Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,220 exploits
initial-access
CVE-2019-19781CRITICALunder attackransomware21 Dec 2023
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RISK
denial-of-service
CVE-2019-1253HIGHunder attackransomware21 Dec 2023
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To e
76RISK
initial-access
CVE-2018-2628CRITICALunder attack21 Dec 2023
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RISK
client-side
CVE-2020-15999CRITICALunder attack21 Dec 2023
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploi
90RISK
local
CVE-2017-0213HIGHunder attackransomware21 Dec 2023
Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Ser
93RISK
local
CVE-2018-19320HIGHunder attackransomware21 Dec 2023
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING
71RISK
initial-access
CVE-2021-43798HIGHunder attack21 Dec 2023
Grafana path traversal
100RISK
initial-access
CVE-2018-2628CRITICALunder attack21 Dec 2023
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RISK
initial-access
CVE-2021-24499—21 Dec 2023
Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution
50RISK
initial-access
CVE-2020-9496—21 Dec 2023
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
60RISK
info-leak
CVE-2021-43798HIGHunder attack21 Dec 2023
Grafana path traversal
100RISK
initial-access
CVE-2020-14882CRITICALunder attack21 Dec 2023
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
remote-with-credentials
CVE-2021-26828HIGHunder attack21 Dec 2023
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe
83RISK
initial-access
CVE-2020-14882CRITICALunder attack21 Dec 2023
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
initial-access
CVE-2021-26084CRITICALunder attackransomware21 Dec 2023
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RISK
infoleak
CVE-2021-43798HIGHunder attack21 Dec 2023
Grafana path traversal
100RISK
initial-access
CVE-2019-19781CRITICALunder attackransomware21 Dec 2023
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RISK
infoleak
CVE-2021-43798HIGHunder attack21 Dec 2023
Grafana path traversal
100RISK
initial-access
CVE-2018-15961CRITICALunder attack21 Dec 2023
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
100RISK
initial-access
CVE-2021-41773HIGHunder attackransomware21 Dec 2023
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
initial-access
CVE-2020-14644CRITICALunder attack21 Dec 2023
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions th
100RISK
info-leak
CVE-2020-1938CRITICALunder attack21 Dec 2023
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RISK
infoleak
CVE-2001-0680—21 Dec 2023
Directory traversal vulnerability in ftpd in QPC QVT/Net 4.0 and AVT/Term 5.0 allows a remote attacker to traverse direc
23RISK
initial-access
CVE-2022-1388CRITICALunder attackransomware21 Dec 2023
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
client-side
CVE-2017-0199HIGHunder attackransomware21 Dec 2023
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window
100RISK
initial-access
CVE-2018-20250HIGHunder attackransomware21 Dec 2023
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
initial-access
CVE-2020-1472MEDIUMunder attackransomware21 Dec 2023
Netlogon Elevation of Privilege Vulnerability
100RISK
local
CVE-2021-4034HIGHunder attackransomware21 Dec 2023
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
client-side
CVE-2021-40444HIGHunder attackransomware21 Dec 2023
Microsoft MSHTML Remote Code Execution Vulnerability
100RISK
local
CVE-2022-21882HIGHunder attackransomware21 Dec 2023
Win32k Elevation of Privilege Vulnerability
98RISK
← previouspage 650 / 2,974next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.