Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-101066
dbgate Archive Link Creation archive.js createLink path traversal
33RISK
open ↗Referência
CVE-2026-101037
FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflow
48RISK
open ↗Referência
CVE-2026-101035
aligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage uncaught exception
33RISK
open ↗Referência
CVE-2026-101016
Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition
33RISK
open ↗Referência
CVE-2026-101011
aaPanel BaoTa Domain domainMod.py get_domain_status sql injection
33RISK
open ↗Referência
CVE-2026-86838
Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation
33RISK
open ↗Referência
CVE-2026-67621
Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints
41RISK
open ↗Referência
CVE-2026-78149
Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post_password Disclosure via sp_handle_post_id
33RISK
open ↗Referência
CVE-2026-19861
JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails
33RISK
open ↗Referência
CVE-2026-85704
ramon-victor freegpt-webui Jailbreak Mode config.py getJailbreak race condition
33RISK
open ↗Referência
CVE-2026-77009
WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console
48RISK
open ↗Referência✓ VexDay Proof
AspWebCalendar 4.5 - 'eventid' SQL Injection
SQL injection vulnerability in aspWebCalendar allows remote attackers to execute arbitrary SQL statements via (1) the us
23RISK
open ↗Referência
CVE-2026-78144
code-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorization
33RISK
open ↗Referência✓ VexDay Proof
aspwebalbum 3.2 - Multiple Vulnerabilities
SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the usern
23RISK
open ↗Referência
CVE-2026-118523
EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override
33RISK
open ↗Referência
CVE-2026-118422
Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path
41RISK
open ↗Referência
CVE-2026-118404
Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR
33RISK
open ↗Referência
CVE-2026-118403
Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure
28RISK
open ↗Referência
CVE-2026-115426
WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting
33RISK
open ↗Referência
CVE-2026-115262
Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore
33RISK
open ↗Referência
CVE-2026-115243
WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files
33RISK
open ↗Referência
CVE-2026-115242
WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path
33RISK
open ↗Referência
CVE-2026-115241
WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.