Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

87.464exploits catalogados

40.695CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4.577Metasploit 3.539✓ só verificadosrecentes populares risco

87.464 exploits

GitHub PoC

Detection-only triage scanner for Rust zip cloaking CVE-2026-115905: Cargo version check plus Central vs Local header comparison. No payloads, no extraction.

CVE-2026-115905CRITICAL27 out 2026

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

48RISCO

GitHub PoC★ 1

CVE-2026-110720 - HashiCorp consul-k8s Cross-Namespace ACL Bypass PoC & Exploit

CVE-2026-110720CRITICAL27 out 2026

Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules

48RISCO

GitHub PoC

Liquescent-Development/CVE-2026-109618-CVE-2026-109619

CVE-2026-109618CRITICALsob ataque27 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

PHP2Shell (CVE-2026-109618/109619) exposure sweep and takeover assessment across 56 vulnerable TZ/KE hosts

CVE-2026-109618CRITICALsob ataque27 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

Find every Wasmtime engine embedded in binaries, wheels, NuGet packages and layers, and check CVE-2026-115889/115893

CVE-2026-115889CRITICAL27 out 2026

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

48RISCO

GitHub PoC

Security audit and remediation agent for CVE-2026-111497, an out-of-bounds write in the Google Brotli decoder: detect, patch and verify on Debian and Ubuntu

CVE-2026-111497CRITICAL27 out 2026

Out-of-Bounds Write in Google Brotli Decoder

70RISCO

GitHub PoC

PoC / exploit archive for CVE-2026-96760

CVE-2026-96760CRITICAL27 out 2026

Authlib library contains a signature‑verification bypass vulnerability

48RISCO

GitHub PoC

Detect-only PHP2Shell (CVE-2026-109618/109619) exposure check for websites and local network devices

CVE-2026-109618CRITICALsob ataque27 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

cyb3r-w0lf/CVE-2026-49881

CVE-2026-49881HIGH27 out 2026

In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the

41RISCO

VulnCheck XDB

initial-access

CVE-2026-16723CRITICAL27 out 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RISCO

GitHub PoC★ 2

CVE-2026-15176 — NGINX alias+rewrite heap overflow: analysis, differential lab, PoC (WIP)

CVE-2026-15176CRITICAL27 out 2026

NGINX ngx_http_core_module vulnerability

48RISCO

GitHub PoC★ 1

CVE-2026-80097 - Microsoft Authenticator Android Token Theft PoC & Exploit

CVE-2026-80097HIGH27 out 2026

Microsoft Authenticator Elevation of Privilege Vulnerability

41RISCO

GitHub PoC

Find Plex Media Servers affected by Plex2Shell (CVE-2026-96652 and three more)

CVE-2026-96652MEDIUMsob ataque27 out 2026

Plex Media Server SSRF

83RISCO

GitHub PoC★ 1

CVE-2026-111497 - .NET Brotli OOB Write PoC and Exploit (HTTP2Shell) | By Gh0st-Bx1

CVE-2026-111497CRITICAL27 out 2026

Out-of-Bounds Write in Google Brotli Decoder

70RISCO

GitHub PoC★ 17

Proof of concept of CVE-2026-84636, WiFi SSID Info Disclosure

CVE-2026-84636MEDIUM27 out 2026

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 2

33RISCO

VulnCheck XDB

initial-access

CVE-2026-102785CRITICAL27 out 2026

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52

48RISCO

GitHub PoC★ 1

CVE-2026-102785: YOOtheme Pro 5.0.0-5.0.52 unauthenticated RCE via image handler signature reuse + path traversal + JPEG/PHP polyglot. CVSS 10.0. Check script, exploit, detection rules.

CVE-2026-102785CRITICAL27 out 2026

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52

48RISCO

GitHub PoC★ 2

weblogic CVE-2026-70748,CVE-2026-60672,CVE-2026-35301;PHP CVE-2026-109618 CVE-2026-109619,Node.js CVE-2026-111497,NGINX CVE-2026-42945 CVE-2026-42533 CVE-2026-15176 CVE-2026-93479,Apache HTTPD 2.4.66 CVE-2026-23918,IIS CVE-2026-70024,HTTP.sys CVE-2026-47291... RCE CVE scanner

CVE-2026-70748CRITICAL27 out 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

28RISCO

GitHub PoC

PoC and exploit for CVE-2025-24813 - Apache Tomcat Partial PUT RCE (CVSS 9.8)

CVE-2025-24813CRITICALsob ataque27 out 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

GitHub PoC★ 3

PHP2Shell — CVE-2026-109618/109619 exploit toolkit: 5 chains + JA3 stealth + mass scan + safe webshell. Authorized testing only.

CVE-2026-109618CRITICALsob ataque27 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC★ 1

Persistent root for LG webOS 2.x TVs (CVE-2014-3153)

CVE-2014-3153HIGHsob ataque27 out 2026

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two diff

98RISCO

GitHub PoC

Measured php2shell (CVE-2026-109618/109619) RCE frontier on amd64: 8.3.35 closed via gdb crash forensics (HTDATA=chunk+0x6a0d8); per-build profiles, tools, method

CVE-2026-109618CRITICALsob ataque27 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC★ 1

Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries themselves, not just version numbers, so it catches bundled copies in Node.js, Python, .NET, Bun and Envoy. Read-only, bash only.

CVE-2026-111497CRITICAL27 out 2026

Out-of-Bounds Write in Google Brotli Decoder

70RISCO

GitHub PoC★ 2

Exposure triage, host verification and remediation tracking for PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

CVE-2026-109618CRITICALsob ataque27 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC★ 1

WordPress XML-RPC pingback lab and crash PoC for CVE-2026-111497 (Brotli decoder out-of-bounds write).

CVE-2026-111497CRITICAL27 out 2026

Out-of-Bounds Write in Google Brotli Decoder

70RISCO

GitHub PoC

CVE-2026-109618 · CVE-2026-109619

CVE-2026-109618CRITICALsob ataque27 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

Detection-only PHP version/exposure scanner for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Fingerprints PHP version via standard HTTP headers, no exploit payload sent.

CVE-2026-109618CRITICALsob ataque27 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

Read-only exposure checks for PHP2Shell (CVE-2026-109618 / -109619): accuracy-hardened scanner + two on-box auditors.

CVE-2026-109618CRITICALsob ataque27 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

Offline Python detector for CVE-2023-7356 exposure in upstream Linux kernels, with CSV/JSON inventories and auditable reports.

CVE-2023-7356HIGH27 out 2026

Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID

21RISCO

GitHub PoC

HDU IS Lab 1: secure Flask REST API, CI/CD SAST+SCA pipeline and CVE-2021-43798 analysis

CVE-2021-43798HIGHsob ataque27 out 2026

Grafana path traversal

100RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.