Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,340cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,491GitHub PoC 18,603exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,309 exploits
client-side
MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site Scripting
56RISK
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
initial-access
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
client-side
MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site Scripting
56RISK
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
remote-with-credentials
File overwrite in file update API in Gogs
100RISK
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
client-side
Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting
56RISK
local
Kernel: io_uring: page use-after-free vulnerability via buffer ring mmap
46RISK
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
initial-access
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
denial-of-service
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many
93RISK
local
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o
98RISK
initial-access
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
initial-access
Livewire vulnerable to remote command execution during property update hydration
100RISK
initial-access
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
local
Windows Kernel Elevation of Privilege Vulnerability
71RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
initial-access
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
initial-access
Authentication Bypass and RCE in man-group/dtale
85RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.