Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,526cataloged exploits
34,478CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecentpopularrisk
8,213 exploits
VulnCheck XDB
infoleak
CVE-2018-14847CRITICALunder attack21 Apr 2021
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2021-22893CRITICALunder attackransomware21 Apr 2021
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windo
90RISK
open ↗
VulnCheck XDB
remote-with-credentials
CVE-2018-9206—20 Apr 2021
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
60RISK
open ↗
VulnCheck XDB
local
CVE-2021-3493HIGHunder attack19 Apr 2021
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o
98RISK
open ↗
VulnCheck XDB
local
CVE-2016-5195HIGHunder attack16 Apr 2021
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗
VulnCheck XDB
local
CVE-2015-1701HIGHunder attackransomware16 Apr 2021
Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local
98RISK
open ↗
VulnCheck XDB
initial-access
CVE-2017-12617HIGHunder attack16 Apr 2021
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
100RISK
open ↗
VulnCheck XDB
local
CVE-2021-3156HIGHunder attack14 Apr 2021
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-26855CRITICALunder attackransomware14 Apr 2021
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2020-17519CRITICALunder attack13 Apr 2021
Apache Flink directory traversal attack: reading remote files through the REST API
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2020-5902CRITICALunder attackransomware13 Apr 2021
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2003-0201—12 Apr 2021
Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x vers
60RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-21975HIGHunder attackransomware10 Apr 2021
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
VulnCheck XDB
local
CVE-2021-3156HIGHunder attack09 Apr 2021
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-21402HIGH09 Apr 2021
Unauthenticated Arbitrary File Access in Jellyfin
78RISK
open ↗
VulnCheck XDB
initial-access
CVE-2020-7961CRITICALunder attack09 Apr 2021
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2020-1938CRITICALunder attack08 Apr 2021
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-21975HIGHunder attackransomware06 Apr 2021
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2019-19781CRITICALunder attackransomware06 Apr 2021
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2020-1472MEDIUMunder attackransomware06 Apr 2021
Netlogon Elevation of Privilege Vulnerability
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-21972CRITICALunder attackransomware06 Apr 2021
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor
100RISK
open ↗
VulnCheck XDB
local
CVE-2021-3156HIGHunder attack05 Apr 2021
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2017-9805HIGHunder attack04 Apr 2021
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2020-17453—03 Apr 2021
WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.
43RISK
open ↗
VulnCheck XDB
local
CVE-2021-1732HIGHunder attackransomware02 Apr 2021
Windows Win32k Elevation of Privilege Vulnerability
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-21975HIGHunder attackransomware02 Apr 2021
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-21975HIGHunder attackransomware01 Apr 2021
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2020-9496—01 Apr 2021
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
60RISK
open ↗
VulnCheck XDB
initial-access
CVE-2020-14882CRITICALunder attack31 Mar 2021
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-21975HIGHunder attackransomware31 Mar 2021
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
← previouspage 222 / 274next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.