Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
87.464exploits catalogados
40.695CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4.577Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.464 exploits
GitHub PoC
CVE-2024-4367 PDF.js FontMatrix PoC - authorized pentest artifact
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISCO
abrir ↗GitHub PoC
Cybersecurity research project analyzing threat intelligence feeds, Log4Shell (CVE-2021-44228), attack progression, remediation, incident response, and threat hunting.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗GitHub PoC
Offline Python applicability detector for CVE-2026-97785 in Microsoft Entra application proxy, with CSV/JSON inventories and auditable reports.
AAD App Proxy Elevation of Privilege Vulnerability
28RISCO
abrir ↗GitHub PoC
Offline Python detector for CVE-2026-114625 exposure in on-premises VeloCloud Orchestrator, with train-specific build checks and auditable reports.
Security Advisory 0199
78RISCO
abrir ↗GitHub PoC
sachincool/cve-2026-84383-poc
libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items
48RISCO
abrir ↗GitHub PoC
sudo5Q/CVE-2026-38056-PoC
ST Engineering iDirect iQ-Series Terminals Missing Authorization
48RISCO
abrir ↗VulnCheck XDB
initial-access
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August
63RISCO
abrir ↗GitHub PoC
Controlled penetration testing and Linux host-hardening lab demonstrating Shellshock (CVE-2014-6271), privilege escalation, vulnerability assessment and defensive security controls.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISCO
abrir ↗GitHub PoC
Offline Python detector for CVE-2026-15723 version exposure in self-managed GitLab CE/EE, with CSV/JSON inventories and auditable reports.
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
41RISCO
abrir ↗GitHub PoC★ 14
AirPods Bluetooth MAC Address Disclosure via NSUserDefaults
This issue was addressed with improved data protection. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPad
33RISCO
abrir ↗GitHub PoC
Security-patched php56 RPMs for Amazon Linux 1 (AMI 2018.03): PHP2Shell (CVE-2026-109618, CVE-2026-109619) and post-5.6.40 fixes backported from deb.sury.org
RCE via OOM corruption
100RISCO
abrir ↗VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗GitHub PoC★ 1
Live demo: the same vulnerable Rust zip crate (RUSTSEC-2026-0367 setuid + CVE-2026-115905 zip cloaking) contained by a deny-by-default Cosmonic WebAssembly sandbox.
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
48RISCO
abrir ↗GitHub PoC
One-click exploit PoC for CVE-2026-109618 and CVE-2026-109619 against vulnerable PHP + Apache mod_php (prefork) targets.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
PHP2Shell CVE-2026-109618 / CVE-2026-109619 Mitigation work (Ansible Role)
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 2
Lab reproduction, exposure probe and detection content for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell). Defensive research; no exploit.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
[PHP2Shell] Golang exploit for CVE-2026-109618 / CVE-2026-109619: Unauthenticated RCE in PHP 5.4–8.5.11 via OOM corruption + session.upload_progress UAF
RCE via OOM corruption
100RISCO
abrir ↗VulnCheck XDB
initial-access
Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
63RISCO
abrir ↗GitHub PoC★ 1
Remote Zend MM ASLR leak testbed (PHP CVE-2026-109618 / CVE-2026-109619)
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Hands-on PHP2Shell workshop: Docker labs, guided debugging, and annotated exploits for CVE-2026-109618 and CVE-2026-109619.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Non-intrusive detector for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) - scans codebases and live hosts for vulnerable PHP versions and risky config. Detection, not exploitation.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Unofficial rebuild of Remi's php80-php 8.0.30-21 SCL packages for CentOS/RHEL 7 (EOL). Includes all 44 CVE fixes between Remi -6 and -21, among them CVE-2026-109618 / CVE-2026-109619 (PHP2Shell).
RCE via OOM corruption
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.