Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
VulnCheck XDB
initial-access
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RISCO
abrir ↗VulnCheck XDB
initial-access
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
63RISCO
abrir ↗GitHub PoC
CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC
CVE-2026-97163 PoC payload (UP plugin Joomla remote code installation)
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
48RISCO
abrir ↗GitHub PoC★ 1
Unauthenticated SQL injection in Joomla YouTube Gallery (joomlaboat.com, com_youtubegallery) ≤ 5.7.2 — video search/sort on the public yg_api endpoint. Python check/exploit PoC for CVE-2026-94130 — PoCbit.
Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3
48RISCO
abrir ↗GitHub PoC★ 3
CVE-2026-43786
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia
41RISCO
abrir ↗GitHub PoC★ 3
CVE-2026-43786
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia
41RISCO
abrir ↗GitHub PoC
A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header — no credentials required.
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
abrir ↗GitHub PoC★ 1
AcyMailing Enterprise for Joomla < 11.1.0: POP3 mailbox actions save MIME attachments without extension checks to media/com_acym/upload/, enabling RCE when an attacker can email the monitored inbox (CVE-2026-94132, CVSS 9.5). Python check/exploit PoC —
Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0
48RISCO
abrir ↗GitHub PoC★ 10
OnePlus Ace 6 temporary root tool (CVE-2026-64560) - device-verified port with corrected bootidParent address
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISCO
abrir ↗GitHub PoC
Unauthenticated arbitrary file upload in Addify Request a Quote for WooCommerce ≤ 2.9.2 via public AJAX afrfq_submit_quote_via_popup — unsafe move_uploaded_file() with attacker-controlled .php filenames into web-accessible RFQ temp storage (popup quote flow required). CVSS 9.8. Python check/exploit PoC → pocbit.org/pocs/cve-2026-18143
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
63RISCO
abrir ↗GitHub PoC
CVE-2026-82901 PoC: WordPress Ultra Addons for Contact Form 7 ≤3.5.50 unauth file upload via signature field when PDF Generator is enabled → wp-content/uploads/uacf7-uploads/. Fix: 3.5.51+. https://pocbit.org/pocs/cve-2026-82901
Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
63RISCO
abrir ↗GitHub PoC
Emergency Zero-Downtime Linux Kernel Defense & Attack-Surface Disarmer. Active hotpatching for CVE-2026-98432 (MPTCP RCE), CVE-2024-1086, CVE-2026-53266 & Seccomp sandboxing.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISCO
abrir ↗GitHub PoC
CVE-2026-97163 PoC payload (UP plugin Joomla remote code installation)
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
48RISCO
abrir ↗GitHub PoC
rmhowe425/POC-CVE-2026-107327
Langflow OSS is affected by multiple vulnerabilities
48RISCO
abrir ↗GitHub PoC
Disabled TLS Certificate Verification for HashiCorp Vault KMS in confluent-kafka
Confluent Kafka Python Improper TLS Certificate Validation
41RISCO
abrir ↗GitHub PoC
CVE-2026-48356 - Magento Open Source - Critical 9.3 - Unauthenticated POST /rest/default/V1/guest-carts/{cartId}/items - Unauthenticated Unrestricted File Upload (PolyShell)
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
60RISCO
abrir ↗GitHub PoC★ 5
MikroTrick (MikroTik RouterOS SSH takeover chain) PoC mirror - CVE-2026-67279 + CVE-2026-86060 (+67276); for authorized lab testing
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
63RISCO
abrir ↗GitHub PoC
xfs kernel LPE (CVE-2026-64600), disclosed by Qualys on 22 July 2026
xfs: resample the data fork mapping after cycling ILOCK
41RISCO
abrir ↗GitHub PoC★ 1
Element2023H/CVE-2026-120232
Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption
48RISCO
abrir ↗GitHub PoC★ 13
CVE-2026-43682: HFS+ B-tree kernel heap overflow in macOS
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-15583 - Grafana MCP Server - High 8.6 - Unauthenticated POST /mcp - Unauthenticated Token Exfiltration (X-Grafana-URL Confused Deputy)
SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header
41RISCO
abrir ↗GitHub PoC★ 1
langz337/CVE-2026-63030
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC
CVE-2026-61500 Rejetto HFS predictable PRNG session forgery to RCE PoC and Docker lab
Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key
48RISCO
abrir ↗GitHub PoC★ 1
Unauthenticated arbitrary file upload on Honeywell PD45 web admin (firmware F10.19.010040–before F10.22.030745) leading to RCE. Python check/exploit PoC
Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040
48RISCO
abrir ↗GitHub PoC
Farih123/CVE-2026-90817
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
63RISCO
abrir ↗GitHub PoC
CVE-2026-97161 PoC: Joomla UP (lomart.fr) unauthenticated path traversal / arbitrary file read via ajax-view (≤6.0.29). Fingerprints plugin, probes configuration.php. Fix: UP 6.1.0 / 5.2.1. https://pocbit.org/pocs/cve-2026-97161
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
48RISCO
abrir ↗VulnCheck XDB
initial-access
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-29053 - Ghost CMS < 6.19.0 - Authenticated Remote Code Execution via Malicious Theme
Ghost Vulnerable to Remote Code Execution via Malicious Themes
56RISCO
abrir ↗GitHub PoC
Penetration testing report and PoC on Metasploitable2 target, demonstrating CVE-2011-2523 vsFTPd v2.3.4 exploitation via Metasploit.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.