Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

84.150exploits catalogados

39.601CVEs com exploração pública

24.695testados em laboratório

Todos Referência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9.680Nuclei 4.488Metasploit 3.525✓ só verificadosrecentes populares risco

16.153 exploits

GitHub PoC

Educational cyber range for CVE-2026-59827 (Metabase H2 unsafe deserialization / CWE-502). Isolated Docker lab — training only, not for attacking production Metabase.

CVE-2026-59827CRITICAL17 set 2026

Metabase: Unsafe Deserialization of H2 Query Results

48RISCO

GitHub PoC★ 2

CVE-2026-49179: Active Directory WriteSPNScript Command Injection

CVE-2026-49179HIGH17 set 2026

Windows Active Directory Domain Services Remote Code Execution Vulnerability

41RISCO

GitHub PoC

CVE-2026-85706

CVE-2026-85706CRITICALsob ataque17 set 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

100RISCO

GitHub PoC★ 5

PoC for CVE-2026-67401 — cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE. Includes a self-contained vulnerable lab, SQLi detection, and full exploit chain.

CVE-2026-67401CRITICAL17 set 2026

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr

48RISCO

GitHub PoC★ 1

CVE-2026-87930 Joomla Multi-CVE RCE suite — authorized testing only

CVE-2026-87930CRITICAL17 set 2026

MaxSite CMS through 109.6 PHP Object Injection via ci_session

48RISCO

GitHub PoC

CVE-2026-12793 - JetFormBuilder Unauthorized RCE (CRITICAL 9.8)

CVE-2026-12793CRITICAL17 set 2026

JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

48RISCO

GitHub PoC★ 2

spip exploits for CVE-2026-72708, CVE-2026-72709, CVE-2026-72710

CVE-2026-72708HIGH16 set 2026

SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html

41RISCO

GitHub PoC★ 48

container escape POCs for CVE-2026-80521 and CVE-2026-52910

CVE-2026-80521HIGH16 set 2026

af_unix: Unlink scc_entry in unix_del_edge().

41RISCO

GitHub PoC★ 1

Issabel pbxapi hard coded JWT RCE POC

CVE-2026-89026CRITICAL16 set 2026

Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

48RISCO

GitHub PoC

Langflow 1.10.0 urllib SSRF

CVE-2026-12944CRITICAL16 set 2026

Incomplete Security Scanner Blocklist Enables Network-Based Code Execution

48RISCO

GitHub PoC

CVE-2014-0160 (Heartbleed) lab: vulnerable OpenSSL 1.0.1f in Docker, a memory-leak PoC, and a demo. Authorised lab use only.

CVE-2014-0160HIGHsob ataque16 set 2026

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISCO

GitHub PoC

FabianCH20/SOC335---CVE-2024-49138-Exploitation-Detected

CVE-2024-49138HIGHsob ataque16 set 2026

Windows Common Log File System Driver Elevation of Privilege Vulnerability

76RISCO

GitHub PoC★ 3

Proof of Concept and Write-up for CVE-2026-56096 (Blind Parameter Injection in TYPO3 EXT:solr)

CVE-2026-56096MEDIUM16 set 2026

Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

33RISCO

GitHub PoC

CVE-2021-29447 is an authenticated XML External Entity (XXE) vulnerability in WordPress

CVE-2021-29447HIGH16 set 2026

WordPress Authenticated XXE attack when installation is running PHP 8

63RISCO

GitHub PoC

Information on the security content of Apple software updates

CVE-2026-84600MEDIUM16 set 2026

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS

33RISCO

GitHub PoC★ 8

Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail

CVE-2025-32432CRITICALsob ataque16 set 2026

Craft CMS Allows Remote Code Execution

100RISCO

GitHub PoC

Unofficial Apache Doris Spark connector 26.1.0 security fork for Java / Spark 3.5.1 / Scala 2.12; patched shaded Jackson for CVE-2026-54512.

CVE-2026-54512HIGH16 set 2026

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

41RISCO

GitHub PoC

avergnaud/flight-sql-jdbc-driver-cve-2026-54512

CVE-2026-54512HIGH16 set 2026

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

41RISCO

GitHub PoC

CVE-2026-65374 - Draft or TODO

CVE-2026-65374HIGH16 set 2026

A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Seq

41RISCO

GitHub PoC★ 11

research on finding the bug and fix of CVE-2026-84616 and CVE-2026-84607

CVE-2026-84616MEDIUM16 set 2026

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS

33RISCO

GitHub PoC

rootxn/CVE-2026-12793

CVE-2026-12793CRITICAL16 set 2026

JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

48RISCO

GitHub PoC

CVE-2026-5430 - Draft or TODO

CVE-2026-5430CRITICALsob ataque16 set 2026

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

78RISCO

GitHub PoC

shivammittal2403/cve-2026-80428-ctf

CVE-2026-80428CRITICAL16 set 2026

ILIAS PHP Object Injection via Shibboleth Logout

48RISCO

GitHub PoC★ 5

CVE-2026-12793 PoC — JetFormBuilder ≤3.6.2 unauth Register User / admin account creation

CVE-2026-12793CRITICAL16 set 2026

JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

48RISCO

GitHub PoC★ 1

My first CVE

CVE-2026-65330MEDIUM16 set 2026

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoi

33RISCO

GitHub PoC

0xgh0stri13y/CVE-2026-109519

CVE-2026-109519MEDIUM16 set 2026

YouTransfer Template Rendering template path traversal

33RISCO

GitHub PoC★ 1

Proof-of-Concept for CVE-2026-92680, the insecurely protected credentials vulnerability affecting Araxis Merge.

CVE-2026-92680MEDIUM16 set 2026

Araxis Merge insufficiently protected credentials

33RISCO

GitHub PoC★ 526

A cPanel and WHM authentication bypassing tool

CVE-2026-41940CRITICALsob ataqueransomware16 set 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RISCO

GitHub PoC

CVE-2026-15315, CVE-2026-15316 - Draft or TODO

CVE-2026-15315HIGH15 set 2026

Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200

41RISCO

GitHub PoC

isaca0315/CVE-2026-65013-BOLA-IDOR

CVE-2026-65013HIGH15 set 2026

Onlook tRPC Insecure Direct Object Reference via multiple procedures

41RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.