Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,299 exploits
initial-access
RCE via OOM corruption
100RISK
initial-access
RCE via OOM corruption
100RISK
initial-access
RCE via OOM corruption
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a docu
38RISK
initial-access
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
initial-access
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
100RISK
initial-access
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5
48RISK
initial-access
Plex Media Server SSRF
83RISK
initial-access
Laravel TokenGuard authentication bypass through non-string API credentials
63RISK
denial-of-service
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
100RISK
initial-access
RCE via OOM corruption
100RISK
client-side
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitra
71RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
info-leak
RCE via OOM corruption
100RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.