Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

84.150exploits catalogados

39.601CVEs com exploração pública

24.695testados em laboratório

Todos Referência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9.680Nuclei 4.488Metasploit 3.525✓ só verificadosrecentes populares risco

16.153 exploits

GitHub PoC

CVE-2026-74469

CVE-2026-74469HIGH19 set 2026

sctp: prevent peer transport count overflow

41RISCO

abrir ↗

GitHub PoC

CVE-2026-80844

CVE-2026-80844—19 set 2026

xfrm: ah6: validate routing header segments_left

23RISCO

abrir ↗

GitHub PoC

CVE-2026-68121

CVE-2026-68121HIGH19 set 2026

pppoe: reload header pointer after dev_hard_header()

41RISCO

abrir ↗

GitHub PoC

CVE-2026-77635 - CakePHP - Critical 9.2 - Unauthenticated GET /?path= - SQL Injection

CVE-2026-77635CRITICAL19 set 2026

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

48RISCO

abrir ↗

GitHub PoC★ 1

Trained to Escalate: Forensic Analysis and Local Replication of RLHF-Induced Privilege Escalation in AI Agents (CVE-2026-65616)

CVE-2026-65616HIGH19 set 2026

Potential privilege escalation to JFrog administrator privileges

41RISCO

abrir ↗

GitHub PoC★ 3

CVE-2026-81294 - WordPress - Critical 9.8 - Unauthenticated Privilege Escalation

CVE-2026-81294CRITICAL19 set 2026

WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability

48RISCO

abrir ↗

GitHub PoC

CVE-2026-81648 - WordPress - CryptoPayment Gateway - Critical 10.0 - Unauthenticated POST /wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax.php - Arbitrary File Deletion

CVE-2026-81648CRITICAL19 set 2026

CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router

48RISCO

abrir ↗

GitHub PoC

CVE-2026-79752 - CakePHP - Critical 9.2 - Unauthenticated GET /?type= - SQL Injection

CVE-2026-79752CRITICAL19 set 2026

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

48RISCO

abrir ↗

GitHub PoC

Stored XSS in Concrete CMS Community Store leads to admin dashboard takeover

CVE-2026-93659HIGH19 set 2026

Concrete CMS Community Store before 2.7.8 Stored XSS

41RISCO

abrir ↗

GitHub PoC

CVE-2026-75816 - Frontend Admin by DynamiApps for Wordpress - Critical 9.8 - Unauthenticated POST /wp-admin/admin-ajax.php - Account Takeover

CVE-2026-75816CRITICAL19 set 2026

Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

48RISCO

abrir ↗

GitHub PoC

CVE-2026-85721: offline checker for org.asynchttpclient:async-http-client against all 26 repository-level advisories. 3.x is fixed in 3.0.14. The 2.x line is end of life - its last release 2.16.1 is still affected by 5 advisories that will not be fixed. 9 of the 26 are still missing from the GitHub Advisory Database (as of 2026-10-12).

CVE-2026-85721HIGH19 set 2026

AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

41RISCO

abrir ↗

GitHub PoC

CVE-2026-81000

CVE-2026-81000HIGH19 set 2026

net: tun: bound receive headroom

41RISCO

abrir ↗

GitHub PoC

CVE-2026-19952 - DynamiApps - High 7.5 - Unauthenticated POST /wp-admin/admin-ajax.php - Arbitrary File Deletion

CVE-2026-19952HIGH19 set 2026

Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag

41RISCO

abrir ↗

GitHub PoC

abhaybansal16/cve-2025-55182-lab

CVE-2025-55182CRITICALsob ataqueransomware19 set 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC

CVE-2026-13447 - WordPress - inspireui - Critical 9.8 - Unauthenticated POST /wp-json/api/flutter_user/firebase_sms_v2 - Authentication Bypass

CVE-2026-13447CRITICAL19 set 2026

MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

48RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-32475 — unauthenticated arbitrary file upload in Elementor Pro <= 4.2.1 (CVSS 9.0, CWE-434). PoC for authorised testing.

CVE-2026-32475CRITICAL19 set 2026

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

63RISCO

abrir ↗

GitHub PoC★ 5

CVE-2026-92229 — Forminator ≤1.57.2 unauth shortcode exec (current_url / quiz AJAX). Python 3 PoC.

CVE-2026-92229CRITICAL19 set 2026

Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

48RISCO

abrir ↗

GitHub PoC★ 3

PoC for CVE-2026-89274: unauthenticated arbitrary shortcode execution in WP Recipe Maker ≤10.8.1 via recipe rating comments (JSON-LD). Python check/exploit/verify.

CVE-2026-89274CRITICAL19 set 2026

WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

48RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-78159 - stellarwp - Critical 9.8 - Unauthenticated POST /wp-comments-post.php - Remote Code Execution

CVE-2026-78159CRITICAL19 set 2026

The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

48RISCO

abrir ↗

GitHub PoC

IDOR/BOLA in Events Manager <= 7.4.3 REST ticket update endpoint — CVE-2026-93661

CVE-2026-93661LOW19 set 2026

Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR

28RISCO

abrir ↗

GitHub PoC★ 2

CVE-2026-93453 Exploit — SOGo password reset link poisoning via attacker-controlled Origin header, enabling password reset token interception and account takeover.

CVE-2026-93453HIGH18 set 2026

SOGo before 5.12.11 Password Reset Token Interception via Origin Header

41RISCO

abrir ↗

GitHub PoC

CVE-2026-45140 - chamilo - Critical 9.8 - Unauthenticated POST /plugin/CStudio/editor/import-project... - Remote Code Execution

CVE-2026-45140CRITICAL18 set 2026

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

48RISCO

abrir ↗

GitHub PoC★ 565

CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept

CVE-2026-63030CRITICALsob ataque18 set 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISCO

abrir ↗

GitHub PoC

Tracking DirtyAH6 (CVE-2026-80844), the Linux kernel IPv6 AH routing-header out-of-bounds write

CVE-2026-80844—18 set 2026

xfrm: ah6: validate routing header segments_left

23RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-77991 - joomlaeventmanager.net - Critical - Privileged POST /administrator/index.php - Remote Code Execution

CVE-2026-77991CRITICAL18 set 2026

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

48RISCO

abrir ↗

GitHub PoC

Tracking TUNderflow (CVE-2026-81000), the Linux kernel TUN/TAP receive-headroom underflow

CVE-2026-81000HIGH18 set 2026

net: tun: bound receive headroom

41RISCO

abrir ↗

GitHub PoC

Enumerate Grafana plugin enumeration PoC for CVE-2021-43798

CVE-2021-43798HIGHsob ataque18 set 2026

Grafana path traversal

100RISCO

abrir ↗

GitHub PoC

CVE-2026-18574 - Draft or TODO

CVE-2026-18574CRITICAL18 set 2026

Authentication Bypass in Check Point Security Management Server

48RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-84753 - WPFunnels - Critical 9.8 - Unauthenticated POST /?rest_route=/mint-mail/v1/mint-form-... - PHP Object Injection

CVE-2026-84753CRITICAL18 set 2026

WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

48RISCO

abrir ↗

GitHub PoC

Tracking DiagSpill (CVE-2026-74469), the Linux kernel SCTP sock_diag heap overflow

CVE-2026-74469HIGH18 set 2026

sctp: prevent peer transport count overflow

41RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.