Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

80.324exploits catalogados

37.130CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.476Referência 23.614GitHub PoC 15.330VulnCheck XDB 9.001Nuclei 4.401Metasploit 3.502✓ só verificadosrecentes populares risco

80.324 exploits

GitHub PoC

Multi-VLAN virtual network across 10 VMs: GRE tunneling, nftables firewall, Active Directory, BIND9 DNS, Kea DHCP, Docker web services, SMB file sharing. Vulnerability assessment using OWASP ZAP (Stored XSS) and Nessus (CVE-2017-0144 EternalBlue). Validated with Wireshark.

CVE-2017-0144HIGHsob ataqueransomware20 abr 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISCO

GitHub PoC

Black-box test whether an LLM chatbot is vulnerable to markdown/HTML exfil (CVE-2025-32711 class). Spins up a sink, sends payloads, renders in headless Chromium, correlates via network.

CVE-2025-32711CRITICAL20 abr 2026

M365 Copilot Information Disclosure Vulnerability

48RISCO

Metasploit300

BerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner

CVE-2026-42208CRITICALsob ataque20 abr 2026

LiteLLM: SQL injection in Proxy API key verification

100RISCO

GitHub PoC

Professional vulnerability assessment of a multi-VLAN enterprise network (student21.local). Confirmed Stored XSS on WebGoat (HIGH, 16) via OWASP ZAP fuzzer, absent XSS on Magento via server sanitization, and CVE-2017-0144 EternalBlue on Metasploitable 3 (CRITICAL, 25) via Nessus + Wireshark PCAP validation.

CVE-2017-0144HIGHsob ataqueransomware20 abr 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISCO

GitHub PoC★ 1

The forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO).

CVE-2025-58434CRITICAL20 abr 2026

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

75RISCO

VulnCheck XDB

initial-access

CVE-2024-3400CRITICALsob ataqueransomware20 abr 2026

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

100RISCO

VulnCheck XDB

local

CVE-2021-3493HIGHsob ataque20 abr 2026

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o

98RISCO

GitHub PoC

We hope to reproduce CVE-2021-41773 to deepen our understanding of real-world cybersecurity vulnerabilities so that we can be knowledgeable about exploits in industry and academic work.

CVE-2021-41773HIGHsob ataqueransomware20 abr 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

VulnCheck XDB

initial-access

CVE-2026-33017CRITICALsob ataque20 abr 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RISCO

GitHub PoC★ 1

Jorrit-VM/CVE-2026-33017

CVE-2026-33017CRITICALsob ataque20 abr 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RISCO

GitHub PoC

CVE-2026-33017

CVE-2026-33017CRITICALsob ataque19 abr 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RISCO

GitHub PoC

Exploiting Bluekeep (CVE-2019-0708) on windows 7 using metasploit (Esucational lab)

CVE-2019-0708CRITICALsob ataqueransomware19 abr 2026

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau

100RISCO

GitHub PoC★ 3

Cyb3rCr0wCC/cve-2017-11176

CVE-2017-11176—19 abr 2026

The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retr

23RISCO

GitHub PoC

rediscovered tplink nday xp (CVE-2023-33538)

CVE-2023-33538HIGHsob ataque19 abr 2026

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerabili

83RISCO

VulnCheck XDB

initial-access

CVE-2026-35616CRITICALsob ataque19 abr 2026

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta

100RISCO

VulnCheck XDB

remote-with-credentials

CVE-2023-33538HIGHsob ataque19 abr 2026

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerabili

83RISCO

GitHub PoC

NetVanguard-cmd/CVE-2025-61882

CVE-2025-61882CRITICALsob ataqueransomware19 abr 2026

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integratio

100RISCO

GitHub PoC

NetVanguard-cmd/CVE-2025-55315

CVE-2025-55315CRITICAL19 abr 2026

ASP.NET Security Feature Bypass Vulnerability

60RISCO

GitHub PoC

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability

CVE-2026-39987CRITICALsob ataque18 abr 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISCO

GitHub PoC★ 14

Cockpit: Unauthenticated Remote Code Execution via SSH Command-Line Argument Injection

CVE-2026-4631CRITICAL18 abr 2026

Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

68RISCO

GitHub PoC

jithinodattu/CVE-2007-4559-lab

CVE-2007-4559CRITICAL18 abr 2026

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows

53RISCO

GitHub PoC

Security research & exploitation analysis of CVE-2025-55182 (React) — CVSS + OWASP Top 10 mapping

CVE-2025-55182CRITICALsob ataqueransomware18 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

VulnCheck XDB

initial-access

CVE-2025-13342CRITICAL18 abr 2026

Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update

63RISCO

GitHub PoC★ 1

CVE-2026-22241

CVE-2026-22241HIGH18 abr 2026

Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)

41RISCO

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALsob ataque18 abr 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISCO

VulnCheck XDB

initial-access

CVE-2026-39808CRITICALsob ataque18 abr 2026

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

100RISCO

VulnCheck XDB

initial-access

CVE-2026-4631CRITICAL18 abr 2026

Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

68RISCO

VulnCheck XDB

initial-access

CVE-2025-15030CRITICAL18 abr 2026

User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset

48RISCO

VulnCheck XDB

initial-access

CVE-2026-27542CRITICAL18 abr 2026

WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability

63RISCO

VulnCheck XDB

initial-access

CVE-2026-1492CRITICAL18 abr 2026

User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration

68RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.