Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência✓ VexDay Proof
Ay System CMS 2.6 - 'main.php' Remote File Inclusion
PHP remote file inclusion vulnerability in main.php in Ay System Solutions CMS 2.6 and earlier allows remote attackers t
23RISK
open ↗Referência
CVE-2026-93984
OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret
33RISK
open ↗Referência✓ VexDay Proof
phpGroupWare 0.9.16.010 - 'GLOBALS[]' Remote Code Execution
Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allow
23RISK
open ↗Referência✓ VexDay Proof
Nokia Symbian 60 3rd Edition - Browser Crash (Denial of Service)
The Nokia Browser, possibly Nokia Symbian 60 Browser 3rd edition, allows remote attackers to cause a denial of service (
23RISK
open ↗Referência
CVE-2026-7006
Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanism
41RISK
open ↗Referência
CVE-2026-19364
itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injection
33RISK
open ↗Referência
CVE-2026-19352
mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery
28RISK
open ↗Referência
CVE-2026-19351
dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection
33RISK
open ↗Referência
CVE-2026-17459
perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink
33RISK
open ↗Referência
CVE-2026-17458
mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery
33RISK
open ↗Referência
CVE-2026-88997
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
33RISK
open ↗Referência
CVE-2026-91016
Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure
33RISK
open ↗Referência
CVE-2026-91015
Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired
33RISK
open ↗Referência
CVE-2026-88904
PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation
41RISK
open ↗Referência
CVE-2026-87786
Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates
41RISK
open ↗Referência
CVE-2026-114256
oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection
33RISK
open ↗Referência
CVE-2026-114255
oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection
33RISK
open ↗Referência
CVE-2026-114254
oretnom23 file-management-system-php admin_class.php login sql injection
33RISK
open ↗Referência
CVE-2026-114253
oretnom23 file-management-system-php index.php include file inclusion
33RISK
open ↗Referência
CVE-2026-114252
itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection
33RISK
open ↗Referência
CVE-2026-114251
itsourcecode Sales-and-Inventory-System cust_del.php sql injection
33RISK
open ↗Referência
CVE-2026-114250
itsourcecode Sales-and-Inventory-System cust_edit.php sql injection
33RISK
open ↗Referência
CVE-2026-108791
westboy CicadasCMS Template Management input TemplateController.input path traversal
33RISK
open ↗Referência
CVE-2026-108790
westboy CicadasCMS Backend Template Editor save TemplateController.save path traversal
33RISK
open ↗Referência
CVE-2026-108789
deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.