Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-16125
CVE-2026-16125MEDIUM
zevorn rt-claw http_request net.c claw_net_post server-side request forgery
33RISK
open ↗
Referência
CVE-2022-2846
CVE-2022-2846MEDIUM
Calendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSS
33RISK
open ↗
Referência
CVE-2026-90826
CVE-2026-90826LOW
GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds
28RISK
open ↗
Referência
CVE-2026-90825
CVE-2026-90825MEDIUM
GPAC MP4Box base_scenegraph.c gf_node_unregister use after free
33RISK
open ↗
Referência
CVE-2026-14750
CVE-2026-14750MEDIUM
mjperpinosa stumasy accessing_dictionary_authorization.php accessing_dictionary_authorization sql injection
33RISK
open ↗
Referência
CVE-2026-14719
CVE-2026-14719MEDIUM
SourceCodester Onlne Examination & Learning Management System Registration Endpoint register.php privileges management
33RISK
open ↗
Referência
CVE-2026-14568
CVE-2026-14568MEDIUM
WP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment Deletion
33RISK
open ↗
Referência
CVE-2026-77116
CVE-2026-77116MEDIUM
Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview
33RISK
open ↗
Referência
CVE-2026-76591
CVE-2026-76591MEDIUM
TRENDnet TEW-755AP ssi email.cgi log_email_server command injection
33RISK
open ↗
Referência✓ VexDay Proof
LeadTools Raster Variant - 'LTRVR14e.dll' Remote File Overwrite
CVE-2007-2851—remotewindows
A certain ActiveX control in LeadTools Raster Variant Object Library (LTRVR14e.dll) 14.5.0.44 allows remote attackers to
23RISK
open ↗
Referência
CVE-2026-13736
CVE-2026-13736MEDIUM
NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API
33RISK
open ↗
Referência
CVE-2026-67182
CVE-2026-67182MEDIUM
Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection
33RISK
open ↗
Referência
CVE-2026-77392
CVE-2026-77392MEDIUM
SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection
33RISK
open ↗
Referência
CVE-2026-63097
CVE-2026-63097MEDIUM
Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure
33RISK
open ↗
Referência
CVE-2026-15253
CVE-2026-15253MEDIUM
Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title
33RISK
open ↗
Referência
CVE-2026-14826
CVE-2026-14826LOW
Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR
28RISK
open ↗
Referência
CVE-2026-14825
CVE-2026-14825LOW
Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR
28RISK
open ↗
Referência
CVE-2014-8682
CVE-2014-8682—
Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow r
50RISK
open ↗
Referência
CVE-2026-76886
CVE-2026-76886HIGH
Heap-based Buffer Overflow in Wireshark
41RISK
open ↗
Referência
CVE-2017-8849
CVE-2017-8849—
smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount hel
23RISK
open ↗
Referência
CVE-2026-12271
CVE-2026-12271MEDIUM
Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR
33RISK
open ↗
Referência
CVE-2026-15618
CVE-2026-15618MEDIUM
mosaxiv clawlet exec Safety Guard tool_exec.go guardExecCommand protection mechanism
33RISK
open ↗
Referência
CVE-2026-15528
CVE-2026-15528MEDIUM
lamaalrajih kicad-mcp path_validator.py protection mechanism
33RISK
open ↗
Referência
CVE-2026-101075
CVE-2026-101075CRITICAL
Netcore NR289-GE Location Time location_time.cgi system os command injection
48RISK
open ↗
Referência
CVE-2026-14778
CVE-2026-14778MEDIUM
SourceCodester Onlne Examination & Learning Management System Enrollment Management ajax_enroll.php improper authorization
33RISK
open ↗
Referência
CVE-2026-74842
CVE-2026-74842MEDIUM
Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery
33RISK
open ↗
Referência✓ VexDay Proof
DESlock+ < 3.2.6 - 'DLMFDISK.sy's Local kernel Ring0 SYSTEM
CVE-2008-1140—localwindows
DLMFDISK.sys 1.2.0.27 in DESlock+ 3.2.6 and earlier allows local users to gain privileges via a certain DLKFDISK_IOCTL r
23RISK
open ↗
Referência
CVE-2026-15376
CVE-2026-15376MEDIUM
Eleveo Call Recording Software statisticReportAction.do improper authorization
33RISK
open ↗
Referência
CVE-2026-14237
CVE-2026-14237HIGH
Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation
41RISK
open ↗
Referência
CVE-2026-17023
CVE-2026-17023MEDIUM
Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback
33RISK
open ↗
← previouspage 526 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.