Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,496cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,487GitHub PoC 17,245VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleihigh
Tautulli <= 2.16.1 - Path Traversal
Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint
36RISK
open ↗Nucleimedium
Uptime-Kuma < v1.23.0 - Improper Access Control
Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page
28RISK
open ↗Nucleihigh
Kan <= 0.5.4 - Server-Side Request Forgery
Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint
56RISK
open ↗Nucleicritical
Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler
WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
63RISK
open ↗Nucleimedium
Webnus Inc. Modern Events Calendar - Broken Access Control
WordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerability
28RISK
open ↗Nucleihigh
dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-u
36RISK
open ↗Nucleicritical
Breeze <= 2.4.4 - Arbitrary File Upload
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
63RISK
open ↗Nucleicritical
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
68RISK
open ↗Nucleicritical
ChurchCRM - API Authentication Bypass via URL Injection
ChurchCRM has an API Authentication Bypass
43RISK
open ↗Nucleimedium
Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal
Frappe has an Arbitrary File Read via Path Traversal in render_include
36RISK
open ↗Nucleihigh
Vite Dev Server - Directory Traversal
Vite has a `server.fs.deny` bypass with queries
36RISK
open ↗Nucleimedium
Vite Dev Server - Path Traversal in Optimized Deps .map Handling
Vite has a Path Traversal in Optimized Deps `.map` Handling
28RISK
open ↗Nucleihigh
Meta Box <= 5.11.1 - Arbitrary File Deletion
WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability
28RISK
open ↗Nucleicritical
Fortinet FortiSandbox - Command Injection
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
100RISK
open ↗Nucleimedium
XWiki - Cross-Site Scripting
XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality
28RISK
open ↗Nucleimedium
PraisonAI AgentOS - Information Disclosure
PraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS
28RISK
open ↗Nucleihigh
Gravity SMTP WordPress Plugin - Sensitive Information Exposure
Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
56RISK
open ↗Nucleihigh
LiteLLM < 1.25.0 - Remote Code Execution
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/t
56RISK
open ↗Nucleihigh
Arcane <= 1.17.2 - Server-Side Request Forgery
Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
36RISK
open ↗Nucleicritical
Gotenberg <= 8.30.1 - Server Side Request Forgery
Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists
36RISK
open ↗Nucleicritical
Gotenberg <= 8.30.1 - Remote Code Execution
Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
43RISK
open ↗Nucleihigh
My Calendar WordPress Plugin - Information Disclosure
My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog
36RISK
open ↗Nucleihigh
Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI
36RISK
open ↗Nucleihigh
Geo Mashup <= 1.13.18 - SQL Injection
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter
56RISK
open ↗Nucleilow
Mailcow < 2026-03b - Href Link Injection
mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping
23RISK
open ↗Nucleicritical
Vendure Core - SQL Injection
@vendure/core has a SQL Injection vulnerability
43RISK
open ↗Nucleicritical
Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution
Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter
63RISK
open ↗Nucleihigh
HT Mega < 3.0.7 - Sensitive Information Disclosure
HT Mega < 3.0.7 – Unauthenticated PII Disclosure
48RISK
open ↗Nucleicritical
Rclone RC - Broken Access Control
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
43RISK
open ↗Nucleicritical
RClone RC - Command Injection
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
63RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.