Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-108521
CVE-2026-108521MEDIUM
Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery
33RISK
open ↗
Referência
CVE-2026-108677
CVE-2026-108677HIGH
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName
41RISK
open ↗
Referência
CVE-2026-108673
CVE-2026-108673MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls
33RISK
open ↗
Referência
CVE-2026-16619
CVE-2026-16619HIGH
miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts
41RISK
open ↗
Referência
CVE-2014-2579
CVE-2014-2579—
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers
23RISK
open ↗
Referência
CVE-2014-2587
CVE-2014-2587—
SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated user
23RISK
open ↗
Referência✓ VexDay Proof
Barracuda Web Application Firewall - Authentication Bypass
CVE-2014-2595—remotehardware
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a perm
28RISK
open ↗
Referência
CVE-2014-2598
CVE-2014-2598—
Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows
23RISK
open ↗
Referência
CVE-2014-2623
CVE-2014-2623—
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown
60RISK
open ↗
Referência
CVE-2026-18995
CVE-2026-18995MEDIUM
netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure
33RISK
open ↗
Referência
CVE-2026-108664
CVE-2026-108664MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById
33RISK
open ↗
Referência
CVE-2026-108655
CVE-2026-108655MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById
33RISK
open ↗
Referência
CVE-2026-15511
CVE-2026-15511CRITICAL
Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection
48RISK
open ↗
Referência
CVE-2026-16073
CVE-2026-16073MEDIUM
AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting
33RISK
open ↗
Referência
CVE-2026-62239
CVE-2026-62239MEDIUM
FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py
33RISK
open ↗
Referência
CVE-2014-3120
CVE-2014-3120HIGHunder attack
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
100RISK
open ↗
Referência
CVE-2026-14800
CVE-2026-14800MEDIUM
imhamzaazam ecommerceFlask cross-site request forgery
33RISK
open ↗
Referência
CVE-2026-6382
CVE-2026-6382CRITICAL
Multiple elFinder Plugins - Authenticated OS Command Injection
48RISK
open ↗
Referência
CVE-2026-15473
CVE-2026-15473MEDIUM
Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization
33RISK
open ↗
Referência
CVE-2026-14723
CVE-2026-14723MEDIUM
AD-Security AD_Miner Cache analyse_cache.py request_a deserialization
33RISK
open ↗
Referência
CVE-2026-15472
CVE-2026-15472MEDIUM
Eleveo Call Recording Software composeEmailAction.do improper authorization
33RISK
open ↗
Referência
CVE-2018-7602
CVE-2018-7602HIGHunder attackransomware
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
100RISK
open ↗
Referência
CVE-2026-15515
CVE-2026-15515HIGH
Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path
41RISK
open ↗
Referência
CVE-2014-3792
CVE-2014-3792—
Cross-site request forgery (CSRF) vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005_retail allows remote at
23RISK
open ↗
Referência
CVE-2026-87846
CVE-2026-87846MEDIUM
Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion
33RISK
open ↗
Referência
CVE-2026-107640
CVE-2026-107640CRITICAL
Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API
48RISK
open ↗
Referência
CVE-2026-85348
CVE-2026-85348MEDIUM
GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF
33RISK
open ↗
Referência
CVE-2026-94244
CVE-2026-94244MEDIUM
Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export
33RISK
open ↗
Referência
CVE-2026-94501
CVE-2026-94501HIGH
jshERP through 3.6 Privilege Escalation via userBusiness CRUD
41RISK
open ↗
Referência
CVE-2014-3977
CVE-2014-3977—
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
23RISK
open ↗
← previouspage 554 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.