Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2021-35464
CVE-2021-35464CRITICALunder attackransomware
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pa
100RISK
open ↗
Referência
CVE-2026-16222
CVE-2026-16222MEDIUM
1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery
33RISK
open ↗
Referência
CVE-2026-63731
CVE-2026-63731MEDIUM
HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint
33RISK
open ↗
Referência
CVE-2026-63107
CVE-2026-63107MEDIUM
LimeSurvey SSRF via REST API Survey Template Host Header
33RISK
open ↗
Referência
CVE-2026-15678
CVE-2026-15678MEDIUM
code-projects Online Job Portal DetailJob.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-114374
CVE-2026-114374MEDIUM
leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
33RISK
open ↗
Referência
CVE-2018-15687
CVE-2018-15687HIGH
systemd: chown_one() can dereference symlinks
41RISK
open ↗
Referência
CVE-2026-15699
CVE-2026-15699MEDIUM
spencermountain compromise Public Root API extend.js nlp.extend prototype pollution
33RISK
open ↗
Referência
CVE-2026-58477
CVE-2026-58477HIGH
Sustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP Parameters
41RISK
open ↗
Referência
CVE-2021-36260
CVE-2021-36260CRITICALunder attack
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,
100RISK
open ↗
Referência
CVE-2026-81424
CVE-2026-81424MEDIUM
Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR
33RISK
open ↗
Referência
CVE-2026-13580
CVE-2026-13580HIGH
Edimax EW-7478APC POST Request formQoS buffer overflow
41RISK
open ↗
Referência
CVE-2026-13544
CVE-2026-13544MEDIUM
Feehi CMS API users access control
33RISK
open ↗
Referência
CVE-2026-11883
CVE-2026-11883HIGH
WebAuthn Provider for Two Factor < 2.5.6 - 2FA Bypass
41RISK
open ↗
Referência
CVE-2026-11880
CVE-2026-11880LOW
Fluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDOR
28RISK
open ↗
Referência
CVE-2026-58172
CVE-2026-58172CRITICAL
Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests
48RISK
open ↗
Referência
CVE-2026-58166
CVE-2026-58166HIGH
OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete
41RISK
open ↗
Referência
CVE-2026-58116
CVE-2026-58116CRITICAL
LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path
48RISK
open ↗
Referência✓ VexDay Proof
crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow
CVE-2006-1236—remotelinux
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrar
28RISK
open ↗
Referência
CVE-2020-37236
CVE-2020-37236MEDIUM
NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel
33RISK
open ↗
Referência
CVE-2020-37235
CVE-2020-37235MEDIUM
WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component
33RISK
open ↗
Referência
CVE-2025-12669
CVE-2025-12669MEDIUM
Improper Control of Generation of Code ('Code Injection') in GitLab
33RISK
open ↗
Referência
CVE-2025-13874
CVE-2025-13874MEDIUM
Authorization Bypass Through User-Controlled Key in GitLab
33RISK
open ↗
Referência
CVE-2025-14869
CVE-2025-14869HIGH
Improper Validation of Specified Quantity in Input in GitLab
41RISK
open ↗
Referência
CVE-2025-14870
CVE-2025-14870HIGH
Allocation of Resources Without Limits or Throttling in GitLab
41RISK
open ↗
Referência
CVE-2026-3607
CVE-2026-3607MEDIUM
Access Control Check Implemented After Asset is Accessed in GitLab
33RISK
open ↗
Referência
CVE-2020-37234
CVE-2020-37234MEDIUM
Internet Download Manager 6.38.12 Scheduler Buffer Overflow
33RISK
open ↗
Referência
CVE-2020-37233
CVE-2020-37233MEDIUM
WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting
33RISK
open ↗
Referência
CVE-2020-37230
CVE-2020-37230HIGH
Syncplify.me Server! 5.0.37 Unquoted Service Path Privilege Escalation
41RISK
open ↗
Referência
CVE-2020-37229
CVE-2020-37229HIGH
OKI sPSV Port Manager 1.0.41 Unquoted Service Path Privilege Escalation
41RISK
open ↗
← previouspage 328 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.