Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-107774
Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form
33RISK
open ↗Referência
CVE-2026-86442
WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR
41RISK
open ↗Referência
CVE-2026-103090
Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
41RISK
open ↗Referência
CVE-2026-85570
Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure
33RISK
open ↗Referência
CVE-2026-85351
FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import
33RISK
open ↗Referência
CVE-2026-122028
NST Labs Tech Nstbrowser Local Agent API info information disclosure
33RISK
open ↗Referência
CVE-2026-54381
VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure
41RISK
open ↗Referência
CVE-2026-122020
NST Labs Tech Nstbrowser Local Agent Management Service stopAll stopAllBrowsers denial of service
33RISK
open ↗Referência
CVE-2026-54373
VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config
33RISK
open ↗Referência
CVE-2026-121607
Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection
48RISK
open ↗Referência
CVE-2026-121599
TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow
48RISK
open ↗Referência
CVE-2026-121598
TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow
48RISK
open ↗Referência
CVE-2026-121509
Headless CMS Plugin REST API post get_required_post_data information disclosure
33RISK
open ↗Referência
CVE-2026-121501
mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation
33RISK
open ↗Referência
CVE-2026-121263
phpMyAdmin MoTranslator Loader.php getTranslator path traversal
33RISK
open ↗Referência✓ VexDay Proof
e107 - 'include()' Remote File Upload
ImageManager in e107 before 0.617 does not properly check the types of uploaded files, which allows remote attackers to
28RISK
open ↗Referência
CVE-2026-116254
rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation
33RISK
open ↗Referência
CVE-2026-108678
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles
33RISK
open ↗Referência
CVE-2026-108623
JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch
41RISK
open ↗Referência
CVE-2026-104651
Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.