But just because there isn't a working PoC on GitHub doesn't mean there isn't one and things aren't been actively exploited.
If you are a bad actor you probably don't share your PoC around as it means less boxes to hit.
You can never rule out the possibility that someone interested in attacking you has a non-public exploit, but it's dramatically less likely if there aren't already working exploits circulating all over the internet.
You can never rule out the possibility that someone interested in attacking you has a non-public exploit, but it's dramatically less likely if there aren't already working exploits circulating all over the internet.