Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
87.464exploits catalogados
40.695CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4.577Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.464 exploits
GitHub PoC★ 1
CVE-2026-109566 (CVSS 9.8) — Rapyd Admin 9.0.0 < 9.20.0 hard-coded super-admin credentials via AuthSeeder (admin@laravel / admin). Standalone exploit PoC.
Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder
48RISCO
abrir ↗GitHub PoC
Interim nftables mitigation for CVE-2026-98432, automatic rollback and Russian administrator guide. Not a kernel patch.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISCO
abrir ↗GitHub PoC★ 8
Read-only patch-state and exposure check for CVE-2026-98432 (Linux kernel IPv4 TCP use-after-free, CVSS 9.8), with opt-in interim mitigation and exact rollback.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISCO
abrir ↗GitHub PoC
Offline Python inventory detector for Oracle Java and GraalVM builds affected by CVE-2026-114820.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE
48RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-106378 is a privilege escalation in the Google Chrome sandbox on macOS. An attacker who has already compromised the renderer process can execute arbitrary code **outside the sandbox** via a crafted HTML page.
Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compr
41RISCO
abrir ↗GitHub PoC★ 1
VeloCloud Orchestrator session elevation + unsanitized diagnostics RCE
Security Advisory 0199
78RISCO
abrir ↗GitHub PoC
PHP2Shell CVE-2026-109618 and CVE-2026-109619 research and isolated RCE lab
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
PHP脆弱性（PHP2Shell: CVE-2026-109618 / CVE-2026-109619）緊急対応プランのランディングページ
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
isukasanuj/CVE-2026-92744
Delinea Privilege Manager agent unauthenticated remote code execution vulnerability
41RISCO
abrir ↗GitHub PoC★ 4
CVE-2026-103688: Checkout Files Upload for WooCommerce < 2.4.0 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).
Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
48RISCO
abrir ↗GitHub PoC★ 1
Crash-only public-API reproducer for CVE-2026-112705 in AVEVideoEncoder
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 2
33RISCO
abrir ↗GitHub PoC
Pre-auth PHP RCE framework for CVE-2026-109618/619 — ArchonX_DeadLock_Security
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
CVE-2026-103056 (CVSS 4.0 9.4 Critical) — AiSOC < 12.0.0 OS command injection into CrowdStrike RTR command strings. Verified standalone PoC.
AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR
48RISCO
abrir ↗GitHub PoC
krevetkqqq/CVE-2026-82384
Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
48RISCO
abrir ↗GitHub PoC
Nucklear/CVE-2026-111497-working
Out-of-Bounds Write in Google Brotli Decoder
70RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-98432: a plain IPv4 TCP server is vulnerable, MPTCP is not the trigger. Bug trigger, evidence and analysis.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISCO
abrir ↗GitHub PoC★ 1
This is a fork of vinaykumar´s poc for CVE-2026-112621. This is for educational purposes only. I am only using this to host the website so that I can try the poc
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2
41RISCO
abrir ↗GitHub PoC
Offline Python detector for Rclone version exposure to CVE-2026-116191.
Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
41RISCO
abrir ↗GitHub PoC
Detection-only triage for GitLab CVE-2026-97229 (and CVE-2026-110264): grade a self-managed GitLab version plus its Ruby, catch the Oct-12-patch and custom-Ruby traps. No payloads, no network probes.
Integer Overflow or Wraparound in GitLab
100RISCO
abrir ↗GitHub PoC
krevetkqqq/CVE-2014-8361
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClien
100RISCO
abrir ↗GitHub PoC
Offline Python detector for CVE-2026-116165 using Parse Server versions and database backend inventory.
Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
21RISCO
abrir ↗GitHub PoC
Authenticated Stored XSS via SafeUrlValidator bypass on the rich-text render path in Spina CMS (<= 2.21.0). Payload executes on the public site. CVE-2026-117182.
An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 all
33RISCO
abrir ↗GitHub PoC
Unauthenticated Denial of Service (DoS) via GraphQL alias overloading in Traggo server v0.8.3. Pins CPU and exhausts memory without requiring authentication. CVE-2026-117184.
An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a craft
41RISCO
abrir ↗GitHub PoC★ 2
Temporary root for the Vivo iQOO 13 via CVE-2026-98260 posix-cpu-timer UAF, with KernelSU and FinaSU late-load
exec: Cleanup POSIX timers right after de_thread()
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.