Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-18990
letta-ai LettaBot API Status Route server.ts missing authentication
33RISK
open ↗Referência
CVE-2026-11319
TickTick Android 8.2.2.0 Path Traversal via ShareReceiveActivity
33RISK
open ↗Referência
CVE-2026-97227
NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion
33RISK
open ↗Referência
CVE-2026-92436
Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR
33RISK
open ↗Referência
CVE-2026-73033
Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php
41RISK
open ↗Referência
CVE-2026-18962
WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization
33RISK
open ↗Referência
CVE-2026-89006
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import
33RISK
open ↗Referência
CVE-2026-19212
WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable
33RISK
open ↗Referência
CVE-2026-18980
nearai ironclaw shell.rs classify_command_risk command injection
33RISK
open ↗Referência
CVE-2026-112247
Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting
33RISK
open ↗Referência
CVE-2026-100746
coollabsio Coolify GitHub App Setup redirect missing authentication
33RISK
open ↗Referência
CVE-2015-2216
SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to exec
23RISK
open ↗Referência
CVE-2015-2223
Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks
23RISK
open ↗Referência
CVE-2015-2275
Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to i
23RISK
open ↗Referência
CVE-2026-14238
Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report
33RISK
open ↗Referência
CVE-2026-112190
Webkul Aureus ERP composer.json insertion of sensitive information into debugging code
33RISK
open ↗Referência
CVE-2026-89271
WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile
33RISK
open ↗Referência
CVE-2026-84167
Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR
33RISK
open ↗Referência
CVE-2026-108799
jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection
33RISK
open ↗Referência
CVE-2026-108891
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId
33RISK
open ↗Referência
CVE-2026-108888
JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls
33RISK
open ↗Referência
CVE-2026-85118
AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion
48RISK
open ↗Referência
CVE-2026-84261
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.