Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,794cataloged exploits
36,057CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,459Referência 22,721GitHub PoC 14,946VulnCheck XDB 8,829Nuclei 4,350Metasploit 3,489✓ verified onlyrecentpopularrisk
14,946 exploits
GitHub PoC★ 20
ThrottleStop.sys Arbitrary Physical Memory R/W
Code Execution / Escalation of Privileges in ThrottleStop
41RISK
open ↗GitHub PoC
CVE-2026-19264 - Critical unauthenticated path traversal to full instance takeover in Postiz (< 2.22.1). Technical writeup: decode-order bypass, JWT_SECRET escalation, and analysis of the upstream fix.
Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
48RISK
open ↗GitHub PoC★ 2
CVE-2026-23744 is an unauthenticated command injection in MCPJam Inspector ≤1.4.2 via /api/mcp/connect. This POC exploits it by sending a crafted JSON payload to execute arbitrary commands, granting a reverse shell with PTY.
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISK
open ↗GitHub PoC★ 1
IamDremig/CVE-2026-15598
antv layout object.js setNestedValue prototype pollution
33RISK
open ↗GitHub PoC★ 1
CVE-2026-43499 (GhostLock) research on HUAWEI MatePad Pro 11 GOT-W29
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC★ 2
独立 APK：CVE-2026-43499 GhostLock 提权 + Shizuku shell 身份执行
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC★ 4
GhostLock-X200 v1.0 - temporary root toolchain for vivo X200 (PD2415 / b57 kernel) based on CVE-2026-43499. For authorized security research only.
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC★ 2
A rewritten Proof-of-Concept / Local Privilege Escalation (LPE) exploit targeting CVE-2019-2215, a Use-After-Free vulnerability in the Android Binder driver.
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RISK
open ↗GitHub PoC
CVE-2026-43499 GhostLock APK 骨架 — 仅验证空项目能编译通过
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC
CVE-2026-43499 GhostLock APK 骨架 — 从零开始，仅空项目编译验证
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC
CVE-2026-20685 - Draft or TODO
An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addres
33RISK
open ↗GitHub PoC
Authorized Kali–Metasploitable2 lab using Python and Nmap NSE to validate CVE-2011-2523 in vsFTPd 2.3.4.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗GitHub PoC★ 5
Community-maintained fork of image-size with fixes for CVE-2025-71329 and CVE-2025-71330
image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
41RISK
open ↗GitHub PoC★ 1
IamDremig/CVE-2026-14802
react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection
33RISK
open ↗GitHub PoC★ 1
CVE-2026-64747 AGXG14P count-bitmask OOB trigger probe (A15/iOS 26.5.2)
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iO
41RISK
open ↗GitHub PoC
my poc for CVE-2026-53787
Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload
63RISK
open ↗GitHub PoC★ 1
Tracking SCTPhantom (CVE-2026-64564), the Linux kernel SCTP ASCONF transport use-after-free
sctp: don't free the ASCONF's own transport in DEL-IP processing
48RISK
open ↗GitHub PoC
CVE-2026-34348 - Draft or TODO
Windows Event Logging Service Information Disclosure Vulnerability
33RISK
open ↗GitHub PoC★ 1
Saku0512/CVE-2026-9086-poc
Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass
41RISK
open ↗GitHub PoC
CVE-2026-65891 PoC — Joomla Content Editor file rename vulnerability (auth required, fixed in JCE 2.20.2)
Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.10
33RISK
open ↗GitHub PoC
spring retry 1.3.x fix with niche toolkit for CVE-2026-41710
Cache Exhaustion in Stateful Retries leads to Denial of Service
33RISK
open ↗GitHub PoC★ 1
CVE-2026-64824 — Home Assistant backup-restore symlink path traversal → root RCE. First working PoC, verified on real HA 2026.5.4 (sitecustomize.py overwrite). GHSA-cwh8-w64c-4j5h
Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore
48RISK
open ↗GitHub PoC★ 1
IamDremig/CVE-2026-65591
n8n before 1.123.64 Sanitizer Bypass Remote Code Execution
41RISK
open ↗GitHub PoC
XSS2Shell ULTIMATE v3.0 is a powerful exploitation tool that chains Cross-Site Scripting (XSS) vulnerabilities in WordPress to achieve Remote Code Execution (RCE). This tool exploits CVE-2026-64638 to gain full control over vulnerable WordPress installations.
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
68RISK
open ↗GitHub PoC★ 3
eh-amish/CVE-2026-64638-XSS-to-Shell-PoC
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
68RISK
open ↗GitHub PoC
KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC★ 3
🔥 XSS2Shell — CVE-2026-64638 Scanner & PoC Toolkit
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
68RISK
open ↗GitHub PoC
Exploiting the .lnk vulnerability and operating system handling mechanisms regarding explorer.exe and USB drives.
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 201
100RISK
open ↗GitHub PoC★ 1
Windwos Zero Day Local PrivESc Exploit (CVE-2026-41091)
Microsoft Defender Elevation of Privilege Vulnerability
71RISK
open ↗GitHub PoC★ 1
A Proof-Of-Concept for the CVE-2021-44228 vulnerability.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.