Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-121930
Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection
48RISK
open ↗Referência
CVE-2026-120454
The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression
33RISK
open ↗Referência
CVE-2026-103310
PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification
33RISK
open ↗Referência
CVE-2026-120349
dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection
33RISK
open ↗Referência
CVE-2026-120345
WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection
48RISK
open ↗Referência
CVE-2026-107342
Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure
33RISK
open ↗Referência
CVE-2026-120198
WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection
48RISK
open ↗Referência
CVE-2026-120197
WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection
48RISK
open ↗Referência
CVE-2026-113617
Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal
48RISK
open ↗Referência
CVE-2026-113616
LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
48RISK
open ↗Referência
CVE-2026-117565
Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch
33RISK
open ↗Referência
CVE-2026-121607
Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection
48RISK
open ↗Referência
CVE-2026-121599
TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow
48RISK
open ↗Referência
CVE-2026-121598
TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow
48RISK
open ↗Referência
CVE-2026-121509
Headless CMS Plugin REST API post get_required_post_data information disclosure
33RISK
open ↗Referência
CVE-2026-121501
mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation
33RISK
open ↗Referência
CVE-2026-121263
phpMyAdmin MoTranslator Loader.php getTranslator path traversal
33RISK
open ↗Referência✓ VexDay Proof
e107 - 'include()' Remote File Upload
ImageManager in e107 before 0.617 does not properly check the types of uploaded files, which allows remote attackers to
28RISK
open ↗Referência
CVE-2026-116254
rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation
33RISK
open ↗Referência
CVE-2026-108678
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles
33RISK
open ↗Referência
CVE-2026-108623
JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch
41RISK
open ↗Referência
CVE-2026-104651
Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR
33RISK
open ↗Referência
CVE-2026-103323
Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure
33RISK
open ↗Referência
CVE-2026-103229
AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.