2018-7600) RCE, credential discovery, and SUID privilege escalation to root. Includes CVSS-rated findings and a remediation roadmap.
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗GitHub PoC
V8 inlined Array.prototype.sort elements-kind confusion - PoC + addrof (N-day research)
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside
71RISK
open ↗GitHub PoC
sohel160/Webfig-jsproxy-unauthenticated-file-read-CVE-2026-67281-
Unauthenticated file read in Mikrotik RouterOS
41RISK
open ↗GitHub PoC
EndlssNightmare/CVE-2026-18116
Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications
41RISK
open ↗GitHub PoC★ 2
Exploit para explotar la vulnerabilidad CVE-2020-25213 en WPFileManager < 6.9
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra
100RISK
open ↗GitHub PoC★ 2
ABC00012345/CVE-2026-74580
vhost: reset the vring metadata cache on vring reconfiguration
41RISK
open ↗VulnCheck XDB
local
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗GitHub PoC
myeongji1/cve-2026-63223-ctf
CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
48RISK
open ↗Metasploit400
Cisco Secure Email Gateway AMP Arbitrary File Write RCE
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
73RISK
open ↗GitHub PoC
Defensive exposure checker and poc for cURL CVE-2026-92392
HTTP/2 upload Use-After-Free
41RISK
open ↗VulnCheck XDB
initial-access
Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
56RISK
open ↗GitHub PoC
CVE-2026-104748 POC
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
48RISK
open ↗GitHub PoC★ 1
CVE-2026-97657 – Authentication Bypass & Account Takeover | Pocbit
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
48RISK
open ↗GitHub PoC★ 26
Mr-Ochobot/CVE-2016-5195
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗GitHub PoC
ChakraCore InitProto type confusion - PoC
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
45RISK
open ↗GitHub PoC★ 1
Heartbleed (CVE-2014-0160) reproduction and analysis —CSP Application Security project
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISK
open ↗GitHub PoC
Unauthenticated remote code execution on Cisco Secure Email Gateway via crafted email attachment. Path traversal in AMP File Reputation handling allows arbitrary file write as root when the service is enabled on a mail policy.
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
73RISK
open ↗GitHub PoC
DirtyFrag (CVE-2026-43284) pro Galaxy A57 5G (SM-A576B, A576BXXS6AZI2): gatilho libbase pro One UI 8.5 + dfroot.ko compilado exato pro 6.12.38-android16-5 do aparelho
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
open ↗GitHub PoC
CVE-2026-106991 report
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sti
41RISK
open ↗GitHub PoC
CVE-2021-4034 (PwnKit) - Python PoC
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗GitHub PoC★ 1
SQL Injection via identifier injection in SLiMS 9.8.0 admin AJAX endpoints (tableName/tableFields). Any authenticated staff can dump password hashes.
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/A
48RISK
open ↗GitHub PoC
Technical writeup of CVE-2026-109506, a vulnerability I found in multiple TP-Link Wi-Fi Range Extenders
Improper Authentication in Multiple TP-Link WiFi Repeaters
33RISK
open ↗VulnCheck XDB
initial-access
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗GitHub PoC★ 8
CVE-2026-76268 PoC: Splunk Enterprise SHC Patroni REST unauth RCE — PATCH /config archive_command + POST /restart. Check + mass exploit, OOB POCBIT-76268-OK, CVSS 9.8. https://pocbit.org/pocs/cve-2026-76268
Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
63RISK
open ↗GitHub PoC★ 1
CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE
Integer Overflow or Wraparound in GitLab
100RISK
open ↗VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.