Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,302cataloged exploits
35,469CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,301 exploits
Referência
CVE-2026-14823
CVE-2026-14823LOW
Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR
28RISK
open ↗
Referência
CVE-2026-14822
CVE-2026-14822MEDIUM
Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation
33RISK
open ↗
Referência
CVE-2026-14561
CVE-2026-14561MEDIUM
Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure
33RISK
open ↗
Referência
CVE-2026-14315
CVE-2026-14315MEDIUM
Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission
33RISK
open ↗
Referência
CVE-2026-14292
CVE-2026-14292MEDIUM
WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title
33RISK
open ↗
Referência
CVE-2026-14214
CVE-2026-14214LOW
Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
28RISK
open ↗
Referência
CVE-2026-14195
CVE-2026-14195LOW
Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info
28RISK
open ↗
Referência
CVE-2026-13729
CVE-2026-13729MEDIUM
Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF
33RISK
open ↗
Referência
CVE-2026-13725
CVE-2026-13725HIGH
Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax
41RISK
open ↗
Referência
CVE-2026-13604
CVE-2026-13604MEDIUM
Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX
33RISK
open ↗
Referência
CVE-2026-13596
CVE-2026-13596CRITICAL
Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search
48RISK
open ↗
Referência
CVE-2026-13329
CVE-2026-13329MEDIUM
WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund
33RISK
open ↗
Referência
CVE-2025-71408
CVE-2025-71408HIGH
NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments
41RISK
open ↗
Referência
CVE-2026-63100
CVE-2026-63100HIGH
Maybe 0.6.0 Missing Authorization via HostingsController show/update
41RISK
open ↗
Referência
CVE-2026-63099
CVE-2026-63099HIGH
TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints
41RISK
open ↗
Referência
CVE-2026-63096
CVE-2026-63096MEDIUM
Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint
33RISK
open ↗
Referência
CVE-2026-63095
CVE-2026-63095HIGH
Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint
41RISK
open ↗
Referência
CVE-2026-63094
CVE-2026-63094HIGH
SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft
41RISK
open ↗
Referência
CVE-2026-16017
CVE-2026-16017MEDIUM
mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization
33RISK
open ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RISK
open ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RISK
open ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RISK
open ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RISK
open ↗
Referência
CVE-2026-16014
CVE-2026-16014MEDIUM
code-projects Hospital Bed Management System Login Form sql injection
33RISK
open ↗
Referência
CVE-2026-16013
CVE-2026-16013MEDIUM
liftoff-sr CIPster cipepath.cc deserialize_symbolic out-of-bounds
33RISK
open ↗
Referência
CVE-2026-15510
CVE-2026-15510MEDIUM
Leantime API saveSetting improper authorization
33RISK
open ↗
Referência
CVE-2026-15478
CVE-2026-15478MEDIUM
IceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection
33RISK
open ↗
Referência
CVE-2026-15475
CVE-2026-15475MEDIUM
MiniTool Partition Wizard Signed Kernel Driver pwdrvio.sys access control
33RISK
open ↗
Referência
CVE-2026-14746
CVE-2026-14746MEDIUM
code-projects Real State Services addprojectrent.php sql injection
33RISK
open ↗
Referência
CVE-2026-14745
CVE-2026-14745MEDIUM
code-projects Real State Services single-list_rent.php sql injection
33RISK
open ↗
← previouspage 470 / 744next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.