Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,432cataloged exploits
34,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,493GitHub PoC 13,618VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleimedium
Blinko <= 1.8.3 - Path Traversal via /plugins
CVE-2026-23483MEDIUM
Blinko: Unauthorized Arbitrary File Read - /plugins
28RISK
open ↗
Nucleilow
Blinko <= 1.8.3 - User Information Leak
CVE-2026-23486MEDIUM
Blinko: Unauthorized User Information Leak
28RISK
open ↗
Nucleihigh
Modular DS - Broken Access Control
CVE-2026-23550CRITICAL
WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability
68RISK
open ↗
Nucleicritical
Windmill < 1.603.3 - SQL Injection
CVE-2026-23696CRITICAL
Windmill < 1.603.3 File Ownership Handling SQLi RCE
68RISK
open ↗
Nucleicritical
MCPJam Inspector - Remote Code Execution
CVE-2026-23744CRITICAL
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISK
open ↗
Nucleicritical
SmarterTools SmarterMail - Admin Password Reset
CVE-2026-23760CRITICALunder attackransomware
SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
100RISK
open ↗
Nucleimedium
XWiki Platform Distribution Flavor Main - Cross-Site Scripting
CVE-2026-24128MEDIUM
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
28RISK
open ↗
Nucleihigh
Ally – Web Accessibility & Usability <= 4.0.3 - SQL Injection
CVE-2026-2413HIGH
Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path
36RISK
open ↗
Nucleihigh
Geo Mashup <= 1.13.17 - SQL Injection
CVE-2026-2416HIGH
Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter
36RISK
open ↗
Nucleicritical
NVIDIA Triton Inference Server <= 26.02 - Authentication Bypass
CVE-2026-24207CRITICAL
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A succes
63RISK
open ↗
Nucleicritical
SmarterMail - Remote Code Execution
CVE-2026-24423CRITICALunder attackransomware
SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
95RISK
open ↗
Nucleihigh
AnythingLLM - Information Disclosure
CVE-2026-24477HIGH
AnythingLLM has key leak in `systemSettings.js`
36RISK
open ↗
Nucleicritical
Group-Office < 26.0.5 - Remote Code Execution
CVE-2026-25512CRITICAL
Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler
48RISK
open ↗
Nucleimedium
changedetection.io <= 0.52.9 - Unauthenticated Path Traversal
CVE-2026-25527MEDIUM
changedetection.io vulnerable to unauthenticated static path traversal
28RISK
open ↗
Nucleihigh
Astro SSR - Server-Side Request Forgery
CVE-2026-25545MEDIUM
Astro has Full-Read SSRF in error rendering via Host: header injection
28RISK
open ↗
Nucleicritical
OpenBullet2 <= 0.3.2 - Authentication Bypass
CVE-2026-25555CRITICAL
OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header
63RISK
open ↗
Nucleimedium
Blesta <= 5.13.1 - Cross-Site Scripting
CVE-2026-25616MEDIUM
Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.
28RISK
open ↗
Nucleihigh
Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS
CVE-2026-25892HIGH
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
36RISK
open ↗
Nucleicritical
Milvus - Unauthenticated Metrics API Access
CVE-2026-26190CRITICAL
Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
55RISK
open ↗
Nucleihigh
Tattile Camera < 1.181.5 - Default Login
CVE-2026-26341CRITICAL
Tattile Smart+ / Vega / Basic <= 1.181.5 Default Credentials
63RISK
open ↗
Nucleihigh
MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes
CVE-2026-2652HIGH
Authentication Bypass in mlflow/mlflow
41RISK
open ↗
Nucleicritical
Ghost CMS Content API - SQL Injection
CVE-2026-26980CRITICAL
Ghost has a SQL Injection in its Content API
75RISK
open ↗
Nucleicritical
Progress ShareFile Storage Zones Controller - Authentication Bypass
CVE-2026-2699CRITICAL
EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)
75RISK
open ↗
Nucleicritical
MajorDoMo - Unauthenticated RCE
CVE-2026-27174CRITICAL
MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
63RISK
open ↗
Nucleimedium
MajorDoMo - Cross-Site Scripting
CVE-2026-27176MEDIUM
MajorDoMo Reflected Cross-Site Scripting in command.php
28RISK
open ↗
Nucleihigh
MindsDB - Remote Code Execution
CVE-2026-27483HIGH
MindsDB has Path Traversal in /api/files Leading to Remote Code Execution
61RISK
open ↗
Nucleihigh
NocoBase - SQL Injection
CVE-2026-41641HIGH
NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call
36RISK
open ↗
Nucleicritical
cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
CVE-2026-41940CRITICALunder attackransomware
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗
Nucleihigh
CKAN DataStore SQL Search - SQL Injection
CVE-2026-42031HIGH
CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
36RISK
open ↗
Nucleicritical
LiteLLM - SQL Injection
CVE-2026-42208CRITICALunder attack
LiteLLM: SQL injection in Proxy API key verification
100RISK
open ↗
← previouspage 111 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.