Exploitarium GitHub Archive Exposes 204 Unpatched 0-Day PoCs Across Open-Source Projects

A GitHub repository called "exploitarium", operated by the account bikini, has published a growing archive of uncoordinated zero-day proof-of-concept exploits affecting dozens of open-source and infrastructure projects before vendors could patch them. Reporting says the archive expanded beyond early public estimates to 35 project folders and 204 tracked files, with new targets continuing to appear at a pace of roughly two to three projects per week. The exposed attack surface spans libraries, kernel drivers, remote-access tools, web applications, and core infrastructure including PostgreSQL, Redis, Nextcloud, Discourse, Nmap, curl, AnyDesk, RustDesk, Git, and some PHP builds.

Researchers identified CVE-2026-55200 in libssh2 as one of the most serious issues in the archive: a pre-authentication out-of-bounds write in ssh2_transport_read() affecting libssh2 through 1.11.1, with an upstream fix referenced as commit 97acf3d. Because libssh2 is embedded transitively in widely used software such as curl and Git, the disclosures are being treated as a broader supply-chain exposure rather than a single incident. Assessments describe exploitarium as a lightly moderated multi-contributor clearinghouse that distributes unvetted exploit material at scale, prompting calls for urgent patching, software composition analysis, reachability-based remediation, and sustained monitoring.