Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
GitHub PoC
e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-32432
Craft CMS Allows Remote Code Execution
100RISCO
abrir ↗GitHub PoC★ 1
PoC and write-up for the HackTheBox "Nexus" privilege escalation: root-run Gitea template-sync service vulnerable to path traversal via forged Git objects. Educational use only.
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-85706 — GitLab unauthenticated arbitrary file read (CVSS 10.0). Root-cause analysis, vulnerable Docker lab, and PoC.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗VulnCheck XDB
remote-with-credentials
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RISCO
abrir ↗VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗VulnCheck XDB
client-side
Git allows arbitrary code execution through broken config quoting
71RISCO
abrir ↗VulnCheck XDB
initial-access
Anonymous user token generation exposure in JFrog Artifactory
66RISCO
abrir ↗VulnCheck XDB
initial-access
Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
56RISCO
abrir ↗GitHub PoC
miniOrange 2FA CVE POC
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator
48RISCO
abrir ↗VulnCheck XDB
initial-access
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISCO
abrir ↗Metasploit600
Cisco Secure Email Gateway S/MIME SQL Injection RCE
Cisco Secure Email Gateway Security Hardening Release
43RISCO
abrir ↗Metasploit600
Cisco Secure Email Gateway ECS Message-ID SQL Injection RCE
Cisco Secure Email Gateway SQL Injection Vulnerability
100RISCO
abrir ↗GitHub PoC
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RISCO
abrir ↗VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗GitHub PoC
vudangducminh/CVE-2016-5195
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISCO
abrir ↗GitHub PoC
OpenMAIC 1.0.0: Unauthenticated Outbound SSRF to Cloud Metadata Service via Fail-Open Middleware and Environment-Gated Validation Bypass
OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation
48RISCO
abrir ↗VulnCheck XDB
local
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISCO
abrir ↗GitHub PoC
CVE-2026-85706 — GitLab unauthenticated arbitrary file read (CVSS 10.0). Root-cause analysis, vulnerable Docker lab, and PoC.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗VulnCheck XDB
denial-of-service
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
71RISCO
abrir ↗GitHub PoC
My implementation of the
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-85706 · GitLab CE/EE unauthenticated file read · research PoC with oracle mode, fd enumeration, and tiered loot targeting
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗GitHub PoC
CVE-2026-65343 PoC — AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71)
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.
41RISCO
abrir ↗VulnCheck XDB
initial-access
User Authentication Bypass in VPN Remote Access and Mobile Access
100RISCO
abrir ↗GitHub PoC
Safe local proof of concept for the Cotonti CommentsWidget PHP object injection vulnerability (CAN-2026-2035973 / CVE-2026-71294).
Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions
41RISCO
abrir ↗VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.