Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-17458
CVE-2026-17458MEDIUM
mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery
33RISK
open ↗
Referência
CVE-2026-88997
CVE-2026-88997MEDIUM
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
33RISK
open ↗
Referência
CVE-2026-91016
CVE-2026-91016MEDIUM
Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure
33RISK
open ↗
Referência
CVE-2026-91015
CVE-2026-91015MEDIUM
Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired
33RISK
open ↗
Referência
CVE-2026-88904
CVE-2026-88904HIGH
PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation
41RISK
open ↗
Referência
CVE-2026-87786
CVE-2026-87786HIGH
Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates
41RISK
open ↗
Referência
CVE-2026-51773
CVE-2026-51773HIGH
An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker provides a maliciously
41RISK
open ↗
Referência
CVE-2026-114264
CVE-2026-114264MEDIUM
ProjectWorlds Advanced Library Management System edit_member.php sql injection
33RISK
open ↗
Referência
CVE-2026-114263
CVE-2026-114263MEDIUM
ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2026-114262
CVE-2026-114262MEDIUM
file-management-system FileController.php store unrestricted upload
33RISK
open ↗
Referência
CVE-2021-42136
CVE-2021-42136—
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows
23RISK
open ↗
Referência
CVE-2021-42165
CVE-2021-42165—
MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing c
28RISK
open ↗
Referência
CVE-2021-42751
CVE-2021-42751—
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrat
23RISK
open ↗
Referência
CVE-2026-94535
CVE-2026-94535HIGH
lamp-cloud through 5.10.0 Unauthorized Notification Deletion
41RISK
open ↗
Referência
CVE-2026-94211
CVE-2026-94211MEDIUM
Hyve5 Leantime Project Dashboard show.blade.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-96881
CVE-2026-96881MEDIUM
TaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization
33RISK
open ↗
Referência
CVE-2026-96739
CVE-2026-96739MEDIUM
SEMCMS KindEditor Upload upload_json.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-89078
CVE-2026-89078CRITICAL
Double Free in GitLab
48RISK
open ↗
Referência
CVE-2026-93577
CVE-2026-93577CRITICAL
Integer Overflow or Wraparound in GitLab
48RISK
open ↗
Referência
CVE-2026-96678
CVE-2026-96678MEDIUM
weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal
33RISK
open ↗
Referência
CVE-2026-96552
CVE-2026-96552LOW
sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt
28RISK
open ↗
Referência
CVE-2026-94210
CVE-2026-94210MEDIUM
Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting
33RISK
open ↗
Referência
CVE-2026-92400
CVE-2026-92400MEDIUM
Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment Confusion
33RISK
open ↗
Referência
CVE-2026-96551
CVE-2026-96551MEDIUM
sfturing hosp_order CommonUserController.java cross-site request forgery
33RISK
open ↗
Referência
CVE-2026-96549
CVE-2026-96549MEDIUM
sfturing hosp_order CommonUserServiceImpl.java cleartext storage
33RISK
open ↗
Referência
CVE-2026-15255
CVE-2026-15255MEDIUM
RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2026-14189
CVE-2026-14189LOW
WPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fields
28RISK
open ↗
Referência
CVE-2026-16327
CVE-2026-16327MEDIUM
D-Link DNS-320 upload.php unrestricted upload
33RISK
open ↗
Referência
CVE-2026-12724
CVE-2026-12724MEDIUM
Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password
33RISK
open ↗
Referência
CVE-2026-11371
CVE-2026-11371MEDIUM
BetterDocs < 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection
33RISK
open ↗
← previouspage 865 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.