Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
22,266 exploits
Referência
CVE-2026-7032
CVE-2026-7032HIGH
Tenda F456 SafeEmailFilter buffer overflow
41RISK
open ↗
Referência
CVE-2026-7031
CVE-2026-7031HIGH
Tenda F456 SafeMacFilter fromSafeMacFilter buffer overflow
41RISK
open ↗
Referência
CVE-2026-7030
CVE-2026-7030HIGH
Tenda F456 RouteStatic fromRouteStatic buffer overflow
41RISK
open ↗
Referência
CVE-2026-7029
CVE-2026-7029HIGH
Tenda F456 addressNat fromaddressNat buffer overflow
41RISK
open ↗
Referência
CVE-2026-7028
CVE-2026-7028MEDIUM
CodeAstro Online Job Portal All Jobs delete-jobs.php sql injection
33RISK
open ↗
Referência
CVE-2026-7025
CVE-2026-7025MEDIUM
Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery
33RISK
open ↗
Referência
CVE-2018-13405
CVE-2018-13405—
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an
23RISK
open ↗
Referência
CVE-2026-8234
CVE-2026-8234HIGH
EFM ipTIME A8004T WifiBasicSet formWifiBasicSet stack-based overflow
41RISK
open ↗
Referência
CVE-2026-8231
CVE-2026-8231MEDIUM
CodeAstro Online Catering Ordering System deleteorder.php sql injection
33RISK
open ↗
Referência✓ VexDay Proof
WebCalendar 1.2.4 - Remote Code Execution
CVE-2012-1495—webappsphp
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user
60RISK
open ↗
Referência
CVE-2026-7682
CVE-2026-7682MEDIUM
Edimax BR-6208AC L2TP Mode setWAN command injection
33RISK
open ↗
Referência
CVE-2026-7582
CVE-2026-7582MEDIUM
AcademySoftwareFoundation OpenImageIO DDS Image ddsinput.cpp out-of-bounds write
33RISK
open ↗
Referência
CVE-2026-7144
CVE-2026-7144MEDIUM
1000 Projects Portfolio Management System MCA update_passwd_process.php authorization
33RISK
open ↗
Referência
CVE-2026-7581
CVE-2026-7581MEDIUM
alexta69 MeTube CORS Policy main.py on_prepare cross-domain policy
33RISK
open ↗
Referência
CVE-2026-7579
CVE-2026-7579MEDIUM
AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials
33RISK
open ↗
Referência
CVE-2026-7578
CVE-2026-7578MEDIUM
MacCMS Pro Plugin Installation add.html install unrestricted upload
33RISK
open ↗
Referência
CVE-2026-7555
CVE-2026-7555MEDIUM
itsourcecode Electronic Judging System login.php sql injection
33RISK
open ↗
Referência
CVE-2026-41466
CVE-2026-41466MEDIUM
ProjeQtor < 12.4.4 Stored XSS via checkValidHtmlText()
33RISK
open ↗
Referência
CVE-2026-41465
CVE-2026-41465HIGH
ProjeQtor < 12.4.4 Path Traversal via dynamicDialog.php
41RISK
open ↗
Referência
CVE-2026-41464
CVE-2026-41464HIGH
ProjeQtor < 12.4.4 Missing Authorization via objectDetail.php
41RISK
open ↗
Referência
CVE-2026-41464
CVE-2026-41464HIGH
ProjeQtor < 12.4.4 Missing Authorization via objectDetail.php
41RISK
open ↗
Referência
CVE-2026-41463
CVE-2026-41463HIGH
ProjeQtor < 12.4.4 ZipSlip Path Traversal via uploadPlugin.php
41RISK
open ↗
Referência
CVE-2026-41463
CVE-2026-41463HIGH
ProjeQtor < 12.4.4 ZipSlip Path Traversal via uploadPlugin.php
41RISK
open ↗
Referência
CVE-2026-41462
CVE-2026-41462CRITICAL
ProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login
48RISK
open ↗
Referência
CVE-2026-6623
CVE-2026-6623MEDIUM
BichitroGan ISP Billing Software Profile users-view cross site scripting
33RISK
open ↗
Referência
CVE-2026-6622
CVE-2026-6622MEDIUM
BichitroGan ISP Billing Software Customer edit cross site scripting
33RISK
open ↗
Referência
CVE-2026-6620
CVE-2026-6620MEDIUM
SonicCloudOrg sonic-server File Upload Endpoint FileTool.java upload path traversal
33RISK
open ↗
Referência
CVE-2026-6619
CVE-2026-6619MEDIUM
langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting
33RISK
open ↗
Referência
CVE-2026-6618
CVE-2026-6618MEDIUM
langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery
33RISK
open ↗
Referência
CVE-2026-6616
CVE-2026-6616MEDIUM
TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery
33RISK
open ↗
← previouspage 442 / 743next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.