Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.871exploits catalogados
40.961CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentespopularesrisco
88.871 exploits
GitHub PoC★ 1
Generic kernel live patch for the KVM/x86 shadow-MMU use-after-free (Zapscape, CVE-2026-64561)
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
41RISCO
abrir ↗GitHub PoC★ 1
PoC for CVE-2026-71554 - h2 duplicate Host header request smuggling primitive (fixed in 4.4.1)
h2: Duplicate Host header could facilitate request smuggling
33RISCO
abrir ↗VulnCheck XDB
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
abrir ↗VulnCheck XDB
initial-access
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISCO
abrir ↗GitHub PoC★ 5
CVE-2026-64638 — WordPress Pre-Auth Reflected XSS → RCE via DOM Clobbering + Application Password Theft + REST API Plugin Activation. Dual-mode PoC (XSS chain & direct).
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
56RISCO
abrir ↗GitHub PoC
0init/CVE-2026-45185
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing p
48RISCO
abrir ↗VulnCheck XDB
initial-access
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RISCO
abrir ↗GitHub PoC★ 20
Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RISCO
abrir ↗GitHub PoC
log4j 2025/2026 年 7 条「配置静默失效」CVE 自查:按 CVE×模块 判定 4 个模块,结构化解析 log4j2 配置做 applicability 降噪,并算出该升到哪个版本才一次到位(6 条写 2.25.4,但有一条要 2.25.5,而它 Dependabot 报不出来) CVE-2026-49844 / CVE-2026-34477
Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()
33RISCO
abrir ↗GitHub PoC
Hunt-Benito/one-multiply-too-many-cve-2026-70638-llama-cpp-android-jni-integer-overflow
llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp
21RISCO
abrir ↗GitHub PoC★ 2
Guest-to-host KVM/x86 escape exploiting CVE-2026-64561, delivering a full PoC chain and analysis for security researchers.
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
41RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
56RISCO
abrir ↗GitHub PoC★ 3
CVE-2026-64561
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
41RISCO
abrir ↗VulnCheck XDB
initial-access
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra
100RISCO
abrir ↗GitHub PoC
jackson-databind 2026 年 15 条安全公告自查:含 4 条 GitHub 全局库未收录、Dependabot 不报的;扫源码降噪告诉你真中几条;逐条求交集给出真正到位的版本(2.18.10/2.21.6/3.1.6,2.21.5 已不够) CVE-2026-54515 / CVE-2026-54512
jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
33RISCO
abrir ↗GitHub PoC
Reproducible Docker lab for the Apache Tomcat JNDIRealm GSSAPI authentication bypass
Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
41RISCO
abrir ↗GitHub PoC
CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
56RISCO
abrir ↗GitHub PoC
Hunt-Benito/go-without-bounds-cve-2026-67822-stack-overflow-in-tenda-w6-s-wifissidset
Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The fu
48RISCO
abrir ↗GitHub PoC★ 1
Advanced React Server Components RCE scanner for CVE-2025-55182. Features: multi-stage fingerprinting, vulnerability verification, DNS exfiltration, interactive shell, payload obfuscation, and professional reporting (JSON/HTML/PDF). Authorized testing only.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-11961 — UserRegistration: WordPress User Registration <= 5.2.2 Privilege Escalation. Misconfigured Membership Roles → Unauthenticated Admin Creation → Site Compromise. CVSS 8.1
User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID
41RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-44613
Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling
33RISCO
abrir ↗GitHub PoC
Wormable exploit for CVE-2026-57858
Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID
48RISCO
abrir ↗GitHub PoC★ 7
ghostlock + tcp-zerocopy hybrid CVE-2026-43499 adaptation for samsung kernel
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗GitHub PoC★ 1
Hands-on homelab simulating the Log4Shell (CVE-2021-44228) vulnerability. Deploy Docker containers to build a vulnerable target and attacker machine, execute the exploit, and implement security mitigations. Perfect for learning offensive security and application hardening.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗GitHub PoC
Tracking Zapscape (CVE-2026-64561), the KVM/x86 shadow-MMU guest-to-host escape
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
41RISCO
abrir ↗GitHub PoC
Exploit KVM/x86 guest-to-host escape CVE-2026-64561 with Zapscape, a proof-of-concept demonstrating hypervisor vulnerability.
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
41RISCO
abrir ↗GitHub PoC
Shams-Ul-Mehmood/CVE-2021-3156-Project
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.