Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-16620
WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode
41RISK
open ↗Referência✓ VexDay Proof
CoolPlayer 2.17 - '.m3u' Local Stack Overflow
Multiple buffer overflows in Niek Albers CoolPlayer 216 and earlier allow remote attackers to execute arbitrary code via
23RISK
open ↗Referência
CVE-2026-11872
Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item
33RISK
open ↗Referência
CVE-2019-14348
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via
28RISK
open ↗Referência
CVE-2019-2725
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
100RISK
open ↗Referência
CVE-2019-2725
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
100RISK
open ↗Referência
CVE-2020-2038
PAN-OS: OS command injection vulnerability in the management web interface
78RISK
open ↗Referência
CVE-2026-69114
Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass
41RISK
open ↗Referência
CVE-2026-66031
Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field
33RISK
open ↗Referência
CVE-2026-66030
Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field
33RISK
open ↗Referência
CVE-2026-19381
Kingston FURY CTRL RGB Control Software Driver NTIOLib_KSFX.sys privileges management
41RISK
open ↗Referência
CVE-2026-66731
facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS
41RISK
open ↗Referência
CVE-2026-110698
Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write
33RISK
open ↗Referência
CVE-2026-110717
Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename
33RISK
open ↗Referência
CVE-2020-2096
Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a ref
60RISK
open ↗Referência
CVE-2026-82422
itsourcecode Sales and Inventory System emp_del.php sql injection
33RISK
open ↗Referência
CVE-2020-25557
In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. A
23RISK
open ↗Referência
CVE-2026-63770
Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass
41RISK
open ↗Referência
CVE-2026-16947
Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure
48RISK
open ↗Referência
CVE-2026-108954
k2-fsa sherpa-onnx Offline Transducer Greedy Search Decoder offline-transducer-greedy-search-decoder.cc Decode buffer overflow
33RISK
open ↗Referência
CVE-2026-108948
code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes
33RISK
open ↗Referência
CVE-2026-60114
Sustainable Irrigation Platform 5.2.16 Path Traversal via JSON Backup Restore
41RISK
open ↗Referência
CVE-2026-15691
Tenda BE12 Pro SafeClientFilter fromSafeClientFilter stack-based overflow
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.