Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,062cataloged exploits

31,617CVEs with public exploitation

0lab-tested

All Exploit-DB 22,467Referência 19,791GitHub PoC 13,086VulnCheck XDB 8,069Nuclei 4,187Metasploit 3,462✓ verified onlyrecent popular risk

13,086 exploits

GitHub PoC

HTTP2-Bomb

CVE-2026-49975HIGH18 Jun 2026

Apache HTTP Server: mod_http2 denial of service

46RISK

open ↗

GitHub PoC★ 9

0xCyberstan/CVE-2026-46215-POC

CVE-2026-46215HIGH18 Jun 2026

drm: Set old handle to NULL before prime swap in change_handle

41RISK

open ↗

GitHub PoC

A local lab for studying, reproducing, and verifying the patch for CVE-2026-42208: an unauthenticated SQL injection in LiteLLM's API key authentication path.

CVE-2026-42208CRITICALunder attack18 Jun 2026

LiteLLM: SQL injection in Proxy API key verification

100RISK

open ↗

GitHub PoC

Fortinet FortiSandbox 4.4.0-4.4.8 - OS Command Injection via tracer-behavior Endpoint

CVE-2026-39808CRITICAL18 Jun 2026

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

75RISK

open ↗

GitHub PoC★ 4

Detection scripts, patch checker & hardening guide for CVE-2026-44963 (Veeam B&R RCE)

CVE-2026-44963CRITICAL18 Jun 2026

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

48RISK

open ↗

GitHub PoC

Root-Level RCE via OS Command Injection in Ivanti Sentry

CVE-2026-10520CRITICAL18 Jun 2026

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote

85RISK

open ↗

GitHub PoC

CVE-2025-6254 — Doctreat Core <= 1.6.8 — Unauthenticated Privilege Escalation

CVE-2025-6254CRITICAL18 Jun 2026

Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation

48RISK

open ↗

GitHub PoC

Reproduction lab for CVE-2026-54316 (Claude Code WebFetch huggingface.co bare-hostname permission bypass / exfiltration)

CVE-2026-54316MEDIUM18 Jun 2026

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

33RISK

open ↗

GitHub PoC★ 1

CVE-2026-40369

CVE-2026-40369HIGH18 Jun 2026

Windows Kernel Elevation of Privilege Vulnerability

41RISK

open ↗

GitHub PoC★ 2

CVE-2025-54123 Hoverfly Command Injection to RCE PoC

CVE-2025-54123CRITICAL18 Jun 2026

Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

68RISK

open ↗

GitHub PoC★ 1

Defensive lab validation and SOC detection guidance for CVE-2026-48907 in Joomla JCE <= 2.9.99.4, including Apache/Joomla/auditd telemetry, webshell artifacts, Sigma rules, MITRE ATT&CK mapping and mitigation recommendations.

CVE-2026-48907CRITICALunder attack18 Jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISK

open ↗

GitHub PoC★ 7

CVE-2026-50656

CVE-2026-50656HIGH18 Jun 2026

Microsoft Defender Elevation of Privilege Vulnerability

41RISK

open ↗

GitHub PoC

Full-chain CVE-2025-57819 PoC for FreePBX 15, 16, and 17: unauthenticated SQLi to RCE and root takeover.

CVE-2025-57819CRITICALunder attack18 Jun 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISK

open ↗

GitHub PoC

PoC for CVE-2015-10141 – Xdebug unauthenticated RCE

CVE-2015-10141CRITICAL17 Jun 2026

Xdebug Remote Debugger Unauthenticated OS Command Execution

63RISK

open ↗

GitHub PoC

CVE-2026-49079 JetSearch SQL Injection Exploit

CVE-2026-49079CRITICAL17 Jun 2026

WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability

48RISK

open ↗

GitHub PoC

Log4Shell (CVE-2021-44228) 보안 실습 환경 - Log4j 2.14.1 취약 로그 수집 서버

CVE-2021-44228CRITICALunder attackransomware17 Jun 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC

segunakinsoyinu/CVE-2024-42009-roundcube-xss

CVE-2024-42009CRITICALunder attack17 Jun 2026

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea

100RISK

open ↗

GitHub PoC

hulina9900-boop/DIY-CVE-2026-42945-POC

CVE-2026-42945CRITICAL17 Jun 2026

NGINX ngx_http_rewrite_module vulnerability

60RISK

open ↗

GitHub PoC

CVE-2026-48907

CVE-2026-48907CRITICALunder attack17 Jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISK

open ↗

GitHub PoC

CVE-2026-48907 is a critical improper access control vulnerability in the JCE editor extension for Joomla. It allows unauthenticated attackers to create new editor profiles, which can ultimately lead to arbitrary PHP file upload and remote code execution on affected systems

CVE-2026-48907CRITICALunder attack17 Jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISK

open ↗

GitHub PoC

CVE-2026-45777 PoC

CVE-2026-45777CRITICAL17 Jun 2026

Open XDMoD Vulnerable to Unauthenticated Remote Code Execution (RCE) via OS Command Injection

28RISK

open ↗

GitHub PoC

CVE-2026-5411 WP Captcha PRO

CVE-2026-5411HIGH17 Jun 2026

WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

41RISK

open ↗

GitHub PoC

CVE-2026-7654 Admin Columns PHP Object Injection RCE Exploit

CVE-2026-7654HIGH17 Jun 2026

Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value

41RISK

open ↗

GitHub PoC

CVE-2026-5415 WP Captcha PRO Authenticated Authentication Bypass Exploit

CVE-2026-5415HIGH17 Jun 2026

WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link

41RISK

open ↗

GitHub PoC

CVE-2026-7465 Spectra Gutenberg Blocks Authenticated RCE Exploit

CVE-2026-7465HIGH17 Jun 2026

Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes

41RISK

open ↗

GitHub PoC

CVE-2026-7459 Simple History Missing Authorization Account Takeover Exploit

CVE-2026-7459HIGH17 Jun 2026

Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint

41RISK

open ↗

GitHub PoC

d4ngkh04w/CVE-2020-7961

CVE-2020-7961CRITICALunder attack17 Jun 2026

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RISK

open ↗

GitHub PoC

CVE-2026-42758 WebinarIgnition Exploit

CVE-2026-42758CRITICAL17 Jun 2026

WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability

48RISK

open ↗

GitHub PoC

CVE-2026-49105 WP Zendesk PHP Object Injection Exploit

CVE-2026-49105CRITICAL17 Jun 2026

WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

48RISK

open ↗

GitHub PoC

CVE-2026-9691: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule

CVE-2026-9691CRITICAL17 Jun 2026

WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability

48RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.