Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,836cataloged exploits
32,133CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,967GitHub PoC 13,264VulnCheck XDB 8,156Nuclei 4,201Metasploit 3,462✓ verified onlyrecentpopularrisk
19,967 exploits
Referência
CVE-2026-6941
CVE-2026-6941MEDIUM
radare2 < 6.1.4 Project Notes Path Traversal via Symlink
13RISK
open ↗
Referência
CVE-2026-6940
CVE-2026-6940MEDIUM
radare2 < 6.1.4 Project Deletion Path Traversal Directory Deletion
13RISK
open ↗
Referência
CVE-2026-25874
CVE-2026-25874CRITICAL
LeRobot Unsafe Deserialization Remote Code Execution via gRPC
53RISK
open ↗
Referência
CVE-2026-23751
CVE-2026-23751CRITICAL
Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting
48RISK
open ↗
Referência
CVE-2026-41460
CVE-2026-41460CRITICAL
SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall
48RISK
open ↗
Referência
CVE-2026-4512
CVE-2026-4512LOW
WP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSS
28RISK
open ↗
Referência
CVE-2026-4106
CVE-2026-4106MEDIUM
HT Mega < 3.0.7 – Unauthenticated PII Disclosure
48RISK
open ↗
Referência
CVE-2026-6878
CVE-2026-6878MEDIUM
ByteDance verl grader.py math_equal sandbox
33RISK
open ↗
Referência
CVE-2026-6874
CVE-2026-6874MEDIUM
ericc-ch copilot-api Header token dns rebinding
33RISK
open ↗
Referência
CVE-2026-40517
CVE-2026-40517HIGH
radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names
41RISK
open ↗
Referência
CVE-2026-34413
CVE-2026-34413HIGH
Xerte Online Toolkits Missing Authentication via connector.php
56RISK
open ↗
Referência
CVE-2026-34415
CVE-2026-34415CRITICAL
Xerte Online Toolkits File Upload RCE via elfinder Connector
63RISK
open ↗
Referência
CVE-2026-9360
CVE-2026-9360HIGH
Edimax EW-7438RPn POST Request formwlencrypt24g buffer overflow
41RISK
open ↗
Referência
CVE-2026-9359
CVE-2026-9359MEDIUM
Edimax EW-7438RPn POST Request formHwSet command injection
33RISK
open ↗
Referência
CVE-2026-9358
CVE-2026-9358MEDIUM
postcss-selector-parser AST Serialization container.js toString recursion
33RISK
open ↗
Referência
CVE-2026-9355
CVE-2026-9355MEDIUM
SourceCodester Hospitals Patient Records Management System Master.php save_patient_history sql injection
33RISK
open ↗
Referência
CVE-2026-9354
CVE-2026-9354MEDIUM
NousResearch hermes-agent Slack Agent/Mattermost Agent escape output
33RISK
open ↗
Referência
CVE-2026-9353
CVE-2026-9353MEDIUM
NousResearch hermes-agent Skills Guard Multi-Word Prompt skills_guard.py injection
33RISK
open ↗
Referência
CVE-2026-9352
CVE-2026-9352MEDIUM
NousResearch hermes-agent Messaging Gateway local.py _make_run_env information disclosure
33RISK
open ↗
Referência
CVE-2026-9351
CVE-2026-9351MEDIUM
NousResearch hermes-agent read_file Tool file_tools.py _is_blocked_device path traversal
33RISK
open ↗
Referência
CVE-2026-9350
CVE-2026-9350MEDIUM
NousResearch hermes-agent Batch Runner approval.py check_all_command_guards authorization
33RISK
open ↗
Referência
CVE-2026-9349
CVE-2026-9349MEDIUM
calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure
33RISK
open ↗
Referência
CVE-2026-9348
CVE-2026-9348HIGH
Edimax EW-7438RPn webs mp stack-based overflow
41RISK
open ↗
Referência
CVE-2026-9347
CVE-2026-9347MEDIUM
Edimax EW-7438RPn webs formWizSurvey os command injection
33RISK
open ↗
Referência
CVE-2026-6799
CVE-2026-6799MEDIUM
Comfast CF-N1-S Endpoint mbox-config command injection
33RISK
open ↗
Referência
CVE-2026-6745
CVE-2026-6745MEDIUM
Bagisto Custom Scripts cross site scripting
33RISK
open ↗
Referência
CVE-2026-41456
CVE-2026-41456MEDIUM
Bludit CMS Reflected XSS via Search Plugin
33RISK
open ↗
Referência
CVE-2026-6744
CVE-2026-6744MEDIUM
Bagisto Downloadable Link copy server-side request forgery
33RISK
open ↗
Referência
CVE-2026-6743
CVE-2026-6743MEDIUM
WebSystems WebTOTUM Calendar cross site scripting
33RISK
open ↗
Referência
CVE-2019-25714
CVE-2019-25714CRITICAL
Seeyon Office Anywhere (OA) A8 Unauthenticated Arbitrary File Write via htmlofficeservlet
48RISK
open ↗
← previouspage 79 / 666next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.