Awesome CVE PoC is a reference repository that organizes publicly available CVE Proof-of-Concept (PoC) links by year of disclosure. Each entry maps a CVE ID to one or more GitHub repositories where a PoC, exploit, or vulnerability research write-up has been published by its original author.
This project does not create, host, or modify any exploit code. It is strictly an index: a curated pointer to existing public resources, organized in a way that makes them easier to browse, search, and reference.
Intended audience:
- Security researchers tracking PoC availability for specific CVEs
- Penetration testers and red teamers building assessment references
- Blue team / SOC analysts researching detection and exploitation context
- Students and developers studying real-world vulnerability patterns
Why organize by year? CVE IDs are already year-prefixed (CVE-YYYY-NNNN), so grouping by year keeps the repository aligned with how CVEs are naturally identified, makes browsing a specific year's disclosures fast, and keeps individual directory listings small enough to stay readable as the collection grows.
| Year | Directory |
|---|---|
| 2016 | cve_2016/README.md |
| 2017 | cve_2017/README.md |
| 2018 | cve_2018/README.md |
| 2019 | cve_2019/README.md |
| 2020 | cve_2020/README.md |
| 2021 | cve_2021/README.md |
| 2022 | cve_2022/README.md |
| 2023 | cve_2023/README.md |
| 2024 | cve_2024/README.md |
| 2025 | cve_2025/README.md |
| 2026 | cve_2026/README.md |
| Year | Total Records | Unique CVEs |
|---|---|---|
| 2016 | 49 | 28 |
| 2017 | 142 | 59 |
| 2018 | 137 | 70 |
| 2019 | 191 | 103 |
| 2020 | 181 | 113 |
| 2021 | 375 | 138 |
| 2022 | 286 | 156 |
| 2023 | 650 | 310 |
| 2024 | 2188 | 1036 |
| 2025 | 2959 | 1132 |
| 2026 | 2262 | 1055 |
| Total | 9420 | 4200 |
"Total Records" reflects raw source entries before deduplication; "Unique CVEs" reflects the distinct CVE IDs actually listed in this repository. Some CVEs (e.g. widely-exploited or high-profile vulnerabilities) have dozens or even hundreds of independently authored PoC repositories linked under a single entry — every distinct link found for a CVE is preserved, not just one.
Each entry follows the standard CVE identifier format:
CVE-YEAR-NUMBER
Within a year's README.md, entries are sorted numerically by the number segment, not alphabetically (so CVE-2024-9 appears before CVE-2024-55, which appears before CVE-2024-1000).
A distinction is drawn between records and unique CVEs:
- Total Records count every source entry, including cases where the same CVE was published with a different PoC link at a different time.
- Unique CVEs count each CVE ID once. Where a CVE has more than one known PoC repository, all of them are listed under that single entry rather than being duplicated as separate rows.
CVE-2024-1234 — POC Link
This example is illustrative only. Refer to the relevant year's README.md to confirm whether a given CVE ID actually exists in this repository.
- Linked GitHub repositories are maintained by their original, independent authors and can be deleted, renamed, made private, or archived at any time without notice to this project.
- Inclusion in this repository does not mean the linked PoC has been manually tested, reviewed, or verified by the maintainers of this repository.
- A PoC being listed does not guarantee that the underlying vulnerability is present, exploitable, or reproducible in every environment or software version.
- Always independently verify the affected software, version, and configuration before relying on any linked PoC.
This collection is intended for authorized security research, vulnerability assessment, defensive security work, education, and testing.
- Only test systems, applications, and networks you own or are explicitly authorized to assess.
- Follow applicable laws, organizational policy, and any scope agreements before using any linked PoC.
- Use this repository as a reference index, not as a substitute for proper authorization or due diligence.
This repository does not guarantee the accuracy, completeness, safety, or functionality of any third-party PoC it links to. The maintainers of this repository are not responsible for how linked resources are used or misused by others.
Users are solely responsible for complying with all applicable laws, regulations, licenses, and authorization requirements when using any resource referenced here. All linked third-party repositories remain the property of their respective authors.
Contributions that add, correct, or maintain CVE/PoC references are welcome. See CONTRIBUTING.md for full guidelines, including how to add a new entry, report a broken link, and avoid duplicate CVE rows.
This repository's own content (structure, organization, and README files) is licensed under the MIT License.
Linked third-party PoC repositories are governed by their own individual licenses, which may differ from this repository's terms or may have no license at all. Always check the license of the linked repository before using its code.
All GitHub links in this repository point to external projects maintained independently by their respective authors. Those projects' licensing, terms of use, and maintenance status are entirely their own and may differ from this repository at any time.
This collection may be updated periodically as new CVE PoC references become publicly available. Updates are made manually as entries are reviewed and added; no automatic update mechanism is claimed or implied by this README.
What is this repository? A curated, year-organized index of publicly available CVE PoC links found on GitHub.
Are all PoCs guaranteed to work? No. Availability, functionality, and applicability vary by environment and are not guaranteed.
Are the PoCs tested? No. Entries are indexed from public sources and are not manually verified or tested by this repository's maintainers.
How are CVEs organized? By year of disclosure (2016 through 2026), with entries sorted numerically within each year.
How can I report a broken link? Open an issue with the CVE ID and the broken link.
Can I contribute a new PoC? Yes. See CONTRIBUTING.md.
Can I use these PoCs in production? No. These are research and testing references only, intended for use in authorized, controlled environments.
Who maintains the linked repositories? Each linked repository is maintained independently by its original author, not by this project.
Use responsibly. Test only what you are authorized to test.
Made with ❤️ by hackthacker