Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,299 exploits
initial-access
RCE via OOM corruption
100RISK
initial-access
RCE via stale global state
100RISK
local
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
local
Windows Win32k Elevation of Privilege Vulnerability
100RISK
initial-access
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISK
local
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
68RISK
initial-access
RCE via OOM corruption
100RISK
initial-access
RCE via OOM corruption
100RISK
denial-of-service
RCE via OOM corruption
100RISK
initial-access
RCE via OOM corruption
100RISK
initial-access
RCE via OOM corruption
100RISK
initial-access
RCE via stale global state
100RISK
denial-of-service
RCE via OOM corruption
100RISK
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
local
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RISK
initial-access
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
41RISK
initial-access
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5
48RISK
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
initial-access
Remote Code Execution in fastjson 1.2.68–1.2.83
48RISK
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
initial-access
Integer Overflow or Wraparound in GitLab
100RISK
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
info-leak
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
info-leak
Vite bypasses server.fs.deny when using `?raw??`
70RISK
initial-access
Plex Media Server arbitrary file write
86RISK
local
ipv4: validate checksum_start before completing checksum
48RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.