Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-105471
girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection
33RISK
open ↗Referência
CVE-2026-97332
User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
33RISK
open ↗Referência
CVE-2026-93549
CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
41RISK
open ↗Referência
CVE-2026-80333
Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes
33RISK
open ↗Referência
CVE-2026-105099
Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting
33RISK
open ↗Referência
CVE-2026-105098
Omega Solution CoinEx Crypto Support Ticket API customer information disclosure
33RISK
open ↗Referência
CVE-2026-104052
itsourcecode Pet Shop Management System admin_reject_completed.php sql injection
33RISK
open ↗Referência
CVE-2026-90705
D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection
33RISK
open ↗Referência
CVE-2026-92399
GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow
33RISK
open ↗Referência
CVE-2025-68624
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user
33RISK
open ↗Referência
CVE-2026-89261
MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
33RISK
open ↗Referência
CVE-2026-84047
Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action
41RISK
open ↗Referência
CVE-2026-108958
TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization
33RISK
open ↗Referência
CVE-2026-108957
TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py _load_text_config code injection
33RISK
open ↗Referência
CVE-2026-108956
code-projects Online Reviewer System User Update btn_functions.php sql injection
33RISK
open ↗Referência
CVE-2026-108955
Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.