Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.055 exploits
VulnCheck XDB
info-leak
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISCO
abrir ↗VulnCheck XDB
initial-access
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
abrir ↗GitHub PoC
Atlassian Arbitrary File Read
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-105844 — Payload CMS @payloadcms/plugin-import-export <3.88.0 unauth prototype pollution (CWE-1321, CVSS 4.0 9.3). PoCbit PoC: POST /api/exports/export-preview fields __proto__.overrideAccess → ACL bypass / data leak. check/exploit/mass. Fix 3.88.0+. https://pocbit.org/pocs/cve-2026-105844
Payload: Prototype pollution in Payload Import Export plugin
48RISCO
abrir ↗GitHub PoC
MCPJam Inspector Remote Code Execution
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISCO
abrir ↗GitHub PoC
CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISCO
abrir ↗GitHub PoC★ 4
Privilege Escalation vulnerability
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
41RISCO
abrir ↗GitHub PoC
CVE-2021-38759 — Raspberry Pi OS Default Credentials Exploit
Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain a
28RISCO
abrir ↗GitHub PoC
CVE-2026-59358 - Cloud Foundry UAA - High - Remote - Privilege leftover - user PKCE token as client_credentials Bearer
UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type
41RISCO
abrir ↗GitHub PoC
CVE-2023-54391: Proxmox VE Authentication Bypass RCE
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RISCO
abrir ↗GitHub PoC★ 1
0xCyp1337/CVE-2026-10196
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
48RISCO
abrir ↗GitHub PoC★ 1
PHP Object Injection -> Arbitrary File Deletion in FacturaScripts <= 2026.66 (CWE-502). PoC + advisory.
FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
33RISCO
abrir ↗VulnCheck XDB
initial-access
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISCO
abrir ↗GitHub PoC
Python tool that detects Apache Struts versions vulnerable to CVE-2017-5638, the flaw behind the 2017 Equifax breach.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISCO
abrir ↗GitHub PoC
Upstream OpenVPN kernel fix for CVE-2026-74727, tested on Ubuntu kernel 7.0.0-38.38. Includes build instructions and functional test results.
ovpn: skip rehash for peers already removed from by_id
48RISCO
abrir ↗GitHub PoC
Technical advisory and proof of concept for CVE-2026-97286 in the WordPress Strong Testimonials plugin
WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability
33RISCO
abrir ↗VulnCheck XDB
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
abrir ↗GitHub PoC
CVE-2026-63277,
RCE via calcext:data-mappings, sql provider and jdbc connector
41RISCO
abrir ↗VulnCheck XDB
local
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISCO
abrir ↗GitHub PoC
CVE-2026-105221 - gist RubyGem - High - MITM - GitHub OAuth token theft
Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-96940
Microsoft Exchange Server Elevation of Privilege Vulnerability
41RISCO
abrir ↗GitHub PoC★ 6
Zammad Session Leak to Remote Code Execution
Undisclosed RCE in Zammad v6.3 and higher
83RISCO
abrir ↗VulnCheck XDB
initial-access
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
48RISCO
abrir ↗GitHub PoC
CVE-2026-59265
Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover
41RISCO
abrir ↗GitHub PoC
One-day analysis + sanitizer PoC of CVE-2026-43805 (IOKit IODMACommand DriverKit RPC race, CWE-362)
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequ
48RISCO
abrir ↗GitHub PoC
beyavuz/cve-2026-105080-poc
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-conve
48RISCO
abrir ↗GitHub PoC★ 11
CVE-2026-21589 - Atlassian Data Center Unauth Arbitrary File Read (CVSS 9.3). Red/Blue Team suite with 2 tools: Full Exploit (path traversal, WEB-INF read, interactive shell, 8 products, mass scan, SOCKS5/Tor, stealth) and SafeChecker (non-intrusive version audit, WAF detection, IoC guidance, JSON/CSV/JSONL reports). Use Ethically, Stay Legal.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-57967 PoC — Apache ActiveMQ Artemis unauthenticated session hijacking via SESSION_REATTACH (2.50.0–2.56.0)
Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
48RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.