Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.871exploits catalogados
40.961CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentespopularesrisco
88.871 exploits
GitHub PoC
Sana-404/CVE-2026-8838-Mitigation-and-Detection
CVE-2026-8838CRITICAL16 jul 2026
Remote Code Execution via eval() Injection in amazon-redshift-python-driver
48RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-20896CRITICAL16 jul 2026
Gitea Docker image trusts spoofable reverse-proxy headers by default
63RISCO
abrir ↗
GitHub PoC★ 6
Proof of concept for CVE-2026-54992, an MSMQ remote-read integer overflow
CVE-2026-54992HIGH16 jul 2026
Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
41RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2021-44228CRITICALsob ataqueransomware16 jul 2026
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗
GitHub PoC★ 2
CVE-2024-25600 - Unauthenticated RCE exploit for WordPress Bricks Builder Theme. Advanced exploitation framework with interactive shell, reverse shells, file upload/download, async scanning, stealth mode, proxy support, and multi-threaded vulnerability scanning. For authorized security testing only.
CVE-2024-25600CRITICAL16 jul 2026
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISCO
abrir ↗
GitHub PoC
CVE-2026-43499 exploit with OnePlus Ace3 support
CVE-2026-43499HIGH16 jul 2026
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗
GitHub PoC★ 3
🔐 CVE-2026-57821 - Apache Fineract SQL Injection Toolkit 📚 Two Python scripts for authorized security testing: verifier.py (safe detection, no extraction) and exploit.py (deep analysis). Supports 11 DB types. Perfect for understanding SQL injection vulnerabilities. Only legal tests ⚠️ for educational & research purposes only.
CVE-2026-57821HIGH16 jul 2026
Apache Fineract: Office list: SQL Injection via Subquery in orderBy
41RISCO
abrir ↗
GitHub PoC
Reproducer for CVE-2026-46592: Apache Camel camel-cxf operationName header injection redirecting the invoked SOAP operation (confused deputy) from a read to a destructive one (fixed in 4.14.8/4.18.3/4.21.0)
CVE-2026-46592HIGH16 jul 2026
Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation
41RISCO
abrir ↗
GitHub PoC★ 58
Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026.
CVE-2026-49176HIGH16 jul 2026
Windows WalletService Elevation of Privilege Vulnerability
41RISCO
abrir ↗
GitHub PoC
CVE-2025-60357- NoSQL(MongoDB) Injection POC
CVE-2025-60357HIGH15 jul 2026
AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEv
41RISCO
abrir ↗
GitHub PoC★ 2
CVE-2026-48909 - Unauthenticated PHP Object Injection to RCE exploit for Joomla SP LMS extension versions <= 4.1.3. Exploits lmsOrders cookie deserialization to write webshell via Joomla FormattedtextLogger gadget chain. Includes interactive shell, path discovery, and cleanup. For authorized security testing only.
CVE-2026-48909CRITICAL15 jul 2026
Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4
63RISCO
abrir ↗
GitHub PoC
seqra/cve-2026-58138
CVE-2026-58138CRITICAL15 jul 2026
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
63RISCO
abrir ↗
GitHub PoC★ 3
A lightweight, fast tool to scan and detect the "regreSSHion" OpenSSH remote code execution vulnerability (CVE-2024-6387).
CVE-2024-6387HIGH15 jul 2026
Openssh: regresshion - race condition in ssh allows rce/dos
63RISCO
abrir ↗
GitHub PoC
firstlax6t/CVE-2026-36669-FengOffice
CVE-2026-36669CRITICAL15 jul 2026
An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote
48RISCO
abrir ↗
GitHub PoC★ 1
Remote Code Execution (RCE) in Yamcs Mission Control System via Java Statement Injection in Yarch SQL Double-Quoted IdentifiersRemote Code Execution (RCE) in Yamcs Mission Control System via Java Statement Injection in Yarch SQL Double-Quoted Identifiers
CVE-2026-55511CRITICAL15 jul 2026
Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
48RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-58138CRITICAL15 jul 2026
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
63RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-58138CRITICAL15 jul 2026
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
63RISCO
abrir ↗
GitHub PoC
Mass Exploiter for CVE-2026-49049
CVE-2026-49049HIGH15 jul 2026
Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
56RISCO
abrir ↗
GitHub PoC
Technical analysis and safety-conscious research harness for CVE-2019-6447 in ES File Explorer for Android
CVE-2019-6447—15 jul 2026
The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary fi
50RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-49049HIGH15 jul 2026
Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
56RISCO
abrir ↗
GitHub PoC
exploit for CVE-2022-42889
CVE-2022-42889—15 jul 2026
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RISCO
abrir ↗
GitHub PoC★ 1
A containerized enterprise-style lab for researching and defending against CVE-2026-27483.
CVE-2026-27483HIGH15 jul 2026
MindsDB has Path Traversal in /api/files Leading to Remote Code Execution
61RISCO
abrir ↗
GitHub PoC★ 1
A modified method to root Android device with locked bootloader via new exploit. (Only for Samsung now or smthing like that devices cuz i ported it to N970U1), Fork of https://github.com/localhosts-A/CyberMeowfia
CVE-2026-43499HIGH15 jul 2026
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗
GitHub PoC★ 1
罗技云掌机 · GhostLock CVE-2026-43499 root 尝试
CVE-2026-43499HIGH15 jul 2026
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗
GitHub PoC
Podlove Podcast Publisher Unauthenticated File Upload RCE via is_image() vs extract_file_extension() Mismatch | CVSS 9.8
CVE-2026-13001CRITICAL15 jul 2026
Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
63RISCO
abrir ↗
GitHub PoC★ 47
Xiaomi K70e (duchamp) one-click root via CVE-2026-43499 (IonStack) + KernelSU integration
CVE-2026-43499HIGH15 jul 2026
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗
GitHub PoC
ctnBobong32/CVE-2026-43499-so-build
CVE-2026-43499HIGH15 jul 2026
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗
GitHub PoC★ 3
CvE-2026-43499偏移量计算
CVE-2026-43499HIGH15 jul 2026
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗
GitHub PoC
Cxyofficial/x200-cve-2026-43499
CVE-2026-43499HIGH15 jul 2026
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗
GitHub PoC★ 2
Raimu0x19/CVE-2026-13001
CVE-2026-13001CRITICAL15 jul 2026
Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
63RISCO
abrir ↗
← anteriorpágina 209 / 2.963próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.