Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,340cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,491GitHub PoC 18,603exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,309 exploits
initial-access
Adobe Commerce | Improper Input Validation (CWE-20)
100RISK
initial-access
Upload Arbitrary Files
100RISK
remote-with-credentials
Gladinet CentreStack and TrioFox Hard Coded AES Keys
98RISK
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
info-leak
Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
85RISK
initial-access
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
initial-access
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
60RISK
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
initial-access
NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because fun
75RISK
initial-access
Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload
60RISK
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
infoleak
Zlib compressed protocol header length confusion may allow memory read
100RISK
initial-access
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
100RISK
infoleak
Zlib compressed protocol header length confusion may allow memory read
100RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.