Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2015-2275
CVE-2015-2275—
Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to i
23RISK
open ↗
Referência
CVE-2026-105998
CVE-2026-105998MEDIUM
Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization
33RISK
open ↗
Referência
CVE-2015-2994
CVE-2015-2994—
Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators t
50RISK
open ↗
Referência
CVE-2026-77934
CVE-2026-77934HIGH
Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner
41RISK
open ↗
Referência
CVE-2026-77933
CVE-2026-77933CRITICAL
DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment
48RISK
open ↗
Referência
CVE-2026-77932
CVE-2026-77932CRITICAL
DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent
48RISK
open ↗
Referência
CVE-2026-77930
CVE-2026-77930CRITICAL
EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents
48RISK
open ↗
Referência
CVE-2026-112195
CVE-2026-112195MEDIUM
FusionPBX Dialplan Editor dialplan.php os command injection
33RISK
open ↗
Referência
CVE-2026-112193
CVE-2026-112193MEDIUM
Webkul Aureus ERP UserForm.php weak password
33RISK
open ↗
Referência
CVE-2026-96904
CVE-2026-96904MEDIUM
AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page
33RISK
open ↗
Referência
CVE-2015-5287
CVE-2015-5287HIGHunder attack
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain perm
86RISK
open ↗
Referência
CVE-2026-110657
CVE-2026-110657MEDIUM
Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label
33RISK
open ↗
Referência
CVE-2026-101301
CVE-2026-101301MEDIUM
WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass
33RISK
open ↗
Referência
CVE-2015-6152
CVE-2015-6152—
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory co
35RISK
open ↗
Referência
CVE-2026-108672
CVE-2026-108672MEDIUM
JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser
33RISK
open ↗
Referência
CVE-2026-112057
CVE-2026-112057MEDIUM
libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
33RISK
open ↗
Referência
CVE-2026-108670
CVE-2026-108670MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment
33RISK
open ↗
Referência
CVE-2026-112052
CVE-2026-112052MEDIUM
libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing
33RISK
open ↗
Referência
CVE-2026-112062
CVE-2026-112062MEDIUM
lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
33RISK
open ↗
Referência
CVE-2026-112018
CVE-2026-112018HIGH
cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
41RISK
open ↗
Referência
CVE-2026-97394
CVE-2026-97394HIGH
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
41RISK
open ↗
Referência
CVE-2026-110031
CVE-2026-110031HIGH
Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key
41RISK
open ↗
Referência
CVE-2026-110026
CVE-2026-110026MEDIUM
Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion
33RISK
open ↗
Referência
CVE-2026-109937
CVE-2026-109937MEDIUM
Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block
33RISK
open ↗
Referência
CVE-2026-108708
CVE-2026-108708HIGH
Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil
41RISK
open ↗
Referência
CVE-2026-108674
CVE-2026-108674MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById
33RISK
open ↗
Referência
CVE-2026-87844
CVE-2026-87844MEDIUM
Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection
33RISK
open ↗
Referência
CVE-2026-111875
CVE-2026-111875MEDIUM
David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization
33RISK
open ↗
Referência
CVE-2026-103043
CVE-2026-103043HIGH
anchorme through 3.0.8 Regular Expression Denial of Service
41RISK
open ↗
Referência
CVE-2026-96532
CVE-2026-96532HIGH
Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update
41RISK
open ↗
← previouspage 579 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.