Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.056exploits catalogados

40.804CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentes populares risco

88.054 exploits

GitHub PoC★ 7

CVE-2026-21589 detector for Atlassian Data Center webresource traversal. Pre-auth webroot file read confirm for Jira, Confluence and Bitbucket.

CVE-2026-21589CRITICALsob ataque07 out 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RISCO

abrir ↗

GitHub PoC

CVE-2026-21589

CVE-2026-21589CRITICALsob ataque07 out 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-102782 — OrdaSoft Joomla Simple Membership <7.4.0 unauth SQLi (CWE-89, CVSS 4.0 9.3). PoCbit PoC: checkLoginPass + login param extractvalue error leak. check/exploit/mass, hits.txt & exploited.txt. Fix 7.4.0+. https://pocbit.org/pocs/cve-2026-102782

CVE-2026-102782CRITICAL07 out 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0

63RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-21589CRITICALsob ataque07 out 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RISCO

abrir ↗

GitHub PoC

CVE-2026-21589

CVE-2026-21589CRITICALsob ataque07 out 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-105844 — Payload CMS @payloadcms/plugin-import-export <3.88.0 unauth prototype pollution (CWE-1321, CVSS 4.0 9.3). PoCbit PoC: POST /api/exports/export-preview fields __proto__.overrideAccess → ACL bypass / data leak. check/exploit/mass. Fix 3.88.0+. https://pocbit.org/pocs/cve-2026-105844

CVE-2026-105844CRITICAL07 out 2026

Payload: Prototype pollution in Payload Import Export plugin

48RISCO

abrir ↗

VulnCheck XDB

denial-of-service

CVE-2024-7971HIGHsob ataque07 out 2026

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a

76RISCO

abrir ↗

GitHub PoC

CVE-2026-102422 POC

CVE-2026-102422CRITICAL07 out 2026

shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token

48RISCO

abrir ↗

GitHub PoC

Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

CVE-2026-90977MEDIUM07 out 2026

Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

33RISCO

abrir ↗

GitHub PoC

0xCyp1337/CVE-2026-81780

CVE-2026-81780CRITICAL07 out 2026

WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability

48RISCO

abrir ↗

GitHub PoC★ 1

Smarty is vulnerable to code injection through template inheritance. Crafted assigned data can inject a forged SmartyNocache marker into regenerated PHP cache files, potentially allowing attackers to execute arbitrary PHP code. The issue affects Smarty 4.5.7 and earlier, and 5.8.4 and earlier.

CVE-2026-82531CRITICAL07 out 2026

Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

48RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-21589CRITICALsob ataque07 out 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RISCO

abrir ↗

GitHub PoC

Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce

CVE-2026-102489HIGHsob ataque07 out 2026

Undisclosed RCE in Zammad v6.3 and higher

83RISCO

abrir ↗

GitHub PoC

MCPJam Inspector Remote Code Execution

CVE-2026-23744CRITICAL07 out 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RISCO

abrir ↗

GitHub PoC

Atlassian Arbitrary File Read

CVE-2026-21589CRITICALsob ataque07 out 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RISCO

abrir ↗

GitHub PoC

CVE-2021-38759 — Raspberry Pi OS Default Credentials Exploit

CVE-2021-38759—07 out 2026

Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain a

28RISCO

abrir ↗

VulnCheck XDB

local

CVE-2019-2215HIGHsob ataque07 out 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RISCO

abrir ↗

GitHub PoC

CVE-2026-59358 - Cloud Foundry UAA - High - Remote - Privilege leftover - user PKCE token as client_credentials Bearer

CVE-2026-59358HIGH07 out 2026

UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

41RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2025-29927CRITICAL07 out 2026

Authorization Bypass in Next.js Middleware

85RISCO

abrir ↗

GitHub PoC

Benign, offline reproduction of CVE-2026-93355 — LiteLLM unverified-email JWT account takeover (runs LiteLLM's real code)

CVE-2026-93355HIGH07 out 2026

LiteLLM Weak JWT Authentication via Email-Based User Lookup

41RISCO

abrir ↗

GitHub PoC★ 4

Privilege Escalation vulnerability

CVE-2026-96451HIGH07 out 2026

WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

41RISCO

abrir ↗

GitHub PoC★ 1

cve-2026-87902 lab

CVE-2026-87902HIGHsob ataque07 out 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RISCO

abrir ↗

GitHub PoC★ 1

Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN

CVE-2026-85102CRITICALsob ataque07 out 2026

Improper Certificate Validation in Quantum Security Gateway

90RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-21589CRITICALsob ataque07 out 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RISCO

abrir ↗

GitHub PoC★ 179

CVE-2026-63030 + CVE-2026-60137 exploit RCE chain

CVE-2026-63030CRITICALsob ataque07 out 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISCO

abrir ↗

GitHub PoC★ 4

Independent PoC and reproducible lab for CVE-2026-97332 — User Private Files < 2.2.0 unauthenticated private file disclosure on WordPress Multisite.

CVE-2026-97332MEDIUM07 out 2026

User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)

33RISCO

abrir ↗

GitHub PoC

DOS infinite-loop Vulnerability POC

CVE-2026-102253HIGH07 out 2026

iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

41RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALsob ataque07 out 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

abrir ↗

GitHub PoC

DirtyFrag CVE-2026-43284 research for 5.4-qgki devices

CVE-2026-43284HIGH07 out 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RISCO

abrir ↗

GitHub PoC

Case study: Label Studio CVE-2022-36551 (task-import URL opened with urlopen). Demo only, not for use.

CVE-2022-36551—07 out 2026

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.