Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-15239
Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key
33RISK
open ↗Referência
CVE-2026-14224
Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR
33RISK
open ↗Referência
CVE-2026-11767
CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form
41RISK
open ↗Referência
CVE-2026-63767
ktransformers Unauthenticated Pickle Deserialization RCE via ZMQ
48RISK
open ↗Referência
CVE-2026-63768
cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
33RISK
open ↗Referência
CVE-2019-15637
Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to informat
46RISK
open ↗Referência
CVE-2019-15742
A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application
38RISK
open ↗Referência
CVE-2026-82485
itsourcecode Sales and Inventory System pro_edit.php sql injection
33RISK
open ↗Referência
CVE-2026-14835
SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox
33RISK
open ↗Referência
CVE-2026-10820
ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR
41RISK
open ↗Referência
CVE-2016-20085
Realtek High Definition Audio Driver 6.0.1.6730 Privilege Escalation
41RISK
open ↗Referência
Savsoft Quiz 5 - Stored Cross-Site Scripting
TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the X
23RISK
open ↗Referência
CVE-2026-97315
Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email
33RISK
open ↗Referência
CVE-2026-88998
Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN
33RISK
open ↗Referência
CVE-2026-87974
Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook
33RISK
open ↗Referência
CVE-2026-12982
Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery
33RISK
open ↗Referência
CVE-2026-18038
nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure
33RISK
open ↗Referência
CVE-2026-14870
Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id
56RISK
open ↗Referência
CVE-2026-14545
TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
48RISK
open ↗Referência
CVE-2003-0264
Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO arg
60RISK
open ↗Referência
CVE-2026-15038
InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
48RISK
open ↗Referência
CVE-2018-19913
DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
23RISK
open ↗Referência
Zhiyuan OA - arbitrary file upload leading
Seeyon Zhiyuan OA System Path Traversal File Upload
68RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.