Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
4,542 exploits
Nucleicritical
Breeze <= 2.4.4 - Arbitrary File Upload
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
68RISK
open ↗Nucleicritical
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
75RISK
open ↗Nucleicritical
ChurchCRM - API Authentication Bypass via URL Injection
ChurchCRM has an API Authentication Bypass
43RISK
open ↗Nucleimedium
Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal
Frappe has an Arbitrary File Read via Path Traversal in render_include
36RISK
open ↗Nucleihigh
Vite Dev Server - Directory Traversal
Vite has a `server.fs.deny` bypass with queries
36RISK
open ↗Nucleimedium
Vite Dev Server - Path Traversal in Optimized Deps .map Handling
Vite has a Path Traversal in Optimized Deps `.map` Handling
28RISK
open ↗Nucleihigh
Meta Box <= 5.11.1 - Arbitrary File Deletion
WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability
28RISK
open ↗Nucleicritical
Fortinet FortiSandbox - Command Injection
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
100RISK
open ↗Nucleimedium
XWiki - Cross-Site Scripting
XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality
28RISK
open ↗Nucleimedium
PraisonAI AgentOS - Information Disclosure
PraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS
28RISK
open ↗Nucleihigh
Gravity SMTP WordPress Plugin - Sensitive Information Exposure
Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
78RISK
open ↗Nucleihigh
LiteLLM < 1.25.0 - Remote Code Execution
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/t
61RISK
open ↗Nucleihigh
Arcane <= 1.17.2 - Server-Side Request Forgery
Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
36RISK
open ↗Nucleicritical
Gotenberg <= 8.30.1 - Server Side Request Forgery
Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists
36RISK
open ↗Nucleicritical
Gotenberg <= 8.30.1 - Remote Code Execution
Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
63RISK
open ↗Nucleihigh
My Calendar WordPress Plugin - Information Disclosure
My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog
36RISK
open ↗Nucleihigh
Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI
36RISK
open ↗Nucleihigh
Geo Mashup <= 1.13.18 - SQL Injection
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter
56RISK
open ↗Nucleilow
Mailcow < 2026-03b - Href Link Injection
mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping
23RISK
open ↗Nucleicritical
Vendure Core - SQL Injection
@vendure/core has a SQL Injection vulnerability
43RISK
open ↗Nucleicritical
Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution
Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter
63RISK
open ↗Nucleihigh
HT Mega < 3.0.7 - Sensitive Information Disclosure
HT Mega < 3.0.7 – Unauthenticated PII Disclosure
48RISK
open ↗Nucleicritical
Rclone RC - Broken Access Control
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
55RISK
open ↗Nucleicritical
RClone RC - Command Injection
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
63RISK
open ↗Nucleihigh
New API < v0.12.10 - Stripe Webhook Bypass
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
36RISK
open ↗Nucleicritical
Krayin CRM < 2.2.1 - Installer Authentication Bypass
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
63RISK
open ↗Nucleicritical
Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
63RISK
open ↗Nucleimedium
Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
28RISK
open ↗Nucleicritical
Dockwatch <= 0.6.567 - OS Command Injection
Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php
63RISK
open ↗Nucleihigh
Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion
Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php
56RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.