Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

84.150exploits catalogados

39.601CVEs com exploração pública

24.695testados em laboratório

Todos Referência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9.680Nuclei 4.488Metasploit 3.525✓ só verificadosrecentes populares risco

16.153 exploits

GitHub PoC★ 2

PoC for CVE-2026-17633 — Authenticated RCE in IBM Langflow OSS 1.0.0–1.10.3 via custom_component endpoint. Includes CVE-2026-17632 AST scanner bypass research.

CVE-2026-17633HIGH15 set 2026

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

41RISCO

GitHub PoC

e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-24813

CVE-2025-24813CRITICALsob ataque15 set 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

GitHub PoC★ 12

PoC for CVE-2026-59346 - 32-bit integer overflow in VMware's VMXNET3 TSO segmentation path, guest-to-host crash.

CVE-2026-59346CRITICAL15 set 2026

VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability

48RISCO

GitHub PoC

Testing for CVE-2025-8191

CVE-2025-8191MEDIUM15 set 2026

macrozheng mall Swagger UI index.html cross site scripting

33RISCO

GitHub PoC★ 3

Langflow 1.10.0 urllib SSRF POC

CVE-2026-12944CRITICAL15 set 2026

Incomplete Security Scanner Blocklist Enables Network-Based Code Execution

48RISCO

GitHub PoC

FLX-0x00/CVE-2026-59550

CVE-2026-59550CRITICAL15 set 2026

WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability

48RISCO

GitHub PoC

Authenticated Arbitrary File Upload leading to Remote Code Execution Technical analysis and controlled reproduction of CVE-2026-38526 in Webkul Krayin CRM 2.2.x.

CVE-2026-38526CRITICAL15 set 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RISCO

GitHub PoC

fix for not working exploit script on exploitdb (50057.py)

CVE-2009-2265—15 set 2026

Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable fil

60RISCO

GitHub PoC

Si13NTTT/CVE-2025-24813

CVE-2025-24813CRITICALsob ataque15 set 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

GitHub PoC

isaca0315/CVE-2026-65013-BOLA-IDOR

CVE-2026-65013HIGH15 set 2026

Onlook tRPC Insecure Direct Object Reference via multiple procedures

41RISCO

GitHub PoC★ 1

NONAME-ELV/CVE-2026-48907

CVE-2026-48907CRITICALsob ataque15 set 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

98RISCO

GitHub PoC★ 2

CVE-2026-76461

CVE-2026-76461CRITICALsob ataque15 set 2026

Cisco Secure Email Gateway SQL Injection Vulnerability

83RISCO

GitHub PoC

0xf9b6a41ec/CVE-2026-69328

CVE-2026-69328HIGH15 set 2026

Windows Storage Elevation of Privilege Vulnerability

41RISCO

GitHub PoC

CVE-2026-15315, CVE-2026-15316 - Draft or TODO

CVE-2026-15315HIGH15 set 2026

Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200

41RISCO

GitHub PoC★ 2

CVE-2026-65343: OOB read in AppleKeyStore.kext (_LibSer_SEPControl_Deserialize) copies an ACM buffer to userspace without length validation, letting sandboxed processes leak kernel pointers (0xfffffff0…) and defeat KASLR via DYLD_INTERPOSE ACM handle capture. Fixed in iOS 26.6.1 (23G83).

CVE-2026-65343HIGH15 set 2026

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.

41RISCO

GitHub PoC

Laboratorio académico de análisis y explotación de CVE-2025-5548 en FreeFloat FTP Server 1.0.

CVE-2025-5548MEDIUM15 set 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RISCO

GitHub PoC★ 4

CVE-2026-82329 – JFrog Artifactory Auth Bypass Toolkit (CVSS 9.8) | Red/Blue Team suite for self-hosted Artifactory 7.x (111-161). 2 tools: Full Exploit (JWTforge, admin token, user create, mass scan, stealth, interactive menu, resistence, WAF bypass etc.), SafeChecker (version detect, audit, JSON report). 🦾 Use Ethically, Stay Legal :V

CVE-2026-82329CRITICALsob ataque15 set 2026

Potential authentication bypass leading to administrative access in Artifactory

98RISCO

GitHub PoC

Tenda Technology Co., Ltd NVR_4H: CH3 v2.1.V27.5.58.6 was discovered to contain a hardcoded cryptographic key.

CVE-2026-79551HIGH15 set 2026

Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.

41RISCO

GitHub PoC

CVE-2026-85706 — GitLab unauthenticated arbitrary file read (CVSS 10.0). Root-cause analysis, vulnerable Docker lab, and PoC.

CVE-2026-85706CRITICALsob ataque14 set 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

100RISCO

GitHub PoC

POC of cve-2026-52910

CVE-2026-52910HIGH14 set 2026

bpf: Free reuseport cBPF prog after RCU grace period.

41RISCO

GitHub PoC

hands on investigation of the heartbleed vulnerability (CVE-2014-0160).

CVE-2014-0160HIGHsob ataque14 set 2026

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISCO

GitHub PoC

Standalone PoC for CVE-2026-90782: status-clobbering NULL dereference in S2OPC alloc_notification_message_items() (DataChange fails, Event succeeds)

CVE-2026-90782MEDIUM14 set 2026

S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()

33RISCO

GitHub PoC

Si13NTTT/CVE-2025-32432

CVE-2025-32432CRITICALsob ataque14 set 2026

Craft CMS Allows Remote Code Execution

100RISCO

GitHub PoC★ 2

CVE-2019-2215 & DirtyCOW exploit automation + post-root debloat + Magisk modules for Sony BRAVIA KDL-43W800C

CVE-2019-2215HIGHsob ataque14 set 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RISCO

GitHub PoC

CVE-2026-85706 — GitLab unauthenticated arbitrary file read (CVSS 10.0). Root-cause analysis, vulnerable Docker lab, and PoC.

CVE-2026-85706CRITICALsob ataque14 set 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

100RISCO

GitHub PoC

PwnKit - polkit pkexec Local Privilege Escalation <= 0.105-31

CVE-2021-4034HIGHsob ataqueransomware14 set 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISCO

GitHub PoC

rh-rahulshetty/log4shell-CVE-2021-44228

CVE-2021-44228CRITICALsob ataqueransomware14 set 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

GitHub PoC

e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-32432

CVE-2025-32432CRITICALsob ataque14 set 2026

Craft CMS Allows Remote Code Execution

100RISCO

GitHub PoC

Knowns 0.30.0: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem

CVE-2026-88899CRITICAL14 set 2026

knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

48RISCO

GitHub PoC

CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read exploit PoC.

CVE-2026-85706CRITICALsob ataque14 set 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

100RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.