Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,299 exploits
exploitation intelligence
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
76RISK
exploitation intelligence
denial-of-service
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside
71RISK
exploitation intelligence
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
76RISK
exploitation intelligence
initial-access
Out-of-Bounds Write in Google Brotli Decoder
70RISK
exploitation intelligence
initial-access
Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
48RISK
exploitation intelligence
denial-of-service
Remote code execution in Wazuh server
100RISK
exploitation intelligence
info-leak
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
75RISK
exploitation intelligence
client-side
Git allows arbitrary code execution through broken config quoting
71RISK
exploitation intelligence
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
exploitation intelligence
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
76RISK
exploitation intelligence
initial-access
Authorization Bypass in Next.js Middleware
85RISK
exploitation intelligence
initial-access
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
100RISK
exploitation intelligence
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
76RISK
exploitation intelligence
info-leak
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISK
exploitation intelligence
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
exploitation intelligence
local
Integer Overflow or Wraparound in Graphics Linux
71RISK
exploitation intelligence
client-side
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside
71RISK
exploitation intelligence
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
76RISK
exploitation intelligence
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
exploitation intelligence
client-side
Microsoft Outlook Spoofing Vulnerability
63RISK
exploitation intelligence
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
76RISK
exploitation intelligence
initial-access
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as
83RISK
exploitation intelligence
initial-access
Craft CMS Allows Remote Code Execution
100RISK
exploitation intelligence
initial-access
C-DATA Web Management System GET Parameter jumpto.php argument injection
45RISK
exploitation intelligence
initial-access
WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability
48RISK
exploitation intelligence
initial-access
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISK
exploitation intelligence
initial-access
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RISK
exploitation intelligence
remote-with-credentials
An issue was discovered in D-Link DIR-816 DIR-816A2_FWv1.10CNB05_R1B011D88210 The HTTP request parameter is used in the
23RISK
exploitation intelligence
initial-access
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevate
83RISK
exploitation intelligence
initial-access
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RISK
page 1 / 377next →
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.