Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,620cataloged exploits
35,647CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,429GitHub PoC 14,270VulnCheck XDB 8,693Nuclei 4,299Metasploit 3,474✓ verified onlyrecentpopularrisk
22,407 exploits
Referência
CVE-2021-47957
WordPress Plugin Cookie Law Bar 1.2.1 Stored XSS via clb_bar_msg
33RISK
open ↗Referência
CVE-2026-3093
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
33RISK
open ↗Referência
CVE-2026-12436
Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab
41RISK
open ↗Referência
CVE-2026-11351
ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure
33RISK
open ↗Referência
CVE-2026-54653
`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
41RISK
open ↗Referência
CVE-2026-55391
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
41RISK
open ↗Referência
CVE-2026-69114
Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass
41RISK
open ↗Referência
CVE-2026-18470
Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response
41RISK
open ↗Referência
CVE-2026-18469
Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force
41RISK
open ↗Referência
CVE-2026-18468
Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header
41RISK
open ↗Referência
CVE-2026-17019
JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)
33RISK
open ↗Referência
CVE-2026-16299
Single Sign On For TNG < 2.2.0 - Unauthenticated Arbitrary Password Reset
48RISK
open ↗Referência
CVE-2026-16298
FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Reset
48RISK
open ↗Referência
CVE-2026-16257
Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling
41RISK
open ↗Referência
CVE-2026-18030
Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms
41RISK
open ↗Referência
CVE-2026-17542
Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector
41RISK
open ↗Referência
CVE-2026-15359
Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite
33RISK
open ↗Referência
CVE-2026-14812
Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection)
48RISK
open ↗Referência
CVE-2020-17519
Apache Flink directory traversal attack: reading remote files through the REST API
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.