Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,899cataloged exploits
40,763CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,324VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,899 exploits
VulnCheck XDB
initial-access
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗VulnCheck XDB
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗VulnCheck XDB
initial-access
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
60RISK
open ↗VulnCheck XDB
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISK
open ↗VulnCheck XDB
initial-access
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗GitHub PoC★ 1
Unauthenticated remote code execution in Ivanti Connect Secure (CWE-290, CVSS 8.6)
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb
100RISK
open ↗GitHub PoC★ 8
CVE-2026-76268 PoC: Splunk Enterprise SHC Patroni REST unauth RCE — PATCH /config archive_command + POST /restart. Check + mass exploit, OOB POCBIT-76268-OK, CVSS 9.8. https://pocbit.org/pocs/cve-2026-76268
Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
63RISK
open ↗GitHub PoC★ 1
CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE
Integer Overflow or Wraparound in GitLab
100RISK
open ↗GitHub PoC
Análisis de vulnerabilidades y el desarrollo de exploits
FreeFloat FTP Server NOOP Command buffer overflow
38RISK
open ↗GitHub PoC★ 5
CVE-2026-85097 – Bricksforge WordPress Plugin Unauth File Upload to RCE Toolkit (CVSS 10.0) | Red/Blue Team suite for Bricksforge Pro Forms < 3.1.8.9. 2 tools: Full Exploit (polyglot upload, web shell, mass scan, OPSEC, SQLite/JSON output) + SafeChecker (version detect, non-intrusive audit). Ethical & educational use only.
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
63RISK
open ↗Metasploit400
GitLab CI/CD RegExp Integer Overflow Remote Code Execution
Integer Overflow or Wraparound in GitLab
100RISK
open ↗VulnCheck XDB
initial-access
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RISK
open ↗VulnCheck XDB
local
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon A
71RISK
open ↗GitHub PoC
Independent reconstruction, lab validation, and PoC for CVE-2026-9198, the Langflow unauthenticated RCE (fixed in 1.10.1)
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RISK
open ↗GitHub PoC
CVE-2026-91136 Divi Plus <= 2.4.0 unauthenticated arbitrary file read (mass scanner + exploit)
Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
56RISK
open ↗GitHub PoC★ 1
Proof of concept and isolated Docker lab for CVE-2026-103889, an unauthenticated RCE vulnerability in Expivi 3D Product Configurator for WooCommerce ≤ 2.16.2.
3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
48RISK
open ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern
48RISK
open ↗GitHub PoC★ 1
CVE-2026-84411 root cause notes and a non-destructive probe (RouterOS before 7.24)
MikroTik RouterOS Integer Underflow
48RISK
open ↗GitHub PoC
CVE-2026-102255 - Draft or TODO
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern
48RISK
open ↗GitHub PoC
AraxyAI/CVE-2026-92956__vm2__test__20261012
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
48RISK
open ↗GitHub PoC★ 8
CVE-2026-91737 Chrome renderer RCE PoC (PDFium)
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside
41RISK
open ↗GitHub PoC★ 3
0xad3m/CVE-2026-13078-POC
Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.