Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.056exploits catalogados

40.804CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentes populares risco

88.056 exploits

VulnCheck XDB

initial-access

CVE-2026-60137MEDIUMsob ataque24 set 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RISCO

abrir ↗

GitHub PoC

CVE-2026-12227 (CVSS 9.8): WordPress Visual Composer Website Builder ≤45.16.0 — unauthenticated local file inclusion via vcv-template. Educational PoC only.

CVE-2026-12227CRITICAL24 set 2026

Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter

63RISCO

abrir ↗

GitHub PoC

CVE-2026-12227 - Visual Composer <= 45.16.0 unauthenticated LFI via vcv-template (CVSS 9.8): Docker validation lab, safe-oracle PoC, nuclei template. Root cause: validate-then-mutate on the theme: prefix. Verified: vendor fix never landed - fires through 45.16.3 on WP <= 7.1.1; masked by WP 7.1.2 core gate.

CVE-2026-12227CRITICAL24 set 2026

Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter

63RISCO

abrir ↗

GitHub PoC

zyphorixofficialmain-lab/cve-2026-87902

CVE-2026-87902HIGHsob ataque24 set 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2023-49070—24 set 2026

Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present

60RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-12227CRITICAL24 set 2026

Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter

63RISCO

abrir ↗

GitHub PoC

Write-up машины Nexus (HTB). Цепочка атак: утечка данных в Git history → Krayin CRM RCE (CVE-2026-38526) → повышение привилегий через Git internals и SUID binary. Подробный разбор векторов атак с иллюстрациями.

CVE-2026-38526CRITICAL24 set 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-94127CRITICALsob ataque24 set 2026

BIG-IP APM OAuth vulnerability

83RISCO

abrir ↗

Exploit-DB

MikroTrick_ 7.24_ 7.24.2_ 7.0.0_ 7.23.4_ 6.0.0_ 6.49.21 - RCE

CVE-2026-86060CRITICALsob ataqueremotemultiple24 set 2026

SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

78RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-87902HIGHsob ataque24 set 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RISCO

abrir ↗

GitHub PoC★ 1

yulisec/CVE-2025-7771

CVE-2025-7771HIGH24 set 2026

Code Execution / Escalation of Privileges in ThrottleStop

41RISCO

abrir ↗

GitHub PoC

A WordPress plugin exposing an MCP server over the REST API, with the security model as the point -- closes the CVE-2026-15015 OAuth-bypass shape by never having that surface at all.

CVE-2026-15015CRITICAL24 set 2026

MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint

63RISCO

abrir ↗

GitHub PoC★ 1

whoami-012/CVE-2026-96515

CVE-2026-96515HIGH24 set 2026

Command Injection Vulnerability in Netlink ICT HG323RW Router

41RISCO

abrir ↗

GitHub PoC★ 14

a23bc/op13-cve-2026-64560

CVE-2026-64560HIGH24 set 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISCO

abrir ↗

GitHub PoC

Detailed technical analysis of CVE-2026-43284 (Dirty Frag) local privilege escalation flaw in the Linux kernel.

CVE-2026-43284HIGH24 set 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RISCO

abrir ↗

GitHub PoC★ 1

This repository contains the exploit for CVE-2026-16764.

CVE-2026-16764MEDIUM24 set 2026

OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

33RISCO

abrir ↗

GitHub PoC★ 15

watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127

CVE-2026-94127CRITICALsob ataque24 set 2026

BIG-IP APM OAuth vulnerability

83RISCO

abrir ↗

GitHub PoC★ 1

yulisec/CVE-2026-90817

CVE-2026-90817CRITICAL24 set 2026

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce

63RISCO

abrir ↗

GitHub PoC

PoC for CVE-2026-72001 — Pangolin < 1.22.0 cross-organization resource authentication bypass via the share-link access-token endpoint (CWE-639, CVSS 8.1).

CVE-2026-72001HIGH24 set 2026

Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint

41RISCO

abrir ↗

GitHub PoC★ 40

Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability

CVE-2026-84543HIGH24 set 2026

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27,

41RISCO

abrir ↗

GitHub PoC

Temporary fork of braces with a minimal security patch for CVE-2026-93687, created only to validate dependency override behavior and Fortify/FoD detection before moving the fix to an official Bentobox-owned source.

CVE-2026-93687HIGH24 set 2026

braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

41RISCO

abrir ↗

GitHub PoC★ 1

DJI Drone DUML Command Injection over Bluetooth — Proof of Concept for CVE-2026-78306

CVE-2026-78306HIGH24 set 2026

DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

41RISCO

abrir ↗

GitHub PoC

Ninja Forms unauth stored XSS POC

CVE-2026-94504HIGH24 set 2026

Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting

21RISCO

abrir ↗

GitHub PoC

CVE-2026-63030 + CVE-2026-60137 WordPress Core pre-auth RCE mass exploit

CVE-2026-63030CRITICALsob ataque24 set 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISCO

abrir ↗

GitHub PoC

UnrealIRCd 3.2.8.1 backdoor exploit — reverse shell via AB; trigger, built from scratch in Python using raw sockets. No Metasploit.

CVE-2010-2075—24 set 2026

UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally

60RISCO

abrir ↗

GitHub PoC★ 11

CVE-2026-102282: Local Privilege Escalation via SUID/SGID preservation during archive extraction

CVE-2026-102282HIGH23 set 2026

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

41RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-87902HIGHsob ataque23 set 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RISCO

abrir ↗

GitHub PoC

CVE-2026-87902 PoC — WordPress Path Traversal → LFI → Conditional RCE

CVE-2026-87902HIGHsob ataque23 set 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RISCO

abrir ↗

GitHub PoC★ 2

CVE-2026-87902: PoC for WordPress's critical path traversal

CVE-2026-87902HIGHsob ataque23 set 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RISCO

abrir ↗

GitHub PoC

Nebula-Consulting-Limited/CVE-2026-93616-PoC

CVE-2026-93616CRITICALsob ataque23 set 2026

Directory Traversal and File upload allows execution of arbitrary script on the Management Server

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.