Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
79.781exploits catalogados
36.771CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.475Referência 23.305GitHub PoC 15.197VulnCheck XDB 8.932Nuclei 4.379Metasploit 3.493✓ só verificadosrecentespopularesrisco
79.386 exploits
GitHub PoC
POC for CVE-2026-41042
Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter
63RISCO
abrir ↗Exploit-DB
NanaZip 6.5 - DoS
NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size
28RISCO
abrir ↗VulnCheck XDB
local
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "
71RISCO
abrir ↗VulnCheck XDB
remote-with-credentials
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
100RISCO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗VulnCheck XDB
initial-access
Gitea Docker image trusts spoofable reverse-proxy headers by default
63RISCO
abrir ↗GitHub PoC
Unauthenticated SQL Injection via Attribute Filter in Phoca Cart - CVSS 9.3
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6
48RISCO
abrir ↗Exploit-DB
WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
68RISCO
abrir ↗GitHub PoC★ 1
ZendTo unauthenticated ClamAV CVE-2026-20217 RCE and default-profile root escalation reproduction
ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerability
41RISCO
abrir ↗Exploit-DB
phpSysInfo 3.4.5 - IP Allowlist Bypass
phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
41RISCO
abrir ↗GitHub PoC
CVE-2026-74943, Use after free in Firefox RasterImage (sec-high)
Use-after-free in the Graphics: ImageLib component
48RISCO
abrir ↗GitHub PoC
Isolated Docker lab, static detection scanner, and PoC validation for React2Shell (CVE-2025-55182).
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
CVE-2026-68138 Linux Local Privilege Escalation Exploit
net/sched: serialize qdisc_rtab_list against concurrent get/put
41RISCO
abrir ↗GitHub PoC
CVE-2026-33017, vuln in langflow.
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISCO
abrir ↗Exploit-DB
Joomla JCE_2.9.15 - Remote Code Execution
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISCO
abrir ↗GitHub PoC
katranSefa/CVE-2026-13714
Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
48RISCO
abrir ↗GitHub PoC
iPad 8 iPadOS 26.3 AVE toolchain research (CVE-2026-64747 class)
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iO
41RISCO
abrir ↗VulnCheck XDB
initial-access
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISCO
abrir ↗GitHub PoC
Tracking CVE-2026-68138, the Linux kernel net/sched qdisc rate-table use-after-free
net/sched: serialize qdisc_rtab_list against concurrent get/put
41RISCO
abrir ↗GitHub PoC
CVE-2026-15826, CVE-2026-15748
User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
63RISCO
abrir ↗GitHub PoC
CVE-2026-19650, CVE-2026-19478 - Draft or TODO
Cross-Site Request Forgery (CSRF) in GitLab
41RISCO
abrir ↗GitHub PoC
golang.org/x/text v0.33.0 backport of CVE-2026-56852 (GO-2026-5970) for Go 1.24
Infinite loop on invalid input in golang.org/x/text
41RISCO
abrir ↗GitHub PoC
CVE-2026-74945, Uninitialized heap disclosure via a crafted web font (sec-high)
Information disclosure in the Graphics: Text component
33RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-62737 ExecutionContext.sys arbitrary kernel-call PoC
Windows Kernel Elevation of Privilege Vulnerability
41RISCO
abrir ↗Exploit-DB
webpack_devserver 5.2.5 - CSRF
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
33RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.