Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,358cataloged exploits
35,511CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,166VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,301 exploits
Referência
CVE-2026-16492
umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection
33RISK
open ↗Referência
CVE-2014-9415
Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a crafted QE
23RISK
open ↗Referência
CVE-2014-9416
Multiple untrusted search path vulnerabilities in Huawei eSpace Desktop before V200R003C00 allow local users to execute
23RISK
open ↗Referência
CVE-2014-9417
The Meeting component in Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (progr
23RISK
open ↗Referência
CVE-2026-16127
zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery
33RISK
open ↗Referência
CVE-2026-18631
jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization
33RISK
open ↗Referência
CVE-2026-12586
Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset
41RISK
open ↗Referência
CVE-2026-11872
Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item
33RISK
open ↗Referência
CVE-2026-16256
Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation
48RISK
open ↗Referência
CVE-2026-15248
Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR
33RISK
open ↗Referência
CVE-2026-15241
ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response
41RISK
open ↗Referência
CVE-2026-14920
AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter
41RISK
open ↗Referência
CVE-2026-14864
JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode
33RISK
open ↗Referência
CVE-2026-14841
King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget
33RISK
open ↗Referência
CVE-2026-67298
FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow
41RISK
open ↗Referência
CVE-2026-14839
Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure
41RISK
open ↗Referência
CVE-2026-14823
Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR
28RISK
open ↗Referência
CVE-2026-14822
Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation
33RISK
open ↗Referência
CVE-2026-14561
Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure
33RISK
open ↗Referência
CVE-2026-14315
Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission
33RISK
open ↗Referência
CVE-2026-14292
WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.