Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-9677
Shariff for WordPress <= 1.0.11 - Admin+ Stored Cross-Site Scripting
33RISK
open ↗Referência
CVE-2026-19957
graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgery
33RISK
open ↗Referência
CVE-2026-19965
automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy
33RISK
open ↗Referência
CVE-2026-34103
Guardian Language-System SQL Injection via id Parameter in subtitles.php
41RISK
open ↗Referência
CVE-2026-58126
PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service
48RISK
open ↗Referência
CVE-2026-19714
Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience Validation
48RISK
open ↗Referência
CVE-2026-19825
SourceCodester Simple Client Management System Master.php save_service sql injection
33RISK
open ↗Referência
CVE-2026-14628
NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal
33RISK
open ↗Referência
CVE-2026-19929
OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engine
33RISK
open ↗Referência✓ VexDay Proof
Linux Kernel 2.6.21.1 - IPv6 Jumbo Bug Remote Denial of Service
The Linux kernel 2.6.20 through 2.6.21.1 allows remote attackers to cause a denial of service (panic) via a certain IPv6
28RISK
open ↗Referência✓ VexDay Proof
PHP-RESIDENCE 0.7.2 - 'Search' SQL Injection
SQL injection vulnerability in visualizza_tabelle.php in php-residence 0.7.2 and 1.0 allows remote attackers to execute
23RISK
open ↗Referência
CVE-2013-7409
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possib
50RISK
open ↗Referência
CVE-2017-6086
Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.1
23RISK
open ↗Referência
CVE-2018-10259
An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged u
23RISK
open ↗Referência
CVE-2016-4655
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
90RISK
open ↗Referência
CVE-2026-7746
SourceCodester Web-based Pharmacy Product Management System edit-admin.php sql injection
33RISK
open ↗Referência
CVE-2017-7310
A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9
50RISK
open ↗Referência
CVE-2026-10156
Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumption
33RISK
open ↗Referência
CVE-2026-9438
yashpokharna2555 StudentManagementSystem courseDel.php resource injection
33RISK
open ↗Referência
CVE-2026-66729
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.