Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.871exploits catalogados

40.961CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentes populares risco

88.871 exploits

GitHub PoC

My portfolio showcasing vulnerability research (CVE-2026-11989, CVE-2026-11395) and automated threat orchestration engineering (Lucius Engine, TalonVigil).

CVE-2026-11989MEDIUM15 jul 2026

Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping

33RISCO

GitHub PoC★ 1

Samsung libimagecodec.quram.so OOB Write PoC

CVE-2026-21045HIGH15 jul 2026

Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote

41RISCO

GitHub PoC

NeseOS-Corp/CVE-2026-50657

CVE-2026-50657MEDIUM15 jul 2026

Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability

33RISCO

GitHub PoC★ 1

A modified method to root Android device with locked bootloader via new exploit. (Only for Samsung now or smthing like that devices cuz i ported it to N970U1), Fork of https://github.com/localhosts-A/CyberMeowfia

CVE-2026-43499HIGH15 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC★ 3

A lightweight, fast tool to scan and detect the "regreSSHion" OpenSSH remote code execution vulnerability (CVE-2024-6387).

CVE-2024-6387HIGH15 jul 2026

Openssh: regresshion - race condition in ssh allows rce/dos

63RISCO

GitHub PoC★ 4

Pix for WooCommerce Unauthenticated File Upload via certificate_crt_path Parameter | CVSS 9.8

CVE-2026-3891CRITICAL15 jul 2026

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

75RISCO

GitHub PoC★ 1

Remote Code Execution (RCE) in Yamcs Mission Control System via Java Statement Injection in Yarch SQL Double-Quoted IdentifiersRemote Code Execution (RCE) in Yamcs Mission Control System via Java Statement Injection in Yarch SQL Double-Quoted Identifiers

CVE-2026-55511CRITICAL15 jul 2026

Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

48RISCO

Metasploit600

SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution

CVE-2026-15409CRITICALsob ataqueransomware14 jul 2026

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

93RISCO

GitHub PoC

Defensive single-target self-check for Langflow CVE-2025-3248 exposure

CVE-2025-3248CRITICALsob ataqueransomware14 jul 2026

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RISCO

GitHub PoC

Reproducer for CVE-2026-46457 — Apache Camel camel-nats inbound header injection (Camel control-header injection via a NATS publisher; CamelHttpUri -> SSRF)

CVE-2026-46457HIGH14 jul 2026

Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers

41RISCO

GitHub PoC

Reproducer for CVE-2026-46584: Apache Camel camel-mail mail.smtp.* header injection enabling credential theft via on-path SOCKS interception (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-46584LOW14 jul 2026

Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters

28RISCO

VulnCheck XDB

initial-access

CVE-2026-23744CRITICAL14 jul 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RISCO

GitHub PoC

JohannesLks/CVE-2026-50338

CVE-2026-50338HIGH14 jul 2026

Azure Spring Apps Elevation of Privilege Vulnerability

41RISCO

VulnCheck XDB

initial-access

CVE-2023-38646—14 jul 2026

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman

60RISCO

GitHub PoC

CVE-2026-8181 — Burst Statistics WordPress plugin Authentication Bypass (CVSS 9.8) to Admin Account Takeover. Mass scanner with FOFA/Shodan integration and modern GUI.

CVE-2026-8181CRITICAL14 jul 2026

Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover

68RISCO

VulnCheck XDB

initial-access

CVE-2026-0740CRITICAL14 jul 2026

Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

75RISCO

GitHub PoC★ 3

CVE-2026-0740

CVE-2026-0740CRITICAL14 jul 2026

Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

75RISCO

GitHub PoC

asoka666/Cve-2020-11023

CVE-2020-11023MEDIUMsob ataque14 jul 2026

Potential XSS vulnerability in jQuery

85RISCO

GitHub PoC★ 15

Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only.

CVE-2026-43499HIGH14 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC

Log4j Vulnerability homelab

CVE-2021-44228CRITICALsob ataqueransomware14 jul 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

GitHub PoC★ 7

A proof-of-concept exploit for CVE-2026-23744 - MCPJam Inspector Remote Code Execution (RCE) vulnerability. This tool demonstrates the security flaw in versions <=1.4.2 and helps security researchers verify patches. For authorized testing and educational purposes only. Includes multiple payload options, command execution, and session management.

CVE-2026-23744CRITICAL14 jul 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RISCO

GitHub PoC★ 2

will be published

CVE-2026-15706CRITICAL14 jul 2026

Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

48RISCO

GitHub PoC

This contains the Dockerfile for building and reproduing shellshock

CVE-2014-7169CRITICALsob ataque14 jul 2026

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

100RISCO

GitHub PoC

Pen Tesing Lab exploiting VSFTPD 2.3.4 backdoor via Metasploit Framework

CVE-2011-2523—14 jul 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISCO

GitHub PoC

Intentionally vulnerable VM-hosted Java shop — Log4Shell (CVE-2021-44228) workshop lab (EC2 / Azure VM / GCE)

CVE-2021-44228CRITICALsob ataqueransomware14 jul 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

GitHub PoC★ 1

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping

CVE-2026-26718CRITICAL14 jul 2026

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an att

48RISCO

GitHub PoC★ 8

Bartixxx32/CVE-2026-43499-OnePlus15

CVE-2026-43499HIGH14 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

VulnCheck XDB

initial-access

CVE-2026-49049HIGH14 jul 2026

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

56RISCO

VulnCheck XDB

denial-of-service

CVE-2022-1471HIGH14 jul 2026

Remote Code execution in SnakeYAML

78RISCO

GitHub PoC

本次个人漏洞研究进展成果

CVE-2026-43499HIGH14 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.