Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
GitHub PoC
CVE-2025-24813 Apache Tomcat 11 1-day vulnerability research lab
CVE-2025-24813CRITICALsob ataque29 set 2026
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
abrir ↗
GitHub PoC★ 1
ChinaRan0/CVE-2026-59310-POC 的优化版本。子命令、一次性 cron、带远端 PTY 的交互 shell。仅限授权测试。
CVE-2026-59310CRITICALsob ataqueransomware29 set 2026
vCenter directory-traversal vulnerability
90RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-87902HIGHsob ataque29 set 2026
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗
GitHub PoC★ 5
XWP_RCE — CVE-2026-87902 Hacker Console
CVE-2026-87902HIGHsob ataque29 set 2026
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗
GitHub PoC
A detection/hunting script for compromise related to CVE-2026-88771
CVE-2026-88771CRITICALsob ataque29 set 2026
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RISCO
abrir ↗
GitHub PoC
Sanitized Cargo report and patch verification notes for CVE-2026-96874.
CVE-2026-96874LOW29 set 2026
Stored XSS in Cargo Drilldown tab names
28RISCO
abrir ↗
GitHub PoC★ 1
Exploit for CVE-2025-32463(sudo LPE)
CVE-2025-32463CRITICALsob ataque29 set 2026
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISCO
abrir ↗
GitHub PoC
Published SiYuan CVE · Reporter: dpfkdlemtp · Official record and advisory links
CVE-2026-100633HIGH29 set 2026
SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations
41RISCO
abrir ↗
VulnCheck XDB
info-leak
CVE-2025-30208MEDIUM29 set 2026
Vite bypasses server.fs.deny when using `?raw??`
70RISCO
abrir ↗
VulnCheck XDB
local
CVE-2025-32463CRITICALsob ataque29 set 2026
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISCO
abrir ↗
GitHub PoC
Sanitized Cargo report and patch verification notes for CVE-2026-96875.
CVE-2026-96875MEDIUM29 set 2026
Reflected XSS in Cargo Drilldown hierarchy filters
33RISCO
abrir ↗
GitHub PoC★ 53
Next.js RCE
CVE-2026-94545MEDIUM29 set 2026
Satori-generated SVG has improper escaping
33RISCO
abrir ↗
GitHub PoC
Published Epson EH-TW5350 CVE · Firmware update verification bypass · B-BEAM-BOB team
CVE-2021-43716CRITICAL29 set 2026
Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector
48RISCO
abrir ↗
GitHub PoC★ 1
PoC / Exploit for CVE-2025-32463(sudo LPE)
CVE-2025-32463CRITICALsob ataque29 set 2026
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISCO
abrir ↗
GitHub PoC★ 1
Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.
CVE-2026-63030CRITICALsob ataque29 set 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗
VulnCheck XDB
client-side
CVE-2025-11201HIGH28 set 2026
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
46RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-48356CRITICAL28 set 2026
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
60RISCO
abrir ↗
GitHub PoC
Thesis scenario test (research only): Scenario C: EPSS-BLOCK path - node-serialize@0.0.4 CVE-2017-5941
CVE-2017-5941—28 set 2026
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() fu
35RISCO
abrir ↗
GitHub PoC★ 3
The Events Calendar Wordpress Plugin Mass Exploit CVE-2026-78006 & CVE-2026-78159
CVE-2026-78006CRITICAL28 set 2026
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
48RISCO
abrir ↗
GitHub PoC★ 178
🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.
CVE-2026-75604CRITICAL28 set 2026
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
63RISCO
abrir ↗
GitHub PoC
CVE-2026-38526 - Authenticated RCE exploit for Krayin CRM <= 2.2.x. Upload arbitrary PHP via /admin/tinymce/upload and gain remote code execution. Python PoC for security researchers, CTF players and bug bounty hunters. Tested on HTB Nexus.
CVE-2026-38526CRITICAL28 set 2026
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a
48RISCO
abrir ↗
GitHub PoC
CVE-2026-88772 - Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS)
CVE-2026-88772CRITICALsob ataque28 set 2026
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
100RISCO
abrir ↗
GitHub PoC★ 1
CVE-2026-38526 - Authenticated RCE exploit for Krayin CRM <= 2.2.x. Upload arbitrary PHP via /admin/tinymce/upload and gain remote code execution. Python PoC for security researchers, CTF players and bug bounty hunters. Tested on HTB Nexus.
CVE-2026-38526CRITICAL28 set 2026
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a
48RISCO
abrir ↗
GitHub PoC★ 26
ZeroDayEvil/CVE-2026-54121
CVE-2026-54121HIGH28 set 2026
Active Directory Certificate Services Elevation of Privilege Vulnerability
41RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-87902HIGHsob ataque28 set 2026
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-78159CRITICAL28 set 2026
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
48RISCO
abrir ↗
VulnCheck XDB
info-leak
CVE-2026-63030CRITICALsob ataque28 set 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗
VulnCheck XDB
info-leak
CVE-2026-85706CRITICALsob ataque28 set 2026
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗
VulnCheck XDB
denial-of-service
CVE-2026-41089CRITICAL28 set 2026
Windows Netlogon Remote Code Execution Vulnerability
70RISCO
abrir ↗
GitHub PoC★ 23
ZeroDayEvil/CVE-2026-62911
CVE-2026-62911HIGH28 set 2026
Microsoft Exchange Server Elevation of Privilege Vulnerability
41RISCO
abrir ↗
← anteriorpágina 112 / 2.936próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.