Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.871exploits catalogados

40.961CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentes populares risco

88.871 exploits

GitHub PoC

jaf0rk/CVE-2026-14431

CVE-2026-14431HIGH17 jul 2026

Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside

41RISCO

abrir ↗

GitHub PoC★ 48

CVE-2026-50416: Windows 11 KASLR bypass

CVE-2026-50416LOW17 jul 2026

Win32k Information Disclosure Vulnerability

28RISCO

abrir ↗

GitHub PoC

Academic proof-of-concept demonstrating CVE-2026-46442 for authorized security research.

CVE-2026-46442CRITICAL17 jul 2026

Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

75RISCO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-48203: Apache Camel camel-solr SolrParam./SolrField. header injection enabling Solr document-field injection and SSRF via the shards parameter (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-48203CRITICAL17 jul 2026

Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

48RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2023-23752MEDIUMsob ataque17 jul 2026

[20230201] - Core - Improper access check in webservice endpoints

100RISCO

abrir ↗

VulnCheck XDB

remote-with-credentials

CVE-2025-8110HIGHsob ataque17 jul 2026

File overwrite in file update API in Gogs

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-36260CRITICALsob ataque17 jul 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-63030CRITICALsob ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISCO

abrir ↗

GitHub PoC

Pentest completo sobre Metasploitable: recon con nmap, explotación con Metasploit (CVE-2007-2447), extracción y cracking de credenciales, persistencia SSH

CVE-2007-2447—17 jul 2026

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RISCO

abrir ↗

Metasploit600

WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE

CVE-2026-60137MEDIUMsob ataque17 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RISCO

abrir ↗

Metasploit600

WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE

CVE-2026-63030CRITICALsob ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISCO

abrir ↗

Metasploit600

Langflow AI Public Flow Build Unauth RCE

CVE-2026-10134CRITICAL17 jul 2026

Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows

63RISCO

abrir ↗

GitHub PoC★ 6

sorrow404Null/CVE-2026-43499-RMX5200

CVE-2026-43499HIGH17 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

abrir ↗

GitHub PoC

fancyzll/CVE-2026-43499_OPPO-MT6835

CVE-2026-43499HIGH17 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

abrir ↗

Metasploit600

Langflow AI auto_login RCE

CVE-2026-9198CRITICALsob ataque17 jul 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

98RISCO

abrir ↗

GitHub PoC★ 2

2932796375github/CVE-2026-43499_OPPO-MT6835

CVE-2026-43499HIGH17 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

abrir ↗

Metasploit300

WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion

CVE-2026-63030CRITICALsob ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-1471HIGH17 jul 2026

Remote Code execution in SnakeYAML

78RISCO

abrir ↗

GitHub PoC★ 1

WordPress KeepInMind CVE-2026-9271 Exploit - Tool detecting stored XSS in KeepInMind plugin v0.8.4.2 and below. Built by Sudeepa Wanigarathna, it simulates CSS injection to hijack admin accounts. Features safe testing, attack simulation, credential capture, bulk scanning, reporting. Essential for security researchers.

CVE-2026-9271MEDIUM17 jul 2026

KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS

33RISCO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-48204: Apache Camel camel-mongodb-gridfs gridfs.* header injection overriding the GridFS operation (enumerate/read/delete files) from an unauthenticated HTTP request (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-48204CRITICAL17 jul 2026

Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration

48RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-55579 – Unauthenticated RCE in Pheditor via hardcoded default password "admin". Full Python exploit with file upload & terminal execution. No dependencies.

CVE-2026-55579CRITICAL17 jul 2026

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

48RISCO

abrir ↗

GitHub PoC

TM4Web Vulnerability - CVE-2022-35499

CVE-2022-35499HIGH17 jul 2026

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via inject

41RISCO

abrir ↗

GitHub PoC

CVE-2026-33017 Exploit | by infrar3d

CVE-2026-33017CRITICALsob ataque17 jul 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RISCO

abrir ↗

GitHub PoC★ 1

MiaPatsune/cve-2026-43499

CVE-2026-43499HIGH17 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

abrir ↗

GitHub PoC

Python port of the CVE-2023-23752 exploit — Joomla! < 4.2.8 unauthenticated information disclosure (user list + DB credentials leak)

CVE-2023-23752MEDIUMsob ataque17 jul 2026

[20230201] - Core - Improper access check in webservice endpoints

100RISCO

abrir ↗

GitHub PoC

TM4WEB Vulnerability - CVE-2022-35497

CVE-2022-35497MEDIUM17 jul 2026

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid se

33RISCO

abrir ↗

GitHub PoC★ 66

CVE-2026-63030, CVE-2026-60137, wp2shell scanner

CVE-2026-63030CRITICALsob ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISCO

abrir ↗

GitHub PoC

CVE-2026-38526 Exploit | by infrar3d

CVE-2026-38526CRITICAL17 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RISCO

abrir ↗

GitHub PoC★ 865

KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499

CVE-2026-43499HIGH17 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

abrir ↗

GitHub PoC★ 58

Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026.

CVE-2026-49176HIGH16 jul 2026

Windows WalletService Elevation of Privilege Vulnerability

41RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.