Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
87.464exploits catalogados
40.695CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4.577Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.464 exploits
VulnCheck XDB
initial-access
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RISCO
abrir ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗VulnCheck XDB
initial-access
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RISCO
abrir ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
CVE-2026-118569 — any editor could publish every draft on a Drupal site
Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282
33RISCO
abrir ↗GitHub PoC★ 2
Exploit para explotar la vulnerabilidad CVE-2026-123158 (conocida como sshole).
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC★ 2
Microsoft Paint CVE-2026-83844 Verification Script
Windows Paint Remote Code Execution Vulnerability
41RISCO
abrir ↗VulnCheck XDB
local
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
76RISCO
abrir ↗VulnCheck XDB
remote-with-credentials
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the functio
35RISCO
abrir ↗GitHub PoC
Find which images and containers run a vulnerable Alpine + OpenSSH combination (CVE-2026-123158) — five-condition check, zero network, first-hour playbook.
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC★ 1
Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation | RCE
AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
48RISCO
abrir ↗GitHub PoC
openssh-musl-enterprise-hardening (CVE-2026-123158)
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
Prova de conceito para exploração da vulnerabilidade CVE-2026-123158.
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
OpenSSH sshole(CVE-2026-123158) 알파인 sshd 점검을 벨로키와 쉽게 보기
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
ansonhsu-ai/sshhole-cve-2026-123158-ste
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
Automated Terraform lab environment for OpenSSH on Linux with musl libc without PAM (CVE-2026-123158 research)
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
sshole漏洞复现，CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
CVE-2026-114630 - ELEX HelpDesk <= 3.3.8 unauthenticated arbitrary file deletion (PoC + exploit by thiscitze)
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter
45RISCO
abrir ↗GitHub PoC
A scanner for *sshole SSH vulnerability (CVE-2026-123158)
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
3jee/CVE-2026-120491
Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page
33RISCO
abrir ↗GitHub PoC
Ansible playbook that upgrades OpenSSH to 10.6p2 on Alpine Linux to remediate CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
Detection-only local triage for Apache OFBiz CVE-2026-83542 (CVSS 9.8) and the 24.09.08 batch — grades installs against the fixed release. No probing, no payloads.
Apache OFBiz: Unauthenticated RCE via login-page widget injection
48RISCO
abrir ↗GitHub PoC
Vulnerability research, PoC reproduction lab, and technical analysis for Alpine Linux OpenSSH authentication bypass (CVE-2026-123158 / sshole)
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
POC exploit for CVE-2026-123488 - unauthenticated SQL injection vulnerability in Craft CMS (MySQL/MariaDB backend). Admin takeover.
Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint
45RISCO
abrir ↗GitHub PoC★ 1
sshole (CVE-2026-123158): OpenSSH password bypass on alpine Linux
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
OS command injection as root via Google Cloud DNS challenge key
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-c
48RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.