Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.871exploits catalogados

40.961CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentes populares risco

88.871 exploits

GitHub PoC★ 2

CVE-2024-25600 - Unauthenticated RCE exploit for WordPress Bricks Builder Theme. Advanced exploitation framework with interactive shell, reverse shells, file upload/download, async scanning, stealth mode, proxy support, and multi-threaded vulnerability scanning. For authorized security testing only.

CVE-2024-25600CRITICAL16 jul 2026

WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

85RISCO

GitHub PoC

Reproducer for CVE-2026-46592: Apache Camel camel-cxf operationName header injection redirecting the invoked SOAP operation (confused deputy) from a read to a destructive one (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-46592HIGH16 jul 2026

Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

41RISCO

GitHub PoC

PedroPLCode/CVE-2025-55182_react2shell_exploit.py

CVE-2025-55182CRITICALsob ataqueransomware16 jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

Spring Boot web application vulnerable to Log4Shell (CVE-2021-44228).

CVE-2021-44228CRITICALsob ataqueransomware16 jul 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

GitHub PoC

OPNsense Root RCE (CVE-2026-57155)

CVE-2026-57155CRITICAL16 jul 2026

OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

48RISCO

GitHub PoC★ 5

Next.js RSC RCE Exploit Tool (CVE-2025-55182)

CVE-2025-55182CRITICALsob ataqueransomware16 jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

uname1able/CVE-2025-21333

CVE-2025-21333HIGHsob ataque16 jul 2026

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

76RISCO

GitHub PoC

CVE-2026-43499 exploit with OnePlus Ace3 support

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC

Sana-404/CVE-2026-8838-Mitigation-and-Detection

CVE-2026-8838CRITICAL16 jul 2026

Remote Code Execution via eval() Injection in amazon-redshift-python-driver

48RISCO

GitHub PoC

Sana-404/CVE-2026-8388-Mitigation-and-Detection

CVE-2026-8388MEDIUM16 jul 2026

Incorrect boundary conditions in the JavaScript Engine: JIT component

33RISCO

GitHub PoC

CVE-2026-43499 exploit reproduction on jinghu (Xiaomi Pad 7 Ultra)

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC

Unofficial Bash IoC checker for SonicWall SMA1000 appliances affected by actively exploited CVE-2026-15409 and CVE-2026-15410.

CVE-2026-15409CRITICALsob ataqueransomware16 jul 2026

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

93RISCO

VulnCheck XDB

initial-access

CVE-2026-20896CRITICAL16 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RISCO

VulnCheck XDB

remote-with-credentials

CVE-2025-8110HIGHsob ataque16 jul 2026

File overwrite in file update API in Gogs

100RISCO

VulnCheck XDB

initial-access

CVE-2024-25600CRITICAL16 jul 2026

WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

85RISCO

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALsob ataqueransomware16 jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC★ 40

Standalone CVE-2026-43499 PoC for Galaxy S25 Ultra SM-S938N S938NKSUACZF1

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

VulnCheck XDB

initial-access

CVE-2026-33017CRITICALsob ataque16 jul 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RISCO

VulnCheck XDB

remote-with-credentials

CVE-2026-34197HIGHsob ataque16 jul 2026

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

100RISCO

GitHub PoC

CVE-2026-43499 exploit reproduction on jinghu (Xiaomi Pad 7 Ultra)

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC★ 2

PoC tools for CVE-2026-58457: Unauthenticated OS Command Injection leading to remote root on Shenzhen Aitemi M300 Wi-Fi Repeater (MT02). Includes exploit, validator, payload generator, and Metasploit module. For educational and authorized pentesting only.

CVE-2026-58457CRITICAL16 jul 2026

Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp

48RISCO

GitHub PoC★ 6

Proof of concept for CVE-2026-54992, an MSMQ remote-read integer overflow

CVE-2026-54992HIGH16 jul 2026

Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability

41RISCO

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALsob ataqueransomware16 jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

VulnCheck XDB

local

CVE-2025-21333HIGHsob ataque16 jul 2026

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

76RISCO

VulnCheck XDB

initial-access

CVE-2026-14894CRITICAL16 jul 2026

Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)

63RISCO

GitHub PoC★ 1

Complete exploitation toolkit for CVE-2026-3180 - WordPress Contest Gallery SQL Injection vulnerability. Features automated data extraction, WAF bypass, reverse shell, SQLMap integration, Burp extension generation, and reporting for penetration testing and security research.

CVE-2026-3180HIGH16 jul 2026

Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection

41RISCO

GitHub PoC★ 2

syxlox/CVE-2026-50369

CVE-2026-50369HIGH16 jul 2026

Windows Remote Desktop Services Elevation of Privilege Vulnerability

41RISCO

GitHub PoC

CVE-2026-43499 exploit with OnePlus Ace3 support

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC

Reproducer for CVE-2026-46726: Apache Camel camel-vertx-websocket unfiltered inbound header injection enabling SSRF and secret disclosure via property-placeholder resolution (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-46726HIGH16 jul 2026

Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers

41RISCO

GitHub PoC

bibotai/secveri-cve-2026-50011-positive

CVE-2026-50011HIGH16 jul 2026

Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

41RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.