Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
84.035exploits catalogados
39.531CVEs com exploração pública
24.695testados em laboratório
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9.678Nuclei 4.478Metasploit 3.524✓ só verificadosrecentespopularesrisco
16.249 exploits
GitHub PoC
Frappe HRMS missing input validation SQL injection vulnerability
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
41RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-97229: GitLab RCE Unauthenticated via CI Lint
Integer Overflow or Wraparound in GitLab
48RISCO
abrir ↗GitHub PoC
BIBILZERODAY/CVE-2026-104736---Proof-of-Concept-PoC-Exploit-Details
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
48RISCO
abrir ↗GitHub PoC
A read-only, passive scanner that checks a REDCap host for exposure to and compromise by **CVE-2026-90817** — the unauthenticated survey-endpoint remote-code-execution flaw abused by the XMRig cryptomining campaign documented by Palo Alto Unit 42
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
48RISCO
abrir ↗GitHub PoC
ExifToolExploit CVE-2021-22204 \\ Arbitrary Code Execution
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-102764 BeyondTrust Remote Support unauthenticated file write / RCE proof of concept
Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
78RISCO
abrir ↗GitHub PoC
Ferramentas de auditoria em segurança da informação, reconhecimento de superfície com RDAP/DNS e análise defensiva web (CVE-2024-10924).
Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
85RISCO
abrir ↗GitHub PoC
Wheels SQL injection on MySQL/MariaDB with backslash escaping enabled
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent)
48RISCO
abrir ↗GitHub PoC
CTF writeup: rooting a Linux box via CVE-2024-23334 (directory traversal) and CVE-2025-32463 (sudo privilege escalation)
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
70RISCO
abrir ↗GitHub PoC
A PoC for CVE-2026-110912 'arpbleed'
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.
41RISCO
abrir ↗GitHub PoC
Detection-only check for the Ivanti Connect Secure authentication bypass (CVE-2026-104935)
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb
91RISCO
abrir ↗GitHub PoC★ 1
ekacs/predicted-CVE-2026-20329
Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Exceptional Conditions Handling Vulnerabilities
48RISCO
abrir ↗GitHub PoC
BlindLlama: CVE-2026-102697 Reproduction
Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization
41RISCO
abrir ↗GitHub PoC
CVE-2026-104715: cifs-utils credentials-file option injection (local root)
Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
41RISCO
abrir ↗GitHub PoC
Unauthenticated RCE via Velocity Template Language (VTL) injection in Floci API Gateway mapping templates (versions 1.1.0–2.2.0). CVSS 9.8 Critical.
Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates
48RISCO
abrir ↗GitHub PoC★ 18
一加 15T（PLZ110）临时 root + KernelSU per-boot 接管：CVE-2026-64560 移植，不写分区、重启即失效。内核 6.12.69-android16-6-g242e1a07f878。
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISCO
abrir ↗GitHub PoC
CVE-2026-0322
PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
71RISCO
abrir ↗GitHub PoC
CTF writeup: rooting a Linux box via CVE-2024-23334 (directory traversal) and CVE-2025-32463 (sudo privilege escalation)
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISCO
abrir ↗GitHub PoC
Free CLI: check a Nextcloud instance for CVE-2026-110447 exposure. Stdlib only, honest verdicts. By Ingenious AI.
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-85097 — Bricksforge <= 3.1.8.9 unauth file upload to RCE. GIF/PHP polyglot + temporaryFileUploads.url mismatch. python3 exploit.py --url http://TARGET
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
48RISCO
abrir ↗GitHub PoC
CVE-2026-64507 — PoC: IBPB flush on BPF JIT allocation
x86/bugs: Enable IBPB flush on BPF JIT allocation
23RISCO
abrir ↗GitHub PoC
POC for the CVE-2026-104711 - New Variant
Apache Struts: OGNL injection in the legacy RESTful action mapper
48RISCO
abrir ↗GitHub PoC★ 2
Neterbit NW-431F unauthenticated SMS disclosure
Neterbit NW-431F Embedded Web Server sms.json information disclosure
33RISCO
abrir ↗GitHub PoC
Proof of concept and vulnerability checker for CVE-2026-18963, an unauthenticated account takeover in the Keycloak reset-credentials flow. Single-file Python, optional Playwright browser component.
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗GitHub PoC
Benign, self-contained reproduction of CVE-2026-77521 (MaxKB prompt-injectable command execution)
MaxKB: Prompt-injectable agent can lead to command execution
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-110912
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.
41RISCO
abrir ↗GitHub PoC
CVE-2026-12118 POC
IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-97657 – Authentication Bypass & Account Takeover | Pocbit
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
48RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.