Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-103090
CVE-2026-103090HIGH
Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
41RISK
open ↗
Referência
CVE-2026-85570
CVE-2026-85570MEDIUM
Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure
33RISK
open ↗
Referência
CVE-2026-85351
CVE-2026-85351MEDIUM
FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import
33RISK
open ↗
Referência
CVE-2026-122028
CVE-2026-122028MEDIUM
NST Labs Tech Nstbrowser Local Agent API info information disclosure
33RISK
open ↗
Referência
CVE-2026-54381
CVE-2026-54381HIGH
VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure
41RISK
open ↗
Referência
CVE-2026-54380
CVE-2026-54380MEDIUM
VitaFit Cloud API Stored XSS via SVG File Upload
33RISK
open ↗
Referência
CVE-2026-54378
CVE-2026-54378CRITICAL
VitaFit Cloud API Broken Access Control via S3 Token Endpoint
48RISK
open ↗
Referência
CVE-2026-54377
CVE-2026-54377MEDIUM
VitaFit Cloud API IDOR via profile_id Endpoints
33RISK
open ↗
Referência
CVE-2026-54376
CVE-2026-54376HIGH
VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking
41RISK
open ↗
Referência
CVE-2026-122020
CVE-2026-122020MEDIUM
NST Labs Tech Nstbrowser Local Agent Management Service stopAll stopAllBrowsers denial of service
33RISK
open ↗
Referência
CVE-2026-54375
CVE-2026-54375HIGH
VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure
41RISK
open ↗
Referência
CVE-2026-54374
CVE-2026-54374HIGH
VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure
41RISK
open ↗
Referência
CVE-2026-54373
CVE-2026-54373MEDIUM
VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config
33RISK
open ↗
Referência
CVE-2026-54372
CVE-2026-54372HIGH
VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation
41RISK
open ↗
Referência
CVE-2026-118407
CVE-2026-118407MEDIUM
Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover
33RISK
open ↗
Referência
CVE-2026-118404
CVE-2026-118404MEDIUM
Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2026-118403
CVE-2026-118403LOW
Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure
28RISK
open ↗
Referência
CVE-2026-115426
CVE-2026-115426MEDIUM
WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting
33RISK
open ↗
Referência
CVE-2026-115262
CVE-2026-115262MEDIUM
Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore
33RISK
open ↗
Referência
CVE-2026-115257
CVE-2026-115257MEDIUM
WP Roster < 2.36 - Unauthenticated Roster Data Modification
33RISK
open ↗
Referência
CVE-2026-115250
CVE-2026-115250MEDIUM
Text Typing < 2.2.2 - Contributor+ Stored XSS
33RISK
open ↗
Referência
CVE-2026-115243
CVE-2026-115243MEDIUM
WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files
33RISK
open ↗
Referência
CVE-2026-115242
CVE-2026-115242MEDIUM
WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path
33RISK
open ↗
Referência
CVE-2026-114431
CVE-2026-114431MEDIUM
Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload
33RISK
open ↗
Referência
CVE-2026-112244
CVE-2026-112244MEDIUM
Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points
33RISK
open ↗
Referência
CVE-2026-112243
CVE-2026-112243MEDIUM
Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter
33RISK
open ↗
Referência
CVE-2026-111962
CVE-2026-111962LOW
WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export File
28RISK
open ↗
Referência
CVE-2026-111740
CVE-2026-111740LOW
Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure
28RISK
open ↗
Referência
CVE-2026-110964
CVE-2026-110964MEDIUM
Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR
33RISK
open ↗
Referência
CVE-2026-88849
CVE-2026-88849LOW
MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment
28RISK
open ↗
← previouspage 878 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.