Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-86163
itsourcecode Sales and Inventory System pro_del.php sql injection
33RISK
open ↗Referência
CVE-2026-110661
CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header
33RISK
open ↗Referência
CVE-2026-109188
jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints
33RISK
open ↗Referência
CVE-2026-108886
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername
33RISK
open ↗Referência
CVE-2026-88930
Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret
41RISK
open ↗Referência
CVE-2026-84251
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update
48RISK
open ↗Referência
CVE-2026-105284
Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization
48RISK
open ↗Referência
CVE-2026-78371
File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure
33RISK
open ↗Referência
CVE-2026-13718
Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content
33RISK
open ↗Referência
CVE-2026-90988
Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum
33RISK
open ↗Referência
CVE-2026-104123
SourceCodester Online Reviewer Management System btn_functions.php activity sql injection
33RISK
open ↗Referência
CVE-2026-105246
SourceCodester Online Reviewer Management System btn_functions.php update sql injection
33RISK
open ↗Referência
CVE-2026-103090
Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
41RISK
open ↗Referência
CVE-2026-103323
Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure
33RISK
open ↗Referência
CVE-2026-103229
AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection
33RISK
open ↗Referência
CVE-2026-108678
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles
33RISK
open ↗Referência
CVE-2026-108623
JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch
41RISK
open ↗Referência
CVE-2026-104651
Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR
33RISK
open ↗Referência
CVE-2013-20009
Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter
33RISK
open ↗Referência
CVE-2026-116471
BKWLD Decoy Authorization Policy Policy.php privileges management
33RISK
open ↗Referência
CVE-2026-116385
Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting
33RISK
open ↗Referência
CVE-2026-116370
2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion
33RISK
open ↗Referência
CVE-2026-106002
Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion
33RISK
open ↗Referência
CVE-2026-105997
Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient
33RISK
open ↗Referência
CVE-2026-116384
Bdtask Garage 24 Garage Management Software Backend improper authorization
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.