Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,299 exploits
initial-access
SSH user impersonation possible in Mikrotik RouterOS
48RISK
initial-access
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
info-leak
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
98RISK
initial-access
SSH user impersonation possible in Mikrotik RouterOS
48RISK
initial-access
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
63RISK
remote-with-credentials
Code Injection Vulnerability in Code Validation Endpoint
63RISK
initial-access
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
48RISK
initial-access
XStore < 9.7.3 - Unauthenticated SQLi
56RISK
initial-access
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
100RISK
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
initial-access
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
initial-access
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
63RISK
initial-access
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
63RISK
info-leak
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
initial-access
Potential authentication bypass leading to administrative access in Artifactory
98RISK
initial-access
An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration a
56RISK
initial-access
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RISK
remote-with-credentials
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
100RISK
initial-access
PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
78RISK
initial-access
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISK
local
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
78RISK
initial-access
Potential authentication bypass leading to administrative access in Artifactory
98RISK
initial-access
SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
100RISK
initial-access
Potential authentication bypass leading to administrative access in Artifactory
98RISK
initial-access
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
100RISK
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
initial-access
Potential authentication bypass leading to administrative access in Artifactory
98RISK
initial-access
Langflow code Code Injection Remote Code Execution Vulnerability
68RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.