Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.340exploits catalogados
41.245CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.769Exploit-DB 24.491GitHub PoC 18.603inteligência de exploração 11.309Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
11.309 exploits
client-side
Cache Poisoning in next.js
53RISCO
initial-access
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RISCO
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
initial-access
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
100RISCO
initial-access
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
100RISCO
initial-access
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
100RISCO
initial-access
Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
100RISCO
initial-access
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,
100RISCO
local
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
local
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
68RISCO
initial-access
W3 Total Cache < 2.8.13 - Unauthenticated Command Injection
53RISCO
info-leak
MindsDB has improper sanitation of filepath that leads to information disclosure and DOS
46RISCO
initial-access
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet
60RISCO
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISCO
initial-access
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet
60RISCO
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
initial-access
Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
78RISCO
initial-access
SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability
78RISCO
local
Code Execution / Escalation of Privileges in ThrottleStop
41RISCO
initial-access
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0
100RISCO
denial-of-service
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perfor
83RISCO
info-leak
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and
76RISCO
initial-access
Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
100RISCO
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISCO
initial-access
Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable fil
60RISCO
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISCO
initial-access
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RISCO
remote-with-credentials
Upload Arbitrary Files
100RISCO
initial-access
Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly
48RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.