Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.871exploits catalogados
40.961CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentespopularesrisco
88.871 exploits
GitHub PoC
A combination of CVE-2026-55494 and CVE-2026-62308 to get root privilege RCE in tugtainer
Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset
48RISCO
abrir ↗GitHub PoC
CVE-2025-33073 Research writeup
Windows SMB Client Elevation of Privilege Vulnerability
93RISCO
abrir ↗GitHub PoC★ 2
CVE-2025-24813 - Apache Tomcat RCE via Session Deserialization - PoC Exploit
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2019-0232 - Apache Tomcat CGIServlet enableCmdLineArguments RCE - PoC Exploit
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RISCO
abrir ↗GitHub PoC
CVE-2023-4911 (Looney Tunables) analysis report and Docker reproduction lab
Glibc: buffer overflow in ld.so leading to privilege escalation
98RISCO
abrir ↗GitHub PoC
Reproducer for CVE-2026-43865 — Apache Camel camel-hazelcast default-configured instance unsafe Java deserialization (RCE)
Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution
41RISCO
abrir ↗GitHub PoC★ 2
Wordpress Plugin Planyo Online Reservation System <= 3.0 - Arbitrary File Read via SSRF
Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
56RISCO
abrir ↗GitHub PoC
cve-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
abrir ↗GitHub PoC
Unauthenticated Remote Code Execution via SSH Command-Line Argument Injection Cockpit versions 327 – 359 | CVSS 9.8 Critical | CWE-78
Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
68RISCO
abrir ↗GitHub PoC
luongchivi/Preproduce-CVE-2019-0232
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RISCO
abrir ↗GitHub PoC★ 1
CVE research-to-detection-signature engineering project: fingerprinting the vsftpd 2.3.4 backdoor (CVE-2011-2523) externally, at scale, with validated false-positive/negative handling - built in Python
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISCO
abrir ↗VulnCheck XDB
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
abrir ↗VulnCheck XDB
initial-access
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RISCO
abrir ↗VulnCheck XDB
initial-access
Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
68RISCO
abrir ↗GitHub PoC
Reproducer for CVE-2026-43866 — Apache Camel camel-jms forged DefaultExchangeHolder bypass of the CVE-2026-40860 deserialization filter (Exchange-state injection)
Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder
41RISCO
abrir ↗GitHub PoC
Write-up and exploitation steps for the pedit COW vulnerability (CVE-2026-46331)
net/sched: fix pedit partial COW leading to page cache corruption
41RISCO
abrir ↗GitHub PoC★ 2
Hunt-Benito/samsung-bixby-command-execution-cve-2026-21055-improper-component-export
Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute a
41RISCO
abrir ↗GitHub PoC★ 226
CVE-2026-43499 Implementation for 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗GitHub PoC★ 94
基于 CVE-2026-43499 的 8E5 机型自动化解锁辅助工具，仅限授权安全研究与自有设备使用。
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗GitHub PoC★ 3
GhostLock - CVE-2026-43499 backport patch for openVZ 7
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗GitHub PoC★ 269
GhostLock (CVE-2026-43499) kernel exploit for OnePlus devices with locked bootloader
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗VulnCheck XDB
initial-access
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RISCO
abrir ↗VulnCheck XDB
initial-access
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
100RISCO
abrir ↗GitHub PoC★ 1
Dahua CVE-2026-29115
A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially c
33RISCO
abrir ↗VulnCheck XDB
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
abrir ↗VulnCheck XDB
initial-access
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
63RISCO
abrir ↗GitHub PoC★ 1
Dahua CVE-2026-29116
A vulnerability has been found in some Dahua products could
allow an unauthenticated remote attacker to send a specially
41RISCO
abrir ↗GitHub PoC★ 4
CVE-2026-46331 act_pedit page-cache corruption exploit, with Alpine PIE fix
net/sched: fix pedit partial COW leading to page cache corruption
41RISCO
abrir ↗GitHub PoC★ 1
Azure IoT Hub where exposure of an owner-level Shared Access Key enables unauthenticated remote code execution (RCE) against connected IoT devices. Proof-Of-Concept
Gardyn IoT Hub Use of Hard-coded Credentials
48RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.