Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-18632
CVE-2026-18632MEDIUM
langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine
33RISK
open ↗
Referência
CVE-2026-102842
CVE-2026-102842MEDIUM
gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload
33RISK
open ↗
Referência
CVE-2026-102805
CVE-2026-102805MEDIUM
Nothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow
33RISK
open ↗
Referência
CVE-2019-18935
CVE-2019-18935CRITICALunder attackransomware
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUp
100RISK
open ↗
Referência✓ VexDay Proof
nabopoll 1.2 - Remote Unprotected Admin Section
CVE-2007-0873—webappsphp
nabopoll 1.1.2 allows remote attackers to bypass authentication and access certain administrative functionality via a di
23RISK
open ↗
Referência
CVE-2016-3984
CVE-2016-3984—
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.
23RISK
open ↗
Referência
CVE-2016-8805
CVE-2016-8805—
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3
23RISK
open ↗
Referência
CVE-2017-11870
CVE-2017-11870—
ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the
35RISK
open ↗
Referência
CVE-2026-67217
CVE-2026-67217MEDIUM
cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation
33RISK
open ↗
Referência
CVE-2026-65709
CVE-2026-65709HIGH
sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API
41RISK
open ↗
Referência
CVE-2026-65698
CVE-2026-65698MEDIUM
Void 1.3.4 Path Traversal via AI Agent File-Reading Tools
33RISK
open ↗
Referência✓ VexDay Proof
pafileDB 2.0.1 - 'mxBB'/'phpBB' Remote File Inclusion
CVE-2006-2361—webappsphp
PHP remote file inclusion vulnerability in pafiledb_constants.php in Download Manager (mxBB pafiledb) integration, as us
23RISK
open ↗
Referência
CVE-2026-16733
CVE-2026-16733MEDIUM
bahmutov find-cypress-specs Branch index.js shell.exec os command injection
33RISK
open ↗
Referência
CVE-2026-14235
CVE-2026-14235HIGH
WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key
41RISK
open ↗
Referência
CVE-2014-3738
CVE-2014-3738—
Cross-site scripting (XSS) vulnerability in Zenoss 4.2.5 allows remote attackers to inject arbitrary web script or HTML
23RISK
open ↗
Referência
CVE-2014-3740
CVE-2014-3740—
Cross-site scripting (XSS) vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbi
23RISK
open ↗
Referência
CVE-2017-5594
CVE-2017-5594—
An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the reg
23RISK
open ↗
Referência
CVE-2017-9614
CVE-2017-9614—
The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service
23RISK
open ↗
Referência
CVE-2014-5216
CVE-2014-5216—
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote atta
23RISK
open ↗
Referência
CVE-2026-16244
CVE-2026-16244MEDIUM
itsourcecode Hospital Management System prescriptionorderreport.php sql injection
33RISK
open ↗
Referência
CVE-2026-63308
CVE-2026-63308MEDIUM
Helm Files.Lines Denial of Service via Empty Chart Files
33RISK
open ↗
Referência
CVE-2026-15693
CVE-2026-15693HIGH
Tenda BE12 Pro SafeMacFilter fromSafeMacFilter stack-based overflow
41RISK
open ↗
Referência
CVE-2026-63101
CVE-2026-63101HIGH
Open Event Server 1.19.1 Unauthenticated Member Roster Export via CSV Export Endpoint
41RISK
open ↗
Referência
CVE-2026-15596
CVE-2026-15596MEDIUM
SourceCodester Class and Exam Timetabling System subject.php cross site scripting
33RISK
open ↗
Referência
CVE-2021-44664
CVE-2021-44664—
An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupl
28RISK
open ↗
Referência
CVE-2026-12500
CVE-2026-12500HIGH
WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update
41RISK
open ↗
Referência
CVE-2020-37255
CVE-2020-37255HIGH
WordPress Time Capsule Plugin 1.21.16 Authentication Bypass
41RISK
open ↗
Referência
CVE-2026-39904
CVE-2026-39904HIGH
Gophish 0.12.1 Denial of Service via Office Document Upload
41RISK
open ↗
Referência
CVE-2019-5526
CVE-2019-5526—
VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by t
23RISK
open ↗
Referência✓ VexDay Proof
WebspotBlogging 3.0.1 - 'path' Remote File Inclusion
CVE-2006-2860—webappsphp
PHP remote file inclusion vulnerability in Webspotblogging 3.0.1 allows remote attackers to execute arbitrary PHP code v
28RISK
open ↗
← previouspage 359 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.