Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,864cataloged exploits
40,957CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,439VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
88,864 exploits
GitHub PoC
Winrar Exploit CVE-2023-38831
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a
100RISK
open ↗GitHub PoC★ 31
BPF-LSM mitigation for CVE-2026-31431 (Copy Fail) — denies AF_ALG socket creation cluster-wide
crypto: algif_aead - Revert to operating out-of-place
100RISK
open ↗Exploit-DB
BusyBox 1.37.0 - Path Traversal
Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization
41RISK
open ↗Exploit-DB
Python-Multipart 0.0.22 - Path Traversal
Python-Multipart has Arbitrary File Write via Non-Default Configuration
41RISK
open ↗Exploit-DB
SUSE Manager 4.3.15 - Code Execution
SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint
53RISK
open ↗Exploit-DB
NiceGUI 3.6.1 - Path Traversal
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
41RISK
open ↗GitHub PoC
CVE-2026-41940利用工具（go并发检测，python利用）
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC
Razielx64/CVE-2025-69606-GSVoIP-XSS
Cross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90. The `msg` parameter in t
33RISK
open ↗Exploit-DB
Frigate NVR 0.16.3 - Remote Code Execution
Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape
48RISK
open ↗GitHub PoC
Remediation report for MegaQuagga Publishing validating the mitigation of CVE-2019-9978 through progressive defensive layering. Documents reverse proxy insertion, ModSecurity WAF deployment, Graylog SIEM integration, and SSL/TLS enforcement using multi-stage Wireshark PCAP analysis across pfSense WAN and LAN interfaces.
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio
100RISK
open ↗GitHub PoC★ 13
Detection, mitigation, and reverse-engineering tooling for CVE-2026-41940 (SessionScribe): the cPanel/WHM unauthenticated session-forgery vulnerability disclosed 2026-04-28. Defense-in-depth active mitigation shim, ModSec rule pack, remote probe, on-host IOC scanner, and per-tier RE snapshot collector. GPL v2.
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC
Arbitrary file read in mcp-atlassian via confluence_upload_attachment — CVE-2026-77262 / GHSA-p6hp-93wp-fh6p
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)
41RISK
open ↗GitHub PoC
dinhthihanhle1989-max/CVE-2024-29988
SmartScreen Prompt Security Feature Bypass Vulnerability
83RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.