Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-92883
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RISK
open ↗Referência
CVE-2026-108908
Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting
33RISK
open ↗Referência
CVE-2026-108890
BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization
33RISK
open ↗Referência
CVE-2026-109180
jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs
33RISK
open ↗Referência
CVE-2026-109178
jshERP through 3.6 Missing Authorization via /log Audit Endpoints
33RISK
open ↗Referência
CVE-2026-108883
JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig
41RISK
open ↗Referência
CVE-2026-122188
DeepGraphLearning KnowledgeGraphEmbedding Checkpoint Loading run.py override_config path traversal
30RISK
open ↗Referência
CVE-2026-122160
myshell-ai AIlice HuggingFace Model Wrapper AModelCausalLM.py LoadModel_PEFT inclusion of functionality from untrusted control sphere
30RISK
open ↗Referência
CVE-2026-122159
Edge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.__init__ path traversal
30RISK
open ↗Referência
CVE-2026-122157
Purocean Yank Note Terminal index.ts checkPermission os command injection
30RISK
open ↗Referência
CVE-2026-122154
purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure
30RISK
open ↗Referência
CVE-2026-122151
Presenton User Configuration user-config JSON.parse cross-site request forgery
30RISK
open ↗Referência
CVE-2026-122050
Campcodes Complete Sales and Inventory System with Credit Management login.php sql injection
30RISK
open ↗Referência
CVE-2026-122049
Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication
30RISK
open ↗Referência
CVE-2026-122048
Campcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injection
30RISK
open ↗Referência
CVE-2026-122047
Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted upload
30RISK
open ↗Referência
CVE-2026-122038
krupalshah EmployeeRecruitmentSystem Requirement Board Update reqformprocessing.php mysql_query sql injection
30RISK
open ↗Referência
CVE-2026-54384
VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
45RISK
open ↗Referência
CVE-2026-54383
VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint
38RISK
open ↗Referência
CVE-2026-54382
VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access
30RISK
open ↗Referência
CVE-2026-122028
NST Labs Tech Nstbrowser Local Agent API info information disclosure
30RISK
open ↗Referência
CVE-2026-108067
FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR
28RISK
open ↗Referência
CVE-2026-108041
SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings
41RISK
open ↗Referência
CVE-2026-106649
Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.