Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.871exploits catalogados
40.961CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentespopularesrisco
88.871 exploits
GitHub PoC
IhsSpotlight/HeartBleed-CVE-2014-0160--SCRIPTS-python3
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISCO
abrir ↗VulnCheck XDB
initial-access
Improper Control of Generation of Code ('Code Injection') in GitLab
63RISCO
abrir ↗GitHub PoC
Technical analysis and clean Java Thread Echo PoC for Oracle WebLogic Server vulnerability chain.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISCO
abrir ↗VulnCheck XDB
info-leak
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISCO
abrir ↗GitHub PoC★ 11
CVE-2026-19478 PoC . Unauthenticated remote code-injection in GitLab's GraphQL layer
Improper Control of Generation of Code ('Code Injection') in GitLab
63RISCO
abrir ↗GitHub PoC
kaleth4/CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
56RISCO
abrir ↗GitHub PoC
codeb0ssx/CVE-2026-64849-PoC
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
98RISCO
abrir ↗GitHub PoC
TP-Link Archer BE800 V1 — Parental Control LAN RCE
Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices
41RISCO
abrir ↗GitHub PoC★ 3
CVE-2026-14669 - PostgreSQL to_char() timezone abbreviation heap buffer overflow PoC; for authorized security testing
PostgreSQL to_char heap buffer overflow executes arbitrary code
41RISCO
abrir ↗GitHub PoC★ 3
CVE-2026-15748 - Unauthenticated RCE exploit for WordPress Forminator plugin (≤1.56.1). Automated detection, deep crawl, nonce extraction, and safe upload test. For authorized testing only.
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
48RISCO
abrir ↗GitHub PoC★ 3
CVE-2026-65400
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS
83RISCO
abrir ↗GitHub PoC
CVE-2026-74970, Fission site isolation bypass in Firefox WebRender
Site isolation issue in the Graphics component
33RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-71518 — Typemill <2.26.0 unauthenticated authorization bypass in media file download (path-equivalent URL variants). Advisory + PoC.
Typemill < 2.26.0 Authorization Bypass via Media File Download Route
41RISCO
abrir ↗GitHub PoC★ 29
Linux Binder binder_free_transaction() process-lifetime use-after-free (CVE-2026-64468): unprivileged PoC + x86_64 LPE. Authorised security research.
binder: fix UAF in binder_free_transaction()
41RISCO
abrir ↗GitHub PoC
Tracking CVE-2026-68138, the Linux kernel net/sched qdisc rate-table use-after-free
net/sched: serialize qdisc_rtab_list against concurrent get/put
41RISCO
abrir ↗GitHub PoC
CVE-2026-74945, Uninitialized heap disclosure via a crafted web font (sec-high)
Information disclosure in the Graphics: Text component
33RISCO
abrir ↗GitHub PoC★ 1
Rce In synaptikcms
synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload
33RISCO
abrir ↗Exploit-DB
NanaZip 6.5 - DoS
NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size
28RISCO
abrir ↗GitHub PoC
Unauthenticated SQL Injection via Attribute Filter in Phoca Cart - CVSS 9.3
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6
48RISCO
abrir ↗GitHub PoC
CVE-2026-15826, CVE-2026-15748
User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
63RISCO
abrir ↗GitHub PoC
Isolated Docker lab, static detection scanner, and PoC validation for React2Shell (CVE-2025-55182).
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗Exploit-DB
WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
75RISCO
abrir ↗GitHub PoC★ 6
A poc and write-up for CVE-2026-40345
deepmerge-ts: Stack exhaustion when merging recursive object graphs
41RISCO
abrir ↗VulnCheck XDB
initial-access
Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
41RISCO
abrir ↗GitHub PoC★ 1
ZendTo unauthenticated ClamAV CVE-2026-20217 RCE and default-profile root escalation reproduction
ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerability
41RISCO
abrir ↗GitHub PoC
CVE-2026-74943, Use after free in Firefox RasterImage (sec-high)
Use-after-free in the Graphics: ImageLib component
48RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.