Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
VulnCheck XDB
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC★ 45
PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC
A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header — no credentials required.
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
abrir ↗VulnCheck XDB
initial-access
Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
63RISCO
abrir ↗GitHub PoC★ 4
A POC for CVE-2026-94129
BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where
48RISCO
abrir ↗GitHub PoC★ 1
Technical details, proof of concept, and responsible disclosure timeline for CVE-2026-93528 (Unauthenticated Order Data Disclosure in NP Quote Request for WooCommerce).
NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page
28RISCO
abrir ↗VulnCheck XDB
initial-access
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
63RISCO
abrir ↗GitHub PoC
ExDev994/CVE-2026-90817
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
63RISCO
abrir ↗GitHub PoC★ 2
Unauth REDCap RCE (CVE-2026-90817) mass check PoC — requires public survey hash for full validation.
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
63RISCO
abrir ↗GitHub PoC★ 7
POC for CVE-2026-94128
BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where
48RISCO
abrir ↗GitHub PoC
Redacted notes on CVE-2026-28618 / StreamBox APV lab — heap write into a session object via FRAME height mismatch
In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote cod
41RISCO
abrir ↗GitHub PoC
Security research lab — Unauthenticated RCE via insecure deserialization in ComfyUI v0.23.0 (CVSS 9.8). Isolated Docker environment, technical analysis and documentation.
ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization
48RISCO
abrir ↗GitHub PoC★ 1
jvidhan/autofs-cve-2026-84568
A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS S
41RISCO
abrir ↗GitHub PoC★ 1
PoC exploit and scanner for CVE-2026-89026, targeting the Issabel PBXAPI authentication vulnerability
Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
63RISCO
abrir ↗GitHub PoC
Example how to use this CVE
multer vulnerable to Denial of Service via crafted multipart field names
41RISCO
abrir ↗GitHub PoC
CVE-2026-68121 PPPoEject
pppoe: reload header pointer after dev_hard_header()
41RISCO
abrir ↗GitHub PoC
Linux CVE-2026-43284 & CVE-2026-43500
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISCO
abrir ↗VulnCheck XDB
local
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
78RISCO
abrir ↗GitHub PoC
Craft CMS CVE-2026-72778 condition.config RCE PoC
Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config
41RISCO
abrir ↗GitHub PoC
Mass check/research exploit for HP HPLIP CVE-2026-91097–91106 (<3.26.6), PAPPL :8000 IPP probes + hpssd templates
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
41RISCO
abrir ↗GitHub PoC
CVE-2026-8932 PoC - incomplete mTLS config matching in conn reuse
incomplete mTLS config matching in conn reuse
41RISCO
abrir ↗GitHub PoC★ 2
Proof of concept exploit code for CVE-2026-93680
Langflow OSS is affected by multiple vulnerabilities
63RISCO
abrir ↗GitHub PoC
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
33RISCO
abrir ↗GitHub PoC
Craft CMS CVE-2026-72781 Twig sandbox escape RCE PoC
Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
41RISCO
abrir ↗GitHub PoC★ 31
Proof of concept for CVE-2026-43786, a local privilege escalation vulnerability in macOS CoreServices that allows an application to gain root privileges.
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia
41RISCO
abrir ↗GitHub PoC
Arbitrary File Upload Under
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
63RISCO
abrir ↗GitHub PoC★ 21
This repository documents the VectorFreed RCE chain and includes a PoC for CVE-2026-96889.
Librsvg: use-after-free when xml includes have duplicated entities
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.