Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.056exploits catalogados

40.804CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentes populares risco

88.056 exploits

GitHub PoC★ 5

composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Magento, via cweagans/composer-patches. Auto-selects the patch for your Magento version.

CVE-2026-75650CRITICALsob ataque08 set 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

100RISCO

VulnCheck XDB

local

CVE-2009-2692—08 set 2026

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socke

43RISCO

GitHub PoC

composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Mage-OS stores, via cweagans/composer-patches. Companion to stylesmuggler-adobe-patches (Magento).

CVE-2026-75650CRITICALsob ataque08 set 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

100RISCO

GitHub PoC

Public reference for CVE-2026-52307

CVE-2026-52307MEDIUM08 set 2026

An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.

33RISCO

GitHub PoC

CVE-2026-59903 / CVE-2026-33870: offline checker for io.netty:netty-codec-http - its 14 CVEs plus 9 advisories Netty published on 2026-09-10 that the GitHub Advisory Database (Dependabot) does not list. 4.1.137.Final / 4.2.17.Final is no longer enough; upgrade to 4.1.138.Final / 4.2.18.Final.

CVE-2026-59903MEDIUM08 set 2026

Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

33RISCO

VulnCheck XDB

initial-access

CVE-2026-19949HIGH08 set 2026

All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

41RISCO

GitHub PoC

CVE-2025-58434 - Flowise (CVE-2025-58434) unauthenticated account takeover via password-reset token disclosure

CVE-2025-58434CRITICAL08 set 2026

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

85RISCO

GitHub PoC

CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight deserialization

CVE-2025-55182CRITICALsob ataqueransomware08 set 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

⚡ GHOSTLYR00T - CVE-2026-82222 GiveWP RCE Exploit Framework Unauthenticated RCE on GiveWP <= 4.16.7.1. Mass scanning, auto-detection (form/gateway/amount), multi-threading, JSON/TXT output, interactive shell. CVSS 9.8 Critical. ⚠️ Authorized testing only.

CVE-2026-82222CRITICAL08 set 2026

WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

63RISCO

GitHub PoC★ 8

CVE-2026-85046 | Chrome V8 Type Confusion in Inline Array.prototype.sort (Maglev/Turbofan) | CVSS 8.8 | CWE-843 | Chrome < 152.0.7977.82

CVE-2026-85046HIGHsob ataque08 set 2026

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

71RISCO

GitHub PoC★ 9

Marimo Pre Authentication RCE

CVE-2026-39987CRITICALsob ataque08 set 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISCO

VulnCheck XDB

initial-access

CVE-2014-9222—08 set 2026

AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows re

60RISCO

GitHub PoC

CVE-2026-83548, CVE-2026-83549, - Draft or TODO - https://github.com/rapid7/metasploit-framework/pull/21883

CVE-2026-83548CRITICALsob ataque08 set 2026

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

93RISCO

VulnCheck XDB

info-leak

CVE-2015-3306CRITICALsob ataque08 set 2026

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

100RISCO

GitHub PoC★ 1

Writeup/finding of CVE-2026-24061 within the Cyberhawks lab

CVE-2026-24061CRITICALsob ataque08 set 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

GitHub PoC★ 5

PoC funcional de CVE-2026-19949 (AIOWPM): SQLi de segundo orden no autenticada en All-in-One WP Migration <= 7.109 via regex de replace_table_values. Laboratorio Docker + payload derivado (leak de ai1wm_secret_key por REST anonima) + RCE con importacion anonima.

CVE-2026-19949HIGH08 set 2026

All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

41RISCO

VulnCheck XDB

local

CVE-2009-3547—08 set 2026

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of servi

23RISCO

VulnCheck XDB

remote-with-credentials

CVE-2017-17215—08 set 2026

Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could se

45RISCO

VulnCheck XDB

initial-access

CVE-2018-14847CRITICALsob ataque08 set 2026

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated

100RISCO

GitHub PoC

Bluex707/React2Shell-CVE-2025-55182-Exploit

CVE-2025-55182CRITICALsob ataqueransomware07 set 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

Reproducible Docker lab + raw-socket exploit for CVE-2015-3306 (ProFTPD mod_copy pre-auth arbitrary file copy) — a patch-diffing learning exercise

CVE-2015-3306CRITICALsob ataque07 set 2026

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

100RISCO

GitHub PoC

This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox credential leak), and the CVE-2021-27101 / CVE-2021-27102 exploit chain (Accellion FTA).

CVE-2017-17215—07 set 2026

Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could se

45RISCO

GitHub PoC

This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox credential leak), and the CVE-2021-27101 / CVE-2021-27102 exploit chain (Accellion FTA).

CVE-2018-14847CRITICALsob ataque07 set 2026

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated

100RISCO

GitHub PoC

Eliot-code/CVE-2026-85046

CVE-2026-85046HIGHsob ataque07 set 2026

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

71RISCO

GitHub PoC

Linux Kernel Exploits -> CVE-2006-2451 + CVE-2006-3626

CVE-2006-2451—07 set 2026

The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a l

23RISCO

GitHub PoC

BlueGate Exploit validator - RD Gateway validator for CVE-2020-0609 and CVE-2020-0610 (BlueGate) using OpenSSL DTLS over UDP/3391.

CVE-2020-0609—07 set 2026

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated atta

45RISCO

GitHub PoC

Buffer overflow in FreeFloat FTP Server 1.0

CVE-2025-5548MEDIUM07 set 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RISCO

GitHub PoC

Log4Shell (CVE-2021-44228) exploitation from a Kali VM against a vulnerable containerized app, with Splunk-based detection engineering and validated remediation. Covers the full attack lifecycle: exploitation, JNDI and host-level auditd detection, and before/after remediation proof.

CVE-2021-44228CRITICALsob ataqueransomware07 set 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

GitHub PoC

iurhfiu6/CVE-2021-4034

CVE-2021-4034HIGHsob ataqueransomware07 set 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISCO

GitHub PoC

Linux Kernel Exploits -> CVE-2008-0600 + CVE-2008-0900 + CVE-2008-4210

CVE-2008-0600—07 set 2026

The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer befo

23RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.