Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,302cataloged exploits
35,469CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,266 exploits
Referência
CVE-2026-16534
CVE-2026-16534CRITICAL
Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import
48RISK
open ↗
Referência
CVE-2026-63087
CVE-2026-63087CRITICAL
Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint
48RISK
open ↗
Referência
CVE-2026-63086
CVE-2026-63086MEDIUM
text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions
33RISK
open ↗
Referência
CVE-2026-63085
CVE-2026-63085HIGH
Axelor Open Platform 8.x < 8.2.2 Authorization Bypass via Nested Relational Record Persistence
41RISK
open ↗
Referência
CVE-2026-63082
CVE-2026-63082MEDIUM
Perfect Support Ticketing System 1.7 Broken Access Control via Agent Assignment
33RISK
open ↗
Referência
CVE-2026-63081
CVE-2026-63081MEDIUM
Perfect Support Ticketing System 1.7 Stored XSS via Ticket Notes Field
33RISK
open ↗
Referência
CVE-2026-12978
CVE-2026-12978HIGH
FunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin Form
41RISK
open ↗
Referência
CVE-2026-12907
CVE-2026-12907LOW
RTMKit Addons for Elementor < 2.0.9 - Author+ Site-Wide Theme Builder Template Creation and Activation
28RISK
open ↗
Referência
CVE-2026-12906
CVE-2026-12906LOW
RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure
28RISK
open ↗
Referência
CVE-2026-15749
CVE-2026-15749MEDIUM
mastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversal
33RISK
open ↗
Referência
CVE-2026-58475
CVE-2026-58475MEDIUM
Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name
33RISK
open ↗
Referência
CVE-2026-11563
CVE-2026-11563CRITICAL
Word Count and Social Shares <= 1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal
48RISK
open ↗
Referência
CVE-2025-15665
CVE-2025-15665MEDIUM
BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field
33RISK
open ↗
Referência
CVE-2026-15622
CVE-2026-15622MEDIUM
poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization
33RISK
open ↗
Referência
CVE-2026-15622
CVE-2026-15622MEDIUM
poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization
33RISK
open ↗
Referência
CVE-2026-15620
CVE-2026-15620MEDIUM
mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery
33RISK
open ↗
Referência
CVE-2026-15619
CVE-2026-15619MEDIUM
mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery
33RISK
open ↗
Referência
CVE-2026-15607
CVE-2026-15607MEDIUM
tanstack db Alias Path select.ts select prototype pollution
33RISK
open ↗
Referência
CVE-2026-62239
CVE-2026-62239MEDIUM
FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py
33RISK
open ↗
Referência
CVE-2026-15546
CVE-2026-15546MEDIUM
Shibby Tomato start_jffs2 sub_2D568 os command injection
33RISK
open ↗
Referência
CVE-2026-15545
CVE-2026-15545HIGH
Shibby Tomato apcupsd tomatodata.cgi main out-of-bounds write
41RISK
open ↗
Referência
CVE-2026-15544
CVE-2026-15544HIGH
Shibby Tomato apcupsd tomatodata.cgi getupsvar stack-based overflow
41RISK
open ↗
Referência
CVE-2026-12397
CVE-2026-12397MEDIUM
WP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2026-15535
CVE-2026-15535MEDIUM
AkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization
33RISK
open ↗
Referência
CVE-2026-15531
CVE-2026-15531MEDIUM
yashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization
33RISK
open ↗
Referência
CVE-2026-15530
CVE-2026-15530MEDIUM
WuzhiCMS Attachment API index.php listimage information disclosure
33RISK
open ↗
Referência
CVE-2026-15527
CVE-2026-15527MEDIUM
better-auth better-icons scan_project_icons/sync_icon path traversal
33RISK
open ↗
Referência
CVE-2026-15526
CVE-2026-15526MEDIUM
augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversal
33RISK
open ↗
Referência
CVE-2026-15525
CVE-2026-15525MEDIUM
kLOsk adloop write.py _validate_urls server-side request forgery
33RISK
open ↗
Referência
CVE-2026-15524
CVE-2026-15524MEDIUM
alioshr memory-bank-mcp list-project-files-validation-factory.ts path traversal
33RISK
open ↗
← previouspage 464 / 743next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.