Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-77878
Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API
41RISK
open ↗Referência
CVE-2026-77877
Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access
41RISK
open ↗Referência
CVE-2026-89269
WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode
33RISK
open ↗Referência
CVE-2026-109173
yshop-crm through 2.1.3 Missing Authorization via invoice check endpoint
33RISK
open ↗Referência
CVE-2026-108820
agno-agi agno Delegation Feature _default_tools.py member_agent.run unnecessary privileges
33RISK
open ↗Referência
CVE-2026-108869
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement
33RISK
open ↗Referência
CVE-2026-108868
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement
33RISK
open ↗Referência
CVE-2026-108867
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById
33RISK
open ↗Referência
CVE-2026-108866
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths
33RISK
open ↗Referência
CVE-2026-108702
CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test
33RISK
open ↗Referência
CVE-2026-108700
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
41RISK
open ↗Referência
CVE-2026-108692
1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints
41RISK
open ↗Referência
CVE-2026-108691
mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList
33RISK
open ↗Referência
CVE-2026-108690
mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList
33RISK
open ↗Referência
CVE-2026-108689
Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send
33RISK
open ↗Referência
CVE-2026-86609
Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription
41RISK
open ↗Referência
CVE-2026-85002
EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes
33RISK
open ↗Referência
CVE-2026-82841
UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice
33RISK
open ↗Referência
CVE-2026-97871
Zhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection
33RISK
open ↗Referência
CVE-2026-82849
Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR
33RISK
open ↗Referência
CVE-2026-82195
10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion
33RISK
open ↗Referência
CVE-2026-80513
wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields
41RISK
open ↗Referência
CVE-2026-96772
Intelliants Subrion CMS actions.json assign-owner information disclosure
33RISK
open ↗Referência
CVE-2026-75797
AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter
41RISK
open ↗Referência
CVE-2026-74930
WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.