Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,886cataloged exploits
32,153CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,978GitHub PoC 13,282VulnCheck XDB 8,176Nuclei 4,202Metasploit 3,462✓ verified onlyrecentpopularrisk
4,202 exploits
Nucleilow
Mailcow < 2026-03b - Href Link Injection
CVE-2026-40878LOW
mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping
23RISK
open ↗
Nucleicritical
Vendure Core - SQL Injection
CVE-2026-40887CRITICAL
@vendure/core has a SQL Injection vulnerability
43RISK
open ↗
Nucleihigh
HT Mega < 3.0.7 - Sensitive Information Disclosure
CVE-2026-4106MEDIUM
HT Mega < 3.0.7 – Unauthenticated PII Disclosure
48RISK
open ↗
Nucleicritical
Rclone RC - Broken Access Control
CVE-2026-41176CRITICAL
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
55RISK
open ↗
Nucleicritical
RClone RC - Command Injection
CVE-2026-41179CRITICAL
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
63RISK
open ↗
Nucleicritical
Dgraph <= 25.3.2 - Admin Token Disclosure
CVE-2026-41492CRITICAL
Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph
43RISK
open ↗
Nucleihigh
NocoBase - SQL Injection
CVE-2026-41640HIGH
NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading
36RISK
open ↗
Nucleihigh
NocoBase - SQL Injection
CVE-2026-41641HIGH
NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call
36RISK
open ↗
Nucleicritical
cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
CVE-2026-41940CRITICALunder attackransomware
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗
Nucleihigh
CKAN DataStore SQL Search - SQL Injection
CVE-2026-42031HIGH
CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
36RISK
open ↗
Nucleicritical
LiteLLM - SQL Injection
CVE-2026-42208CRITICALunder attack
LiteLLM: SQL injection in Proxy API key verification
100RISK
open ↗
Nucleicritical
LiteLLM - Command Injection
CVE-2026-42271HIGHunder attack
LiteLLM: Authenticated command execution via MCP stdio test endpoints
100RISK
open ↗
Nucleicritical
MagicMirror <= 2.35.0 - Server-Side Request Forgery
CVE-2026-42281CRITICAL
MagicMirror²: Unauthenticated SSRF via /cors endpoint
43RISK
open ↗
Nucleicritical
phpVMS < 7.0.6 - Legacy Importer Authorization Bypass
CVE-2026-42569CRITICAL
phpvms: /importer authorization bypass causing full database wipe
43RISK
open ↗
Nucleicritical
WordPress Contact Form by Supsystic - Server-Side Template Injection
CVE-2026-4257CRITICAL
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
75RISK
open ↗
Nucleicritical
Gotenberg - Command Injection
CVE-2026-42589CRITICAL
Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection
63RISK
open ↗
Nucleicritical
JoomSport <= 5.7.7 - SQL Injection
CVE-2026-42647CRITICAL
WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability
63RISK
open ↗
Nucleicritical
Scramble Laravel - Remote Code Execution
CVE-2026-44262CRITICAL
Scramble: Remote code execution via evaluation of user-controlled input in validation rules
63RISK
open ↗
Nucleicritical
Open WebUI 'LDAP Empty Password' - Authentication Bypass
CVE-2026-44551CRITICAL
Open WebUI: LDAP Empty Password Authentication Bypass
43RISK
open ↗
Nucleihigh
Dozzle - Server Side Request Forgery
CVE-2026-45298HIGH
Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)
36RISK
open ↗
Nucleimedium
Open WebUI < 0.9.5 - Information Disclosure
CVE-2026-45397MEDIUM
Open WebUI: Unauthenticated RAG Configuration Disclosure
28RISK
open ↗
Nucleicritical
Cockpit Web Console < 360 - Remote Code Execution
CVE-2026-4631CRITICAL
Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
68RISK
open ↗
Nucleicritical
9Router <= 0.4.36 - Unauthenticated RCE
CVE-2026-46339CRITICAL
9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
43RISK
open ↗
Nucleicritical
phpMyFAQ <= 4.1.1 - SQL Injection
CVE-2026-46364CRITICAL
phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
43RISK
open ↗
Nucleihigh
SillyTavern - Server-Side Request Forgery
CVE-2026-46372HIGH
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
36RISK
open ↗
Nucleicritical
Flowise < 3.1.2 - node-custom-function Unauthorized RCE
CVE-2026-46442CRITICAL
Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
63RISK
open ↗
Nucleicritical
TYPO3 ceselector Extension - Insecure Deserialization
CVE-2026-46725CRITICAL
Remote Code Execution in extension "Content Element Selector" (ceselector)
43RISK
open ↗
Nucleicritical
Google ADK-Python - Unauthenticated Builder Endpoint
CVE-2026-4810CRITICAL
Remote Code Execution in Google Agent Development Kit (ADK)
43RISK
open ↗
Nucleicritical
Adobe ColdFusion - RDS Arbitrary File Write
CVE-2026-48282CRITICAL
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
68RISK
open ↗
Nucleihigh
ColdFusion - Path Traversal
CVE-2026-48313CRITICAL
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
43RISK
open ↗
← previouspage 107 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.