Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.056exploits catalogados

40.804CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentes populares risco

88.056 exploits

GitHub PoC

CVE-2026-92966 — WordPress LatePoint ≤5.7.0 unauthenticated stored shortcode execution (CVSS 9.1, CWE-94). PoCbit mass-exploit PoC: plant [caption]/custom shortcode in booking first name → Customer Cabinet block double do_shortcode; fixed in 5.7.1. No API key. check/exploit/mass, hits.txt & exploited.txt, https://pocbit.org/pocs/cve-2026-92966

CVE-2026-92966CRITICAL01 out 2026

Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

48RISCO

GitHub PoC

critical-severity unauthenticated Remote Code Execution (RCE) vulnerability impacting Orkes Conductor

CVE-2026-58138CRITICAL01 out 2026

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

63RISCO

GitHub PoC★ 1

34zY/CVE-2026-86950

CVE-2026-86950HIGHsob ataque01 out 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS

76RISCO

VulnCheck XDB

client-side

CVE-2026-86950HIGHsob ataque01 out 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS

76RISCO

GitHub PoC

Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php

CVE-2026-104110MEDIUM01 out 2026

FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php

33RISCO

VulnCheck XDB

initial-access

CVE-2026-90817CRITICAL01 out 2026

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce

63RISCO

Exploit-DB

SuiteCRM 8.10.1 - Authenticated SSRF

CVE-2026-69137HIGHwebappsmultiple01 out 2026

SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure

56RISCO

VulnCheck XDB

info-leak

CVE-2025-30208MEDIUM01 out 2026

Vite bypasses server.fs.deny when using `?raw??`

70RISCO

GitHub PoC★ 1

REDCap DataImport RCE

CVE-2026-90817CRITICAL01 out 2026

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce

63RISCO

GitHub PoC

Safely detect Check Point CPM RCE CVE-2026-93616

CVE-2026-93616CRITICALsob ataque01 out 2026

Directory Traversal and File upload allows execution of arbitrary script on the Management Server

100RISCO

GitHub PoC

PitScaler: independent, source-linked briefing on Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 (CTX697096). https://pitscaler.com

CVE-2026-88771CRITICALsob ataque01 out 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

100RISCO

GitHub PoC

Reproducer for CVE-2026-88789 (Apache Camel Quarkus camel-quarkus-support-xalan drops the JAXP external access restrictions, XXE / SSRF) — Camel Quarkus

CVE-2026-88789HIGH01 out 2026

Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

41RISCO

GitHub PoC

Hassham1/CVE-2026-62059-ultimate-member-sqli-poc

CVE-2026-62059HIGH01 out 2026

WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

41RISCO

GitHub PoC★ 10

Runtime exploit monitor for Apple document/image pipelines (iOS/macOS) — EXPMON concept: Frida agent + behavioral rules. First target: the CVE-2026-86950 glyph chain.

CVE-2026-86950HIGHsob ataque01 out 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS

76RISCO

GitHub PoC

CVE-2026-102425 - GUI CONSOLE

CVE-2026-102425CRITICAL01 out 2026

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4

48RISCO

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALsob ataqueransomware01 out 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

VulnCheck XDB

remote-with-credentials

CVE-2025-8110HIGHsob ataque01 out 2026

File overwrite in file update API in Gogs

100RISCO

GitHub PoC

CVE-2026-96349 — WordPress SiteSkite plugin ≤2.1.8 unauthenticated RCE (CVSS 10.0, CWE-94). PoCbit mass-exploit PoC: legacy API-key autologin (?token=) + REST MCP siteskite_execute_php eval chain; fixed in 2.2.0. Check/exploit/mass bulk, hits.txt & exploited.txt, --lab self-test. Catalog: https://pocbit.org/pocs/cve-2026-96349

CVE-2026-96349CRITICAL01 out 2026

WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability

48RISCO

GitHub PoC

a practical NetScaler CTX697096 security-assessment workflow covering exposure validation, upgrade readiness and compromise-indicator hunting for CVE-2026-88771 through CVE-2026-88778.

CVE-2026-88771CRITICALsob ataque01 out 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

100RISCO

GitHub PoC

Session-scoped TOTP rate limiting permits repeated verification attempts

CVE-2026-103977HIGH01 out 2026

FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts

41RISCO

GitHub PoC★ 1

CVE-2026-90907 (CVSS 6.9) — Joomla! CMS unauthorized user account creation via com_users profile.save (authorization bypass). Non-destructive checker + authorized-use exploit PoC. Fixed in 5.4.9 / 6.1.4.

CVE-2026-90907MEDIUM01 out 2026

Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

33RISCO

GitHub PoC

NetScaler CTX697096 Threat Hunt Helper (IoC scanner) - CVE-2026-88771, CVE-2026-88772, CVE-2026-88779

CVE-2026-88771CRITICALsob ataque01 out 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

100RISCO

GitHub PoC

canhieu/cve-2026-100671-poc

CVE-2026-100671HIGH01 out 2026

Grav before 2.0.25 Session Cookie Theft via Twig Sandbox

41RISCO

VulnCheck XDB

initial-access

CVE-2026-85520CRITICAL30 set 2026

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

48RISCO

GitHub PoC

CVE-2026-72018

CVE-2026-72018HIGH30 set 2026

dibs: loopback: validate offset and size in move_data()

41RISCO

GitHub PoC★ 1

POC for react2shell

CVE-2025-29927CRITICAL30 set 2026

Authorization Bypass in Next.js Middleware

85RISCO

GitHub PoC★ 2

CVE-2026-73570

CVE-2026-73570HIGHsob ataque30 set 2026

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp

100RISCO

GitHub PoC

kikozz/CVE-2024-21338

CVE-2024-21338HIGHsob ataqueransomware30 set 2026

Windows Kernel Elevation of Privilege Vulnerability

83RISCO

VulnCheck XDB

initial-access

CVE-2026-88771CRITICALsob ataque30 set 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

100RISCO

GitHub PoC

Sanitized report summary and local PoC for CVE-2026-103437

CVE-2026-103437LOW30 set 2026

ReadingLists imported metadata permits JavaScript URL XSS

28RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.