Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.871exploits catalogados

40.961CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentes populares risco

88.871 exploits

GitHub PoC

CVE-2026-55726: Publicly Listable Azure Blob Storage Container (device logs) - Gardyn (ICSA-26-183-03)

CVE-2026-55726MEDIUM02 jul 2026

Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere

33RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-57819CRITICALsob ataque02 jul 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

abrir ↗

VulnCheck XDB

remote-with-credentials

CVE-2026-52813CRITICAL02 jul 2026

Gogs: Path Traversal in organization name results in RCE through Git hooks

48RISCO

abrir ↗

GitHub PoC★ 1

Proof of concept for CVE-2026-36027 and CVE-2026-36028

CVE-2026-36027MEDIUM02 jul 2026

An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via

33RISCO

abrir ↗

GitHub PoC

DESIGN AND IMPLEMENTATION OF A VULNERABILITY SCANNER FOR CVE-2026-45498 IN MICROSOFT DEFENDER

CVE-2026-45498MEDIUMsob ataque02 jul 2026

Microsoft Defender Denial of Service Vulnerability

55RISCO

abrir ↗

GitHub PoC

CVE-2025-5777 Research writeup

CVE-2025-5777CRITICALsob ataqueransomware02 jul 2026

NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

100RISCO

abrir ↗

GitHub PoC

Hunt-Benito/llama-factory-webui-rce-cve-2026-58116-trust-remote-code-model-path-injection

CVE-2026-58116CRITICAL02 jul 2026

LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path

48RISCO

abrir ↗

GitHub PoC

Gorse < 0.5.10 contains an authentication bypass caused by empty admin_api_key in /api/dump and /api/restore endpoints, letting unauthenticated remote attackers access and modify protected data, exploit requires default empty admin_api_key configuration.

CVE-2026-56782CRITICAL02 jul 2026

Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints

63RISCO

abrir ↗

GitHub PoC★ 3

CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE)

CVE-2025-57819CRITICALsob ataque02 jul 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

abrir ↗

GitHub PoC

Práctica de ciberseguridad sobre Dirty COW (CVE-2016-5195), escalamiento de privilegios y seguridad del kernel de Linux.

CVE-2016-5195HIGHsob ataque02 jul 2026

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISCO

abrir ↗

GitHub PoC★ 1

kaleth4/CVE-2026-20896

CVE-2026-20896CRITICAL02 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RISCO

abrir ↗

GitHub PoC

kaleth4/CVE-2026-55200

CVE-2026-55200CRITICAL02 jul 2026

libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

48RISCO

abrir ↗

GitHub PoC★ 1

FzRsLLaSheR/CVE-2026-12166_CVE-2026-12167_CVE-2026-12168

CVE-2026-12166MEDIUM02 jul 2026

CVE-2026-12166

33RISCO

abrir ↗

GitHub PoC

Gogs has Path Traversal in organization name that results in RCE through Git hooks

CVE-2026-52813CRITICAL02 jul 2026

Gogs: Path Traversal in organization name results in RCE through Git hooks

48RISCO

abrir ↗

GitHub PoC

do4choo/CVE-2026-53694-NoMachine-LPE

CVE-2026-53694HIGH01 jul 2026

Potential local privileges escalation through argument injection in the nxchmod.sh script

41RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-10520CRITICALsob ataque01 jul 2026

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote

100RISCO

abrir ↗

GitHub PoC

motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read

CVE-2026-55488HIGH01 jul 2026

motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read

21RISCO

abrir ↗

GitHub PoC

Blue-team lab: detecting & mitigating CVE-2025-24054 (Windows NTLM hash disclosure) with Sysmon, Wazuh SIEM, and Group Policy

CVE-2025-24054MEDIUMsob ataque01 jul 2026

NTLM Hash Disclosure Spoofing Vulnerability

75RISCO

abrir ↗

GitHub PoC★ 1

pedit COW

CVE-2026-46331HIGH01 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISCO

abrir ↗

GitHub PoC

rootdirective-sec/CVE-2026-56011-Lab

CVE-2026-56011HIGH01 jul 2026

WordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerability

41RISCO

abrir ↗

GitHub PoC

Its1Zero/cve-2025-57819-exploit

CVE-2025-57819CRITICALsob ataque01 jul 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

abrir ↗

GitHub PoC★ 1

A flaw was found in NGINX, specifically within the ngx_http_rewrite_module. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests under specific rewrite configurations. This can lead to a heap buffer overflow in the NGINX worker process, which may result in arbitrary code execution

CVE-2026-42945CRITICAL01 jul 2026

NGINX ngx_http_rewrite_module vulnerability

60RISCO

abrir ↗

GitHub PoC

CVE-2026-48907 PoC

CVE-2026-48907CRITICALsob ataque01 jul 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

GitHub PoC★ 1

🛡️ CVE Proof-of-Concept Hub — 21 security advisories · 80+ vulnerabilities · 19 CVEs under review · 1 PUBLISHED (CVE-2026-66412)

CVE-2026-66412HIGH01 jul 2026

Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

21RISCO

abrir ↗

VulnCheck XDB

denial-of-service

CVE-2026-42945CRITICAL01 jul 2026

NGINX ngx_http_rewrite_module vulnerability

60RISCO

abrir ↗

GitHub PoC

Pivotal CRM's patch for an initial deserialization vulnerability was incomplete. The fix switched from BinaryFormatter to JSON.NET but left TypeNameHandling set to 4 without implementing SerializationBinder, allowing attackers to execute arbitrary code through malicious $type payloads. Fixed in 6.6.5.10 and Patch_CWE502_20260316.zip

CVE-2026-51947CRITICAL01 jul 2026

An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 a

48RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-57819CRITICALsob ataque01 jul 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

abrir ↗

GitHub PoC★ 1

Safari 跨域信息读取

CVE-2026-43735HIGH01 jul 2026

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS

41RISCO

abrir ↗

GitHub PoC★ 48

Google Chrome CVE-2026-6307 PoC

CVE-2026-6307HIGH01 jul 2026

Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code

41RISCO

abrir ↗

GitHub PoC

emilliewatson96/spryCVE-2026-10520

CVE-2026-10520CRITICALsob ataque01 jul 2026

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.