Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,331cataloged exploits

36,057CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,458Referência 22,721GitHub PoC 14,484VulnCheck XDB 8,829Nuclei 4,350Metasploit 3,489✓ verified onlyrecent popular risk

14,484 exploits

GitHub PoC

Password-Protected Category Bypass via JSON Format in JoomGallery

CVE-2026-66916MEDIUM23 Aug 2026

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0

33RISK

open ↗

GitHub PoC★ 1

Legendile7/CVE-2026-78122-POC

CVE-2026-78122HIGH23 Aug 2026

docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems

41RISK

open ↗

GitHub PoC

Gitlab-CVE-2026-19478

CVE-2026-19478CRITICAL22 Aug 2026

Improper Control of Generation of Code ('Code Injection') in GitLab

63RISK

open ↗

GitHub PoC

Detection & precondition-verification tool for CVE-2026-58231 (SAP Commerce Cloud Data Hub Adapter)

CVE-2026-58231CRITICAL22 Aug 2026

Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)

48RISK

open ↗

GitHub PoC★ 2

Apple MacOS Screen Sharing Arbitrary File read/write -> RCE

CVE-2026-65400CRITICALunder attack22 Aug 2026

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS

78RISK

open ↗

GitHub PoC★ 1

CVE-2026-9198 - IBM Langflow OSS Unauthenticated Remote Code Execution (RCE)

CVE-2026-9198CRITICALunder attack22 Aug 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

100RISK

open ↗

GitHub PoC

PoC for CVE-2026-75616, an authenticated OS command injection in TP-Link Archer C20 v6 firmware

CVE-2026-75616HIGH22 Aug 2026

Command Injection in Router Web Management Interface

41RISK

open ↗

GitHub PoC★ 141

POC pre-auth RCE on Exchange

CVE-2026-62911HIGH22 Aug 2026

Microsoft Exchange Server Elevation of Privilege Vulnerability

41RISK

open ↗

GitHub PoC

CVE-2026-47630 — NVIDIA Triton Inference Server: arbitrary dlopen via TRITON_BATCH_STRATEGY_PATH

CVE-2026-47630MEDIUM22 Aug 2026

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path travers

33RISK

open ↗

GitHub PoC★ 3

내 공유기가 Zbtlink ENDLESSDOORS 백도어(CVE-2026-66747) 대상인지 클릭 한 번으로 검사하는 Windows 프로그램

CVE-2026-66747CRITICAL22 Aug 2026

ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant

48RISK

open ↗

GitHub PoC

Stored XSS in J2Commerce Guest Checkout via Cookie Filter Bypass

CVE-2026-74252HIGH22 Aug 2026

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

41RISK

open ↗

GitHub PoC

CVE-2026-32475

CVE-2026-32475CRITICAL22 Aug 2026

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

63RISK

open ↗

GitHub PoC

MinhHK68/CVE-2026-13736

CVE-2026-13736MEDIUM22 Aug 2026

NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API

33RISK

open ↗

GitHub PoC

Metasploit-based penetration test on an isolated Metasploitable2 lab VM — remote exploitation via DistCC (CVE-2004-2687), privilege escalation via udev netlink (CVE-2009-1185), and vsftpd 2.3.4 backdoor analysis (CVE-2011-2523), with firewall mitigation validated end-to-end.

CVE-2004-2687—22 Aug 2026

distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote at

60RISK

open ↗

GitHub PoC★ 3

Read-only PoC for CVE-2026-65400 — macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file read. Patched in macOS 26.6.1 / 15.7.9 / 14.8.9.

CVE-2026-65400CRITICALunder attack21 Aug 2026

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS

78RISK

open ↗

GitHub PoC

Stored XSS via User-Agent in Admin Order View in PhocaCart

CVE-2026-76564HIGH21 Aug 2026

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

41RISK

open ↗

GitHub PoC★ 5

CVE-2026-32475 The Elementor Pro Forms File Upload field handles validation and file processing in two separate loops with different handling of empty upload entries (UPLOAD_ERR_NO_FILE). An unauthenticated attacker can submit a multipart

CVE-2026-32475CRITICAL21 Aug 2026

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

63RISK

open ↗

GitHub PoC★ 1

CVE-2026-69836 — Unauthenticated RCE via Entra ID deserialization

CVE-2026-69836CRITICAL21 Aug 2026

Microsoft Entra ID Remote Code Execution Vulnerability

48RISK

open ↗

GitHub PoC

CVE-2026-69836 - Draft or TODO

CVE-2026-69836CRITICAL21 Aug 2026

Microsoft Entra ID Remote Code Execution Vulnerability

48RISK

open ↗

GitHub PoC★ 1

PoC for CVE-2026-58455: Dockwatch <=0.6.567 unauthenticated RCE. Stdlib-only Python.

CVE-2026-58455CRITICAL21 Aug 2026

Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php

63RISK

open ↗

GitHub PoC

JCEzploit is a powerful, fully-automated RCE exploit for Joomla JCE (CVE-2026-48907) featuring interactive shell, batch command execution, file download capability, and proxy support. Built with Python & Rich for penetration testers. Ethical use only. By Sudeepa Wanigarathna.

CVE-2026-48907CRITICALunder attack21 Aug 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISK

open ↗

GitHub PoC★ 1

Custom Content Types and Fields plugin for WordPress

CVE-2026-19598CRITICAL21 Aug 2026

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

63RISK

open ↗

GitHub PoC

CVE-2026-41567 1day

CVE-2026-41567HIGH21 Aug 2026

Docker: `PUT /containers/{id}/archive` executes container binary on the host

41RISK

open ↗

GitHub PoC

CVE-2026-39113: SQLite SQLAR heap-buffer-overflow advisory and reproducer

CVE-2026-39113—21 Aug 2026

Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3a

23RISK

open ↗

GitHub PoC★ 5

CVE-2026-73570

CVE-2026-73570HIGHunder attack21 Aug 2026

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp

91RISK

open ↗

GitHub PoC

Reflected XSS via price_from & price_to Filter Parameters in PhocaCart

CVE-2026-76565MEDIUM21 Aug 2026

Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7

33RISK

open ↗

GitHub PoC★ 1

Educational use only!

CVE-2026-64638HIGH21 Aug 2026

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malici

68RISK

open ↗

GitHub PoC

wp2shell — WordPress Core Pre-Auth RCE Chain poc for CVE-2026-63030 and CVE-2026-60137

CVE-2026-63030CRITICALunder attack21 Aug 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISK

open ↗

GitHub PoC★ 1

Hunt-Benito/rendering-code-outside-the-sandbox-cve-2026-76036-dawn-webgpu-buffer-overflow-in-chrome-on-android

CVE-2026-76036CRITICAL21 Aug 2026

Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbi

48RISK

open ↗

GitHub PoC

PoC for J2Store CVE-2026-67358–67362 (J2Commerce security advisory Aug 2026)

CVE-2026-67358MEDIUM21 Aug 2026

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.