Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.871exploits catalogados

40.961CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentes populares risco

88.871 exploits

GitHub PoC

PoC reproducer for CVE-2026-56139 (Apache Camel camel-undertow Rest DSL): the Rest DSL binding hard-codes muteException=false, so a configured muteException=true is ignored and an uncaught exception's full stack trace is returned to the client (CWE-209). Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-56139MEDIUM22 jul 2026

Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients

33RISCO

GitHub PoC

CVE-2026-50055 - Draft

CVE-2026-50055MEDIUM22 jul 2026

Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion

33RISCO

GitHub PoC★ 3

CVE-2026-6875 ServiceNow Pre-Auth RCE Framework | JS Injection → Sandbox Escape → RCE → Root. Features: --detect, --exec, reverse/interactive shell, batch threading, WAF bypass, persistence, lateral movement, credential dump, fileless exec, clean tracks. CVSS 9.5 actively exploited. Authorized & Legal use only. Stay Legal.

CVE-2026-6875CRITICAL21 jul 2026

Sandbox Escape in ServiceNow AI Platform

63RISCO

GitHub PoC

Mofarthim/CVE-2026-50369

CVE-2026-50369HIGH21 jul 2026

Windows Remote Desktop Services Elevation of Privilege Vulnerability

41RISCO

GitHub PoC

WhatsWrongAndWhy/CVE-2017-1000112

CVE-2017-1000112—21 jul 2026

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE

43RISCO

GitHub PoC

PoC reproducer for CVE-2026-49365 (Apache Camel camel-netty-http / camel-undertow): muteException defaults to false, so an uncaught exception's full Java stack trace is returned to the HTTP client (CWE-209). Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-49365MEDIUM21 jul 2026

Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients

33RISCO

GitHub PoC

Drop-in fix for the unpatched MCP STDIO command-injection flaw (CVE-2026-30623 family)

CVE-2026-30623CRITICAL21 jul 2026

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application

63RISCO

GitHub PoC

WhatsWrongAndWhy/CVE-2021-22555

CVE-2021-22555HIGHsob ataque21 jul 2026

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

100RISCO

VulnCheck XDB

initial-access

CVE-2026-9198CRITICALsob ataque21 jul 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

98RISCO

VulnCheck XDB

info-leak

CVE-2025-14847HIGHsob ataque21 jul 2026

Zlib compressed protocol header length confusion may allow memory read

100RISCO

GitHub PoC

WhatsWrongAndWhy/CVE-2018-5333

CVE-2018-5333—21 jul 2026

In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning

38RISCO

GitHub PoC★ 4

Analysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030

CVE-2026-60137MEDIUMsob ataque21 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RISCO

GitHub PoC

WhatsWrongAndWhy/CVE-2021-3156

CVE-2021-3156HIGHsob ataque21 jul 2026

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISCO

GitHub PoC

my exploit for GLPI

CVE-2022-35914CRITICALsob ataque21 jul 2026

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

100RISCO

GitHub PoC

mass_cve-2021-41773

CVE-2021-41773HIGHsob ataqueransomware21 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

GitHub PoC★ 6

Exploit, POC for CVE-2025-32432, CraftCMS2Shell

CVE-2025-32432CRITICALsob ataque21 jul 2026

Craft CMS Allows Remote Code Execution

100RISCO

GitHub PoC

danielissaq/-PaperCut-CVE-2023-27350-

CVE-2023-27350CRITICALsob ataqueransomware21 jul 2026

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui

100RISCO

GitHub PoC

CVE-2026-43499

CVE-2026-43499HIGH21 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC

PoC reproducer for CVE-2026-49099 (Apache Camel camel-salesforce): the non-Camel-prefixed sObjectQuery header escapes the HTTP header filter and overrides the producer's configured SOQL (SOQL injection / broken access control). Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-49099MEDIUM21 jul 2026

Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour

33RISCO

GitHub PoC

WhatsWrongAndWhy/CVE-2017-16995

CVE-2017-16995—21 jul 2026

The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial

50RISCO

GitHub PoC

Mirrored from tegal1337/CVE-2022-0441

CVE-2022-0441—21 jul 2026

MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation

60RISCO

GitHub PoC

CVE-2026-13233 (Drupal OpenAI Provider, SA-CONTRIB-2026-053): response-URL SSRF / local file read. Untrusted upstream, not the prompt. Safe reproducer + detections. Fixed in 1.1.1/1.2.2.

CVE-2026-13233LOW21 jul 2026

OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053

28RISCO

VulnCheck XDB

initial-access

CVE-2026-60137MEDIUMsob ataque21 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RISCO

GitHub PoC★ 1

PoC for CVE-2026-57588 - SQL injection in Nessus 10.12.0 XML import. Generates malicious .nessus files to enumerate databases, exfiltrate credentials, and test time-based blind injection. For authorized security research. Author: Sudeepa Wanigarathna. Patched in 10.12.1.

CVE-2026-57588LOW21 jul 2026

SQL Injection in Nessus via Malicious Scan Result File Import

28RISCO

VulnCheck XDB

initial-access

CVE-2026-60137MEDIUMsob ataque21 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RISCO

GitHub PoC

CVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)

CVE-2026-60137MEDIUMsob ataque21 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RISCO

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALsob ataqueransomware21 jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

WhatsWrongAndWhy/CVE-2018-18955

CVE-2018-18955—21 jul 2026

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat

38RISCO

VulnCheck XDB

denial-of-service

CVE-2026-41089CRITICAL21 jul 2026

Windows Netlogon Remote Code Execution Vulnerability

70RISCO

VulnCheck XDB

initial-access

CVE-2025-32432CRITICALsob ataque21 jul 2026

Craft CMS Allows Remote Code Execution

100RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.