Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
84.035exploits catalogados
39.531CVEs com exploração pública
24.695testados em laboratório
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9.678Nuclei 4.478Metasploit 3.524✓ só verificadosrecentespopularesrisco
16.153 exploits
GitHub PoC
ShadowForge-Cyber/CVE-2026-104286-POC
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
78RISCO
abrir ↗GitHub PoC
NetScaler CTX697096 Threat Hunt Helper (IoC scanner) - CVE-2026-88771, CVE-2026-88772, CVE-2026-88779
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RISCO
abrir ↗GitHub PoC★ 2
VC-Strike — VMware vCenter CVE-2026-59310 (unauth root RCE) & CVE-2026-59309 (SRP auth bypass) authorized pentest suite. GUI+CLI, multi-session C2, stdlib-only. 授权测试专用
vCenter directory-traversal vulnerability
78RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-90907 (CVSS 6.9) — Joomla! CMS unauthorized user account creation via com_users profile.save (authorization bypass). Non-destructive checker + authorized-use exploit PoC. Fixed in 5.4.9 / 6.1.4.
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
33RISCO
abrir ↗GitHub PoC
34zY/CVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2
71RISCO
abrir ↗GitHub PoC
Hassham1/CVE-2026-62059-ultimate-member-sqli-poc
WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
41RISCO
abrir ↗GitHub PoC
a practical NetScaler CTX697096 security-assessment workflow covering exposure validation, upgrade readiness and compromise-indicator hunting for CVE-2026-88771 through CVE-2026-88778.
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RISCO
abrir ↗GitHub PoC
critical-severity unauthenticated Remote Code Execution (RCE) vulnerability impacting Orkes Conductor
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
68RISCO
abrir ↗GitHub PoC
CVE-2026-102425 - GUI CONSOLE
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
48RISCO
abrir ↗GitHub PoC★ 9
Runtime exploit monitor for Apple document/image pipelines (iOS/macOS) — EXPMON concept: Frida agent + behavioral rules. First target: the CVE-2026-86950 glyph chain.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2
71RISCO
abrir ↗GitHub PoC
PitScaler: independent, source-linked briefing on Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 (CTX697096). https://pitscaler.com
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RISCO
abrir ↗GitHub PoC★ 2
Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC
Satori-generated SVG has improper escaping
33RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
100RISCO
abrir ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103442
MergeAccount PHP object injection via session-key substitution
41RISCO
abrir ↗GitHub PoC
Authlib 1.7.2: Signature Verification Bypass - General JSON JWS Accepts Unsigned Payload when `signatures` is Empty
Authlib library contains a signature‑verification bypass vulnerability
48RISCO
abrir ↗GitHub PoC
single PoC for CVE-2026-18143 Unauth AFU (Arbitrary File Upload)
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
48RISCO
abrir ↗GitHub PoC
CVE-2026-102425 PoC (PoCbit) — Joomla Balbooa Forms (com_baforms) <2.4.3.4 unauth RCE via field shortcode injection in post-submission PHP eval(). check + exploit + mass bulk. https://pocbit.org/pocs/cve-2026-102425
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
48RISCO
abrir ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103445
Stored XSS through PageForms #autoedit redirect links
28RISCO
abrir ↗GitHub PoC★ 1
Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC
Satori-generated SVG has improper escaping
33RISCO
abrir ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103446
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
41RISCO
abrir ↗GitHub PoC
CVE-2026-76570 PoC (PoCbit) — Joomla JCTables (com_jctables) <1.21.1: unauth SQL read/write via front-end JSON API getdatarow/getrow (CVSS 4.0 10.0 AT:N). check + exploit + mass. https://www.cve.org/CVERecord?id=CVE-2026-76570
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
48RISCO
abrir ↗GitHub PoC★ 2
EUVD-2026-89950 Improper Handling of URL Encoding (Hex Encoding) (CWE-177)
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
78RISCO
abrir ↗GitHub PoC
JailBr3ak/CVE-2026-97347
Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
41RISCO
abrir ↗GitHub PoC
Local classroom demo of NoSQL operator injection in LangGraph's MongoDBSaver (GHSA-98xf-r82g-9mhx / CVE-2026-48121). Fictional data only.
@langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access
33RISCO
abrir ↗GitHub PoC
kikozz/CVE-2013-3660-win32k.sys
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windo
98RISCO
abrir ↗GitHub PoC
Security PoC payload host for CVE-2026-91159 oEmbed test (authorized bug bounty)
Discourse: Stored oEmbed HTML injection via allowed iframe
38RISCO
abrir ↗GitHub PoC
CVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE).
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
63RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.