
A community-curated, verified collection of Proof-of-Concept exploits for CVEs disclosed in 2026.
The definitive community-curated index of verified Proof-of-Concept (PoC) exploits, technical root-cause analyses, and vulnerability research for CVEs disclosed in 2026.
| 🏢 Category | Primary Target Technologies / Vendors |
|---|---|
| 🌐 Web & CMS | WordPress Core, WooCommerce, Elementor, Apache HTTP, Nginx, Node.js |
| 🏢 Enterprise & Auth | Microsoft Exchange, SharePoint, Active Directory, Keycloak, SAP NetWeaver, Oracle WebLogic |
| 🛡️ Network & Firewalls | Palo Alto PAN-OS, Fortinet FortiOS, Cisco IOS XE / ISE, F5 BIG-IP, SonicWall SMA, Check Point |
| ☁️ Cloud & DevOps | Kubernetes, Docker & runc, HashiCorp Vault/Nomad, GitLab, Jenkins, Grafana |
| 🐧 Kernels & Systems | Linux Kernel (eBPF/netfilter/io_uring), Windows Kernel (CLFS/Win32k), VMware ESXi, Android, Apple iOS |
This repository indexes, tracks, and documents Proof-of-Concept exploits for all 2026 CVEs with verified upstream researcher attribution, official vendor advisories, and standardized non-destructive verification skeletons.
poc.py --verify-only) for lab security audits.| Total CVEs | 🔴 Critical | 🟠 High | 🟡 Medium+ | PoCs Available | Last Updated |
|---|---|---|---|---|---|
| 2314 | 1176 | 1081 | 57 | 2314 | 2026-09-29 |
| CVE ID | CVSS | Product | Vuln Class | Day | Added |
|---|---|---|---|---|---|
| CVE-2026-27015 | 🔴 9.8 | SAP NetWeaver | Authentication Bypass in... | — | 2026-09-27 |
| CVE-2026-26244 | 🔴 9.8 | SonicWall SMA | Pre-Auth Stack Buffer... | — | 2026-09-27 |
| CVE-2026-25330 | 🔴 9.8 | Apache ActiveMQ | OpenWire Protocol Insecure... | — | 2026-09-27 |
| CVE-2026-24515 | 🔴 9.8 | F5 BIG-IP | Pre-Auth Memory Corruption... | — | 2026-09-27 |
| CVE-2026-23844 | 🔴 9.8 | Ivanti Connect | Authentication Bypass and... | — | 2026-09-27 |
| CVE-2026-23412 | 🔴 9.8 | Atlassian Confluence | OGNL Injection / Pre-Auth RCE | — | 2026-09-27 |
| CVE-2026-23055 | 🔴 9.8 | GitLab Enterprise | Arbitrary File Overwrite &... | — | 2026-09-27 |
| CVE-2026-22390 | 🔴 9.8 | Palo Alto | Unauthenticated Remote... | — | 2026-09-27 |
| CVE-2026-22150 | 🔴 9.8 | Cisco Identity | Pre-auth Command Injection... | — | 2026-09-27 |
| CVE-2026-21912 | 🔴 9.8 | Microsoft SharePoint | Remote Code Execution via... | — | 2026-09-27 |