Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,287cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,490GitHub PoC 18,551exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,309 exploits
initial-access
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RISK
initial-access
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
68RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
info-leak
Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers
56RISK
initial-access
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
info-leak
Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure
68RISK
initial-access
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
initial-access
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2
98RISK
initial-access
Time Based SQL Injection in Zabbix Server Audit Log
70RISK
info-leak
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RISK
local
The Ancillary Function Driver (AFD) in afd.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vis
23RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
initial-access
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
100RISK
initial-access
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
100RISK
local
crypto: algif_aead - Revert to operating out-of-place
100RISK
info-leak
Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers
56RISK
initial-access
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
initial-access
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.