Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,058cataloged exploits
35,300CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecentpopularrisk
22,175 exploits
Referência
CVE-2026-11351
ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure
33RISK
open ↗Referência
CVE-2026-54653
`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
41RISK
open ↗Referência
CVE-2026-55391
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
41RISK
open ↗Referência
CVE-2026-66731
facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS
41RISK
open ↗Referência
CVE-2026-66730
facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser
41RISK
open ↗Referência
CVE-2026-66729
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
41RISK
open ↗Referência
CVE-2026-13493
AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection
28RISK
open ↗Referência
CVE-2026-13491
78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service
33RISK
open ↗Referência
CVE-2026-13489
78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization
28RISK
open ↗Referência
CVE-2026-13488
SourceCodester Class and Exam Timetabling System preview7.php sql injection
33RISK
open ↗Referência
CVE-2026-13487
SourceCodester Class and Exam Timetabling System archive.php sql injection
33RISK
open ↗Referência
CVE-2026-11437
perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery
33RISK
open ↗Referência
CVE-2026-11408
vertex-app vertex Log Viewer Endpoint LogMod.js os command injection
33RISK
open ↗Referência
CVE-2026-11338
SourceCodester Ship Ferry Ticket Reservation System manage_user cross site scripting
33RISK
open ↗Referência
CVE-2026-11337
tittuvarghese CollegeManagementSystem fetch.php cross site scripting
33RISK
open ↗Referência
CVE-2026-11336
tittuvarghese CollegeManagementSystem Admin admin_page.php improper authorization
33RISK
open ↗Referência
CVE-2026-11335
tittuvarghese CollegeManagementSystem login-form.php session_start session fixiation
33RISK
open ↗Referência
CVE-2004-1722
SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗Referência
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗Referência
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.