Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,445cataloged exploits
34,432CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleihigh
Tattile Camera < 1.181.5 - Default Login
CVE-2026-26341CRITICAL
Tattile Smart+ / Vega / Basic <= 1.181.5 Default Credentials
63RISK
open ↗
Nucleihigh
MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes
CVE-2026-2652HIGH
Authentication Bypass in mlflow/mlflow
41RISK
open ↗
Nucleicritical
Ghost CMS Content API - SQL Injection
CVE-2026-26980CRITICAL
Ghost has a SQL Injection in its Content API
75RISK
open ↗
Nucleicritical
Progress ShareFile Storage Zones Controller - Authentication Bypass
CVE-2026-2699CRITICAL
EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)
75RISK
open ↗
Nucleicritical
MajorDoMo - Unauthenticated RCE
CVE-2026-27174CRITICAL
MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
63RISK
open ↗
Nucleimedium
MajorDoMo - Cross-Site Scripting
CVE-2026-27176MEDIUM
MajorDoMo Reflected Cross-Site Scripting in command.php
28RISK
open ↗
Nucleihigh
MindsDB - Remote Code Execution
CVE-2026-27483HIGH
MindsDB has Path Traversal in /api/files Leading to Remote Code Execution
61RISK
open ↗
Nucleimedium
Changedetection.io RSS Single Watch - Cross-Site Scripting
CVE-2026-27645MEDIUM
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
28RISK
open ↗
Nucleihigh
OpenCATS - Command Injection
CVE-2026-27760CRITICAL
OpenCATS PHP Code Injection via installer AJAX endpoint
68RISK
open ↗
Nucleihigh
Gitea Container Registry - Unauthorized Private Image Access
CVE-2026-27771HIGH
Gitea Composer package source links use insufficient permission checks
68RISK
open ↗
Nucleihigh
mcp-atlassian < 0.17.0 - Server-Side Request Forgery
CVE-2026-27826HIGH
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
41RISK
open ↗
Nucleihigh
Piwigo < 16.3.0 - Unauthenticated Information Disclosure via History API
CVE-2026-27833HIGH
Piwigo: Unauthenticated Information Disclosure via pwg.history.search API
36RISK
open ↗
Nucleicritical
Nginx UI < 2.3.3 - Information Disclosure
CVE-2026-27944CRITICAL
Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure
68RISK
open ↗
Nucleicritical
Qwik - Unauthenticated RCE via server$ Deserialization
CVE-2026-27971CRITICAL
Qwik affected by unauthenticated RCE via server$ Deserialization
63RISK
open ↗
Nucleimedium
Dify User Enumeration via Observable Response Discrepancy
CVE-2026-28288MEDIUM
Dify has a user enumeration issue
28RISK
open ↗
Nucleimedium
NocoDB - User Enumeration
CVE-2026-28358LOW
NocoDB: User Enumeration via Password Reset Endpoint
23RISK
open ↗
Nucleicritical
WeGIA <= 3.6.4 - Remote Code Execution
CVE-2026-28409CRITICAL
WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection
43RISK
open ↗
Nucleihigh
Gradio - Absolute Path Traversal
CVE-2026-28414HIGH
Gradio has Absolute Path Traversal on Windows with Python 3.13+
36RISK
open ↗
Nucleicritical
FOSSBilling - Server-Side Template Injection
CVE-2026-28496CRITICAL
FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE
68RISK
open ↗
Nucleicritical
MetInfo CMS <= 8.1 - Remote Code Execution
CVE-2026-29014CRITICAL
MetInfo CMS Unauthenticated PHP Code Injection RCE
75RISK
open ↗
Nucleicritical
Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal
CVE-2026-29059MEDIUM
Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly
48RISK
open ↗
Nucleimedium
TinaCMS - Path Traversal
CVE-2026-29066MEDIUM
Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI
28RISK
open ↗
Nucleimedium
SiYuan Note - Cross-Site Scripting
CVE-2026-29183CRITICAL
SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution
43RISK
open ↗
Nucleihigh
WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection
CVE-2026-3018HIGH
Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
36RISK
open ↗
Nucleicritical
Citrix NetScaler SAML IDP - Memory Overread
CVE-2026-3055CRITICALunder attack
Insufficient input validation leading to memory overread
95RISK
open ↗
Nucleihigh
Flowise - NVIDIA NIM Endpoints Missing Authentication
CVE-2026-30824HIGH
Flowise: Missing Authentication on NVIDIA NIM Endpoints
48RISK
open ↗
Nucleihigh
Glances - Information Disclosure
CVE-2026-30928HIGH
Glances Exposes Unauthenticated Configuration Secrets
36RISK
open ↗
Nucleihigh
OneUptime < 10.0.21 - Path Traversal
CVE-2026-30958HIGH
OneUptime: Path Traversal — Arbitrary File Read (No Auth)
36RISK
open ↗
Nucleimedium
SiYuan <= v3.5.9 - SVG Animate Element XSS
CVE-2026-31807MEDIUM
SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS
28RISK
open ↗
Nucleimedium
SiYuan <= v3.5.9 - Cross Site Scripting
CVE-2026-31809MEDIUM
SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS
28RISK
open ↗
← previouspage 138 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.