Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,313cataloged exploits
34,834CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,797GitHub PoC 13,885VulnCheck XDB 8,484Nuclei 4,237Metasploit 3,467✓ verified onlyrecentpopularrisk
21,797 exploits
Referência
CVE-2026-13518
CVE-2026-13518HIGH
Tenda JD12L addressNat fromAddressNat stack-based overflow
41RISK
open ↗
Referência
CVE-2026-13511
CVE-2026-13511LOW
VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization
28RISK
open ↗
Referência
CVE-2026-13510
CVE-2026-13510MEDIUM
SimStudioAI sim Password Protection deployment.ts weak hash
33RISK
open ↗
Referência
CVE-2026-13509
CVE-2026-13509MEDIUM
RAGapp Knowledge File files.py FileHandler.remove_file path traversal
33RISK
open ↗
Referência
CVE-2026-13508
CVE-2026-13508MEDIUM
khoj-ai khoj Conversation Sharing api_chat.py authorization
33RISK
open ↗
Referência
CVE-2026-13504
CVE-2026-13504MEDIUM
code-projects Project Management System Mail Compose mail.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-13500
CVE-2026-13500MEDIUM
antlr ANTLR4 Grammar Action Block OutputFile.java code injection
33RISK
open ↗
Referência
CVE-2026-13486
CVE-2026-13486MEDIUM
SourceCodester Class and Exam Timetabling System preview6.php sql injection
33RISK
open ↗
Referência
CVE-2026-13485
CVE-2026-13485MEDIUM
SourceCodester Class and Exam Timetabling System preview.php sql injection
33RISK
open ↗
Referência
CVE-2026-13484
CVE-2026-13484LOW
MLflow Experiment-scoped Label Schema CRUD API authorization
28RISK
open ↗
Referência
CVE-2026-58056
CVE-2026-58056HIGH
RustDesk - FileTransfer Session Authorization Scope Bypass
41RISK
open ↗
Referência
CVE-2026-58055
CVE-2026-58055MEDIUM
nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length
33RISK
open ↗
Referência
CVE-2026-58053
CVE-2026-58053CRITICAL
Gitea act_runner - Container Hardening Bypass via Workflow Container Options
48RISK
open ↗
Referência
CVE-2026-58052
CVE-2026-58052MEDIUM
7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision
33RISK
open ↗
Referência
CVE-2026-58051
CVE-2026-58051HIGH
libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
41RISK
open ↗
Referência
CVE-2026-58049
CVE-2026-58049HIGH
FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()
41RISK
open ↗
Referência
CVE-2026-9677
CVE-2026-9677MEDIUM
Shariff for WordPress <= 1.0.11 - Admin+ Stored Cross-Site Scripting
33RISK
open ↗
Referência
CVE-2026-57521
CVE-2026-57521MEDIUM
Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController
33RISK
open ↗
Referência
CVE-2026-56774
CVE-2026-56774MEDIUM
Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID
33RISK
open ↗
Referência
CVE-2026-56770
CVE-2026-56770HIGH
libais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message ID
41RISK
open ↗
Referência
CVE-2026-56769
CVE-2026-56769MEDIUM
Huly Platform - Server-Side Request Forgery via /import Endpoint
33RISK
open ↗
Referência
CVE-2026-5305
CVE-2026-5305HIGH
Email Address Encoder (Free < 1.0.25, Premium < 0.3.12) - Unauthenticated Stored XSS
41RISK
open ↗
Referência
CVE-2026-9710
CVE-2026-9710HIGH
Themeco Cornerstone < 7.8.8 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Password Hash Disclosure
41RISK
open ↗
Referência
CVE-2026-12810
CVE-2026-12810MEDIUM
Edimax BR-6478AC V2 POST Request mp command injection
33RISK
open ↗
Referência
CVE-2026-12809
CVE-2026-12809MEDIUM
Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injection
33RISK
open ↗
Referência
CVE-2026-12808
CVE-2026-12808MEDIUM
Edimax BR-6478AC V2 POST Request stainfo command injection
33RISK
open ↗
Referência
CVE-2026-12806
CVE-2026-12806HIGH
Edimax BR-6478AC V2 POST Request formWlSiteSurvey buffer overflow
41RISK
open ↗
Referência
CVE-2026-12805
CVE-2026-12805MEDIUM
OFFIS DCMTK ofxml.cc parseFile heap-based overflow
33RISK
open ↗
Referência
CVE-2026-12799
CVE-2026-12799MEDIUM
BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization
33RISK
open ↗
Referência
CVE-2026-12796
CVE-2026-12796MEDIUM
BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration
33RISK
open ↗
← previouspage 297 / 727next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.