Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,287cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,490GitHub PoC 18,551exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,309 exploits
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
initial-access
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
75RISK
initial-access
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
info-leak
LiteLLM: SQL injection in Proxy API key verification
100RISK
initial-access
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
info-leak
cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source
60RISK
info-leak
Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection
56RISK
initial-access
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
68RISK
initial-access
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra
100RISK
initial-access
PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
78RISK
initial-access
LiteLLM: SQL injection in Proxy API key verification
100RISK
initial-access
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
initial-access
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RISK
client-side
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allow
71RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
info-leak
Kyocera Net View Address Book Exposure
61RISK
initial-access
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
56RISK
client-side
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
initial-access
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RISK
initial-access
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RISK
initial-access
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.