Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,035cataloged exploits

39,531CVEs with public exploitation

24,695lab-tested

All Referência 25,557Exploit-DB 24,485GitHub PoC 16,313VulnCheck XDB 9,678Nuclei 4,478Metasploit 3,524✓ verified onlyrecent popular risk

16,313 exploits

GitHub PoC

kpatch livepatch build and load test for CVE-2026-99999 on Rocky Linux 8.10 (4.18.0-553.144.1.el8_10)

CVE-2026-99999CRITICAL19 Oct 2026

ipv4: validate checksum_start before completing checksum

48RISK

open ↗

GitHub PoC

Lewis1766/CVE-2023-54391-POC

CVE-2023-54391CRITICAL19 Oct 2026

Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter

63RISK

open ↗

GitHub PoC

shizuku198411/CVE-2026-99999-KVM-checksum-metadata-non-destructive-PoC

CVE-2026-99999CRITICAL19 Oct 2026

ipv4: validate checksum_start before completing checksum

48RISK

open ↗

GitHub PoC★ 3

CVE-2026-99999 (PwnEscape) reproduction: IPv4 csum_start validation bug — IHL rewrite and 32-byte kernel heap disclosure

CVE-2026-99999CRITICAL19 Oct 2026

ipv4: validate checksum_start before completing checksum

48RISK

open ↗

GitHub PoC

Toluwanimi7/CYB401-CVE-2026-58249-Analysis

CVE-2026-58249HIGH19 Oct 2026

Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)

41RISK

open ↗

GitHub PoC

alvaroguzmancode/CVE-2026-99999

CVE-2026-99999CRITICAL19 Oct 2026

ipv4: validate checksum_start before completing checksum

48RISK

open ↗

GitHub PoC

CVE-2026-105105 - NASA-AMMOS AIT-Core unauthenticated ZeroMQ command/telemetry bus (CWE-306, CVSS 9.8). Responsible scanner + loopback-only lab PoC.

CVE-2026-105105CRITICAL19 Oct 2026

Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration

48RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-85257 — Apache Camel camel-cxf SOAP fault information disclosure (CWE-209); Spring Boot + Quarkus, affected vs fixed

CVE-2026-85257MEDIUM19 Oct 2026

Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions

30RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-85249 — Apache Camel camel-tika metadata header injection (CWE-20); Spring Boot + Quarkus, affected vs fixed

CVE-2026-85249MEDIUM19 Oct 2026

Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata

30RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-85248 — Apache Camel camel-pqc concurrent Signature race / verification bypass (CWE-362); Spring Boot + Quarkus, affected vs fixed

CVE-2026-85248MEDIUM19 Oct 2026

Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance

30RISK

open ↗

GitHub PoC

striga-ai/CVE-2026-103663

CVE-2026-103663MEDIUM19 Oct 2026

Path Traversal leading to Remote Code Execution in Ollama

33RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-85251 — Apache Camel camel-http credential disclosure on redirect (CWE-200); Spring Boot, affected vs fixed

CVE-2026-85251HIGH19 Oct 2026

Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets

38RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-85250 — Apache Camel camel-xpath XML external entity processing via documentType=InputSource (CWE-611); Spring Boot + Quarkus, affected vs fixed

CVE-2026-85250HIGH19 Oct 2026

Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option

38RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-85254 — Apache Camel camel-platform-http request-header echo suppression bypass (CWE-178); Spring Boot + Quarkus, affected vs fixed

CVE-2026-85254MEDIUM19 Oct 2026

Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing

30RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-84178 (Apache Camel camel-oauth): the authorization-code callback redeems the code without verifying a state parameter (login CSRF) — Camel Spring Boot + Camel Quarkus

CVE-2026-84178MEDIUM19 Oct 2026

Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow

30RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-84176 (Apache Camel camel-platform-http-vertx): CORS handler sends Access-Control-Allow-Credentials: true outside the origin check and reflects the Origin when no origins are configured (credentialed any-origin) — Camel Spring Boot

CVE-2026-84176MEDIUM19 Oct 2026

Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection

30RISK

open ↗

GitHub PoC★ 13

CVE-2026-64560 staged security research package

CVE-2026-64560HIGH19 Oct 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-83531 (Apache Camel camel-dynamic-router): the dynamic-router-control endpoint compiles an attacker-supplied predicate expression/language from the control message (expression-language / code injection) — Camel Spring Boot

CVE-2026-83531HIGH19 Oct 2026

Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages

38RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-85246 — Apache Camel camel-mina consumer information disclosure (CWE-209); Spring Boot, affected vs fixed

CVE-2026-85246MEDIUM19 Oct 2026

Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions

30RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-80344 (Apache Camel camel-as2): asynchronous MDN SSRF + credential disclosure — the receiver delivers the MDN to the sender-chosen Receipt-Delivery-Option, presenting its credentials to an attacker-chosen host — Camel Spring Boot + Camel Quarkus

CVE-2026-80344HIGH19 Oct 2026

Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address

38RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-85243 — Apache Camel camel-crypto-pgp integrity verification downgrade (CWE-354); Spring Boot + Quarkus, affected vs fixed

CVE-2026-85243MEDIUM19 Oct 2026

Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure

30RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-85245 — Apache Camel camel-thrift cross-exchange data disclosure (CWE-488); Spring Boot, affected vs fixed

CVE-2026-85245MEDIUM19 Oct 2026

Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target

30RISK

open ↗

GitHub PoC

PoC For CVE-2026-52856

CVE-2026-52856HIGH19 Oct 2026

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

41RISK

open ↗

GitHub PoC

CVE-2026-81963 - It is rated as "Important" by Microsoft. CVE-2026-85880 - CVE-2026-69414 -

CVE-2026-81963HIGHunder attack19 Oct 2026

Windows Update Stack Elevation of Privilege Vulnerability

71RISK

open ↗

GitHub PoC

CVE-2026-16723 reproduction toolkit - fastjson 1.2.83 jar: remote class-loading payload generator (ASM-built POC.class with @JSONType + clinit exec)

CVE-2026-16723CRITICAL19 Oct 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RISK

open ↗

GitHub PoC

Corresponding source for the CVE-2026-64560 public binaries

CVE-2026-64560HIGH19 Oct 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-85247 — Apache Camel camel-knative improper certificate validation (CWE-295); Spring Boot + Quarkus, affected vs fixed

CVE-2026-85247MEDIUM19 Oct 2026

Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore

30RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-84181 — Apache Camel camel-shiro thread-bound-subject authentication bypass (CWE-287); Spring Boot + Quarkus, affected vs fixed

CVE-2026-84181MEDIUM19 Oct 2026

Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse

30RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-84180 — Apache Camel camel-knative HTTP consumer information disclosure (CWE-209); Spring Boot + Quarkus, affected vs fixed

CVE-2026-84180MEDIUM19 Oct 2026

Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions

30RISK

open ↗

GitHub PoC

Reproducer for CVE-2026-80343 (Apache Camel camel-netty-http): security constraint case-sensitivity bypass — altering the path case skips the constraint while routing still dispatches to the protected endpoint — Camel Spring Boot + Camel Quarkus

CVE-2026-80343HIGH18 Oct 2026

Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching

38RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.