Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,426cataloged exploits
41,291CVEs with public exploitation
24,696lab-tested
AllReferência 26,792Exploit-DB 24,491GitHub PoC 18,666exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,309 exploits
initial-access
ingress-nginx admission controller RCE escalation
85RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
initial-access
ingress-nginx admission controller RCE escalation
85RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
infoleak
Vite bypasses server.fs.deny when using `?raw??`
70RISK
initial-access
ingress-nginx admission controller RCE escalation
85RISK
initial-access
ingress-nginx admission controller RCE escalation
85RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
infoleak
Vite bypasses server.fs.deny when using `?raw??`
70RISK
infoleak
Vite bypasses server.fs.deny when using `?raw??`
70RISK
infoleak
Authorization Bypass in Next.js Middleware
85RISK
infoleak
Vite bypasses server.fs.deny when using `?raw??`
70RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
initial-access
ingress-nginx admission controller RCE escalation
85RISK
infoleak
Authorization Bypass in Next.js Middleware
85RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
local
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
initial-access
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com
85RISK
infoleak
Authorization Bypass in Next.js Middleware
85RISK
infoleak
Microsoft Outlook Remote Code Execution Vulnerability
100RISK
initial-access
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RISK
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
initial-access
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.