Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,794cataloged exploits

36,057CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,459Referência 22,721GitHub PoC 14,946VulnCheck XDB 8,829Nuclei 4,350Metasploit 3,489✓ verified onlyrecent popular risk

14,946 exploits

GitHub PoC★ 1

Technical analysis and proof of concept for CVE-2026-59827, a critical unsafe Java deserialization vulnerability in Metabase leading to remote code execution.

CVE-2026-59827CRITICAL12 Aug 2026

Metabase: Unsafe Deserialization of H2 Query Results

48RISK

GitHub PoC

Security advisories for CVE-2021-43716/43717/43718 (Epson EH-TW5350)

CVE-2021-43716CRITICAL12 Aug 2026

Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector

48RISK

GitHub PoC★ 2

Passive security checker for CVE-2026-48908 affecting SP Page Builder.

CVE-2026-48908CRITICAL12 Aug 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

68RISK

GitHub PoC★ 4

vivo/iQOO 临时 root 工具箱 (免解锁临时root, CVE-2026-43499) - 源码与脚本

CVE-2026-43499HIGH12 Aug 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

GitHub PoC

Leeyoonjoo/CVE-2026-42533

CVE-2026-42533CRITICAL12 Aug 2026

NGINX Map directive and Regex matching vulnerability

48RISK

GitHub PoC★ 12

CVE-2026-0075 — Android ContactsProvider information disclosure via JSON error side-channel, including PoC, root-cause analysis, and patch details.

CVE-2026-0075HIGH12 Aug 2026

In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead t

41RISK

GitHub PoC★ 10

CVE-2026-68398 Ubuntu PPPoL2TP use-after-free local privilege escalation

CVE-2026-68398HIGH12 Aug 2026

ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

41RISK

GitHub PoC★ 3

SM-F9360 (Galaxy Z Fold4, q4q) locked-bootloader KernelSU root — CVE-2026-43499 temp root → LD_PRELOAD DEFEX bypass → no-LTO clang-12 kernelsu.ko. Device-verified 2026-08-12.

CVE-2026-43499HIGH12 Aug 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

GitHub PoC

Technical analysis of CVE-2025-55182 (React2Shell), covering vulnerability mechanics, root cause, controlled PoC testing, impact, and mitigation strategies.

CVE-2025-55182CRITICALunder attackransomware12 Aug 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

GitHub PoC

DavidCarliez/cve-2026-62737-lab

CVE-2026-62737HIGH11 Aug 2026

Windows Kernel Elevation of Privilege Vulnerability

41RISK

GitHub PoC

PoC exploit for CVE-2022-35914 — GLPI v.10.0.2 htmLawed command injection, command execution, and reverse shell support.

CVE-2022-35914CRITICALunder attack11 Aug 2026

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

100RISK

GitHub PoC★ 2

CVE-2026-43499 (GhostLock) rtmutex remove_waiter() UAF local-root PoC adapted for Qualcomm Android 4.19 kernels (Redmi K40 / Snapdragon 870 class), LD_PRELOAD based

CVE-2026-43499HIGH11 Aug 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

GitHub PoC★ 2

Persistent XSS in Typemill CMS: the Markdown parser lets javascript: URIs through unfiltered. Writeup + PoC.

CVE-2026-44401MEDIUM11 Aug 2026

Typemill CMS 2.x Persistent XSS via Markdown javascript URI

33RISK

GitHub PoC

Defensive security research, SIEM rules, and remediation tools for CVE-2026-18577 & StormEncryptor ransomware.

CVE-2026-18577HIGHunder attack11 Aug 2026

Incomplete patch leads to administrative account takeover

98RISK

GitHub PoC

Hunt-Benito/two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907HIGH11 Aug 2026

PathTravelsal Vulnerability in com.talpa.hibrowser

41RISK

GitHub PoC

CVE-2026-48710漏洞验证代码

CVE-2026-48710MEDIUM11 Aug 2026

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

48RISK

GitHub PoC★ 33

CVE-2026-68138 Linux qdisc rate-table race local privilege escalation PoC

CVE-2026-68138HIGH11 Aug 2026

net/sched: serialize qdisc_rtab_list against concurrent get/put

41RISK

GitHub PoC★ 1

YellowKey BitLocker CVE-2026-45585 - free BitLocker recovery key extractor and vulnerability tool. Bitlocker yellowkey, yellowkey bitlocker, yellowkey github, cve-2026-45585, yellowkey vulnerability, yellowkey exploit, chaotic eclipse. Free 2026.

CVE-2026-45585MEDIUM11 Aug 2026

Windows BitLocker Security Feature Bypass Vulnerability

33RISK

GitHub PoC★ 1

CopyEscape (CVE-2026-17106) docker cp container-to-host arbitrary file write PoC mirror — Imperva Ron Masas, MIT; for authorized security testing

CVE-2026-17106HIGH11 Aug 2026

Tar extraction in moby/go-archive can write outside the destination directory via link following

41RISK

GitHub PoC★ 1

CVE-2026-43499 GhostLock futex UAF LPE PoC for OPPO PCKM00 (SM6150) / Linux 4.14.180

CVE-2026-43499HIGH11 Aug 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

GitHub PoC

CVE-2026-9198利用代码

CVE-2026-9198CRITICALunder attack11 Aug 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

100RISK

GitHub PoC

keithbennedict/CVE-2026-41940-Linux

CVE-2026-41940CRITICALunder attackransomware11 Aug 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RISK

GitHub PoC

CVE-2025-64459 vulnerable by design app

CVE-2025-64459CRITICAL11 Aug 2026

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

53RISK

GitHub PoC

AegisAgent - Runtime security gateway & privilege governance for AI agents. Cryptographic tool-call provenance (CoreBreak/CVE-2026-18830/18236/64650 defense), policy engine, sandbox isolation, HITL approval, MCP security proxy, tamper-evident audit.

CVE-2026-18830HIGH11 Aug 2026

Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

41RISK

GitHub PoC

DaemonSet для митигации уязвимости CVE-2026-64564 (SCTPhantom)

CVE-2026-64564CRITICAL11 Aug 2026

sctp: don't free the ASCONF's own transport in DEL-IP processing

48RISK

GitHub PoC

CVE-2026-43499 GhostLock APK 骨架 — 从零开始，仅空项目编译验证

CVE-2026-43499HIGH10 Aug 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISK

GitHub PoC

Authorized Kali–Metasploitable2 lab using Python and Nmap NSE to validate CVE-2011-2523 in vsFTPd 2.3.4.

CVE-2011-2523—10 Aug 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISK

GitHub PoC★ 20

ThrottleStop.sys Arbitrary Physical Memory R/W

CVE-2025-7771HIGH10 Aug 2026

Code Execution / Escalation of Privileges in ThrottleStop

41RISK

GitHub PoC★ 2

CVE-2026-23744 is an unauthenticated command injection in MCPJam Inspector ≤1.4.2 via /api/mcp/connect. This POC exploits it by sending a crafted JSON payload to execute arbitrary commands, granting a reverse shell with PTY.

CVE-2026-23744CRITICAL10 Aug 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RISK

GitHub PoC★ 1

Tracking SCTPhantom (CVE-2026-64564), the Linux kernel SCTP ASCONF transport use-after-free

CVE-2026-64564CRITICAL10 Aug 2026

sctp: don't free the ASCONF's own transport in DEL-IP processing

48RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.