Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,299 exploits
initial-access
RCE via OOM corruption
100RISK
local
NSecsoft NSecKrnl process termination privilege escalation
33RISK
denial-of-service
RCE via OOM corruption
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via OOM corruption
100RISK
initial-access
RCE via OOM corruption
100RISK
initial-access
An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a docu
38RISK
initial-access
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
initial-access
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
100RISK
initial-access
RCE via OOM corruption
100RISK
initial-access
RCE via OOM corruption
100RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via OOM corruption
100RISK
initial-access
Plex Media Server SSRF
83RISK
initial-access
RCE via OOM corruption
100RISK
initial-access
RCE via OOM corruption
100RISK
local
Out-of-Bounds Write in Google Brotli Decoder
70RISK
initial-access
Out-of-Bounds Write in Google Brotli Decoder
70RISK
initial-access
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5
48RISK
local
Out-of-Bounds Write in Google Brotli Decoder
70RISK
initial-access
Remote Code execution in SnakeYAML
78RISK
denial-of-service
RCE via OOM corruption
100RISK
initial-access
RCE via stale global state
100RISK
local
Code Execution / Escalation of Privileges in ThrottleStop
41RISK
initial-access
In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
60RISK
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
client-side
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
93RISK
initial-access
RCE via stale global state
100RISK
initial-access
RCE via stale global state
100RISK
info-leak
Gitea Org-mode file disclosure and code execution
68RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.