Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,813cataloged exploits
35,788CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,549GitHub PoC 14,290VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,549 exploits
Referência
CVE-2010-0373
CVE-2010-0373—
SQL injection vulnerability in the libros (com_libros) component for Joomla! allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2026-19019
CVE-2026-19019MEDIUM
poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup
33RISK
open ↗
Referência
CVE-2026-19019
CVE-2026-19019MEDIUM
poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup
33RISK
open ↗
Referência
CVE-2026-19011
CVE-2026-19011MEDIUM
TinyAGI agents.ts buildSystemPrompt file inclusion
33RISK
open ↗
Referência
CVE-2026-19010
CVE-2026-19010MEDIUM
TinyAGI Message API Endpoint index.ts processMessage authorization
33RISK
open ↗
Referência
CVE-2026-19009
CVE-2026-19009MEDIUM
TinyAGI Message API Endpoint response.ts collectFiles file inclusion
33RISK
open ↗
Referência
CVE-2026-19008
CVE-2026-19008MEDIUM
mf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following
33RISK
open ↗
Referência
CVE-2026-19007
CVE-2026-19007MEDIUM
mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management
33RISK
open ↗
Referência
CVE-2026-14204
CVE-2026-14204MEDIUM
Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF
33RISK
open ↗
Referência
CVE-2026-16537
CVE-2026-16537MEDIUM
Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode
33RISK
open ↗
Referência
CVE-2026-18395
CVE-2026-18395MEDIUM
Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes
33RISK
open ↗
Referência
CVE-2026-16065
CVE-2026-16065MEDIUM
Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import
33RISK
open ↗
Referência
CVE-2026-14829
CVE-2026-14829HIGH
Checkimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded Secret
41RISK
open ↗
Referência
CVE-2026-11588
CVE-2026-11588MEDIUM
EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation
33RISK
open ↗
Referência
CVE-2022-35914
CVE-2022-35914CRITICALunder attack
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
100RISK
open ↗
Referência
CVE-2009-5093
CVE-2009-5093—
Directory traversal vulnerability in gastbuch.php in Gästebuch (Gastebuch) 1.6 allows remote attackers to read arbitrary
23RISK
open ↗
Referência
CVE-2015-8425
CVE-2015-8425—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and
35RISK
open ↗
Referência
CVE-2026-14839
CVE-2026-14839HIGH
Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure
41RISK
open ↗
Referência
CVE-2026-14823
CVE-2026-14823LOW
Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR
28RISK
open ↗
Referência
CVE-2026-14822
CVE-2026-14822MEDIUM
Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation
33RISK
open ↗
Referência
CVE-2026-14561
CVE-2026-14561MEDIUM
Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure
33RISK
open ↗
Referência
CVE-2026-14315
CVE-2026-14315MEDIUM
Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission
33RISK
open ↗
Referência
CVE-2026-14292
CVE-2026-14292MEDIUM
WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title
33RISK
open ↗
Referência
CVE-2026-14214
CVE-2026-14214LOW
Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
28RISK
open ↗
Referência
CVE-2026-14195
CVE-2026-14195LOW
Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info
28RISK
open ↗
Referência
CVE-2026-13729
CVE-2026-13729MEDIUM
Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF
33RISK
open ↗
Referência
CVE-2026-13725
CVE-2026-13725HIGH
Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax
41RISK
open ↗
Referência
CVE-2026-13604
CVE-2026-13604MEDIUM
Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX
33RISK
open ↗
Referência
CVE-2026-13596
CVE-2026-13596CRITICAL
Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search
48RISK
open ↗
Referência
CVE-2026-13329
CVE-2026-13329MEDIUM
WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund
33RISK
open ↗
← previouspage 604 / 752next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.