Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-111147
CVE-2026-111147MEDIUM
Libyal libesedb through 20260704 Heap Out-of-Bounds Read via libesedb_record_get_multi_value
33RISK
open ↗
Referência
CVE-2026-110867
CVE-2026-110867CRITICAL
Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
48RISK
open ↗
Referência
CVE-2026-110689
CVE-2026-110689MEDIUM
OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism
33RISK
open ↗
Referência
CVE-2026-108635
CVE-2026-108635MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint
33RISK
open ↗
Referência
CVE-2026-108626
CVE-2026-108626MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint
33RISK
open ↗
Referência
CVE-2019-4716
CVE-2019-4716CRITICALunder attack
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use
100RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência
CVE-2026-92764
CVE-2026-92764MEDIUM
OpenCVE 2.4.0 < 3.1.0 Organization API Ignores Token Scope
33RISK
open ↗
Referência
CVE-2026-85569
CVE-2026-85569HIGH
Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification
41RISK
open ↗
Referência
CVE-2026-85530
CVE-2026-85530HIGH
GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch
41RISK
open ↗
Referência
CVE-2026-85131
CVE-2026-85131MEDIUM
WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF
33RISK
open ↗
Referência
CVE-2026-105989
CVE-2026-105989MEDIUM
Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery
33RISK
open ↗
Referência
CVE-2026-105977
CVE-2026-105977LOW
Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail
28RISK
open ↗
Referência
CVE-2026-105976
CVE-2026-105976MEDIUM
Portfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX Actions
33RISK
open ↗
Referência
CVE-2014-6593
CVE-2014-6593—
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.
50RISK
open ↗
Referência
CVE-2019-11539
CVE-2019-11539HIGHunder attackransomware
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R
100RISK
open ↗
Referência
Kardex Mlog MCC 5.7.12 - RCE (Remote Code Execution)
CVE-2023-22855CRITICALremotewindows
Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 808
53RISK
open ↗
Referência
CVE-2026-91020
CVE-2026-91020MEDIUM
WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount
33RISK
open ↗
Referência
CVE-2023-0962
CVE-2023-0962MEDIUM
SourceCodester Music Gallery Site GET Request Master.php sql injection
33RISK
open ↗
Referência
CVE-2023-2068
CVE-2023-2068—
File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode
50RISK
open ↗
Referência
CVE-2020-7209
CVE-2020-7209—
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
60RISK
open ↗
Referência
CVE-2026-97231
CVE-2026-97231MEDIUM
volotat Anagnorisis Socket.IO Connect app.py missing authentication
33RISK
open ↗
Referência
CVE-2022-0377
CVE-2022-0377—
LearnPress < 4.1.5 - Arbitrary Image Renaming
23RISK
open ↗
Referência
CVE-2026-93508
CVE-2026-93508HIGH
WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX
41RISK
open ↗
Referência✓ VexDay Proof
Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)
CVE-2023-33584CRITICALwebappsphp
Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to
53RISK
open ↗
Referência
CVE-2014-8577
CVE-2014-8577—
Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2019-8928
CVE-2019-8928—
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userMan
23RISK
open ↗
Referência
CVE-2014-8577
CVE-2014-8577—
Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2014-8684
CVE-2014-8684—
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof
60RISK
open ↗
Referência
CVE-2026-47116
CVE-2026-47116CRITICAL
LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH
48RISK
open ↗
← previouspage 861 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.