Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

87.464exploits catalogados
40.695CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4.577Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.464 exploits
GitHub PoC
Reproducible local Docker lab for CVE-2026-109618 PHP-FPM validation
CVE-2026-109618CRITICALsob ataque26 out 2026
RCE via OOM corruption
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2025-3987MEDIUM26 out 2026
TOTOLINK N150RT formWsc command injection
38RISCO
abrir ↗
GitHub PoC★ 1
hack-ita/php2shell-cve-2026-109618-109619
CVE-2026-109618CRITICALsob ataque26 out 2026
RCE via OOM corruption
100RISCO
abrir ↗
GitHub PoC★ 1
CVE-2026-109618-109619 PHP2shell
CVE-2026-109618CRITICALsob ataque26 out 2026
RCE via OOM corruption
100RISCO
abrir ↗
VulnCheck XDB
info-leak
CVE-2021-48015HIGH26 out 2026
JeeWMS Path Traversal via showOrDownByurl.do
41RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2024-45409CRITICAL26 out 2026
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
53RISCO
abrir ↗
VulnCheck XDB
info-leak
CVE-2017-1000028—26 out 2026
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trave
60RISCO
abrir ↗
VulnCheck XDB
info-leak
CVE-2026-99999CRITICAL26 out 2026
ipv4: validate checksum_start before completing checksum
48RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-109619CRITICALsob ataque26 out 2026
RCE via stale global state
100RISCO
abrir ↗
VulnCheck XDB
denial-of-service
CVE-2026-109619CRITICALsob ataque26 out 2026
RCE via stale global state
100RISCO
abrir ↗
VulnCheck XDB
denial-of-service
CVE-2026-109618CRITICALsob ataque26 out 2026
RCE via OOM corruption
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-109619CRITICALsob ataque26 out 2026
RCE via stale global state
100RISCO
abrir ↗
VulnCheck XDB
denial-of-service
CVE-2026-109618CRITICALsob ataque26 out 2026
RCE via OOM corruption
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-109618CRITICALsob ataque26 out 2026
RCE via OOM corruption
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-109619CRITICALsob ataque26 out 2026
RCE via stale global state
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-39987CRITICALsob ataque26 out 2026
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2017-5689CRITICALsob ataque26 out 2026
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2025-31161CRITICALsob ataqueransomware26 out 2026
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RISCO
abrir ↗
VulnCheck XDB
info-leak
CVE-2019-17503—26 out 2026
An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REG
50RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2020-25494—26 out 2026
Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in ou
35RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2018-25126CRITICAL26 out 2026
TVT NVMS-9000 Hard-coded API Credentials & Command Injection
48RISCO
abrir ↗
VulnCheck XDB
remote-with-credentials
CVE-2024-24329CRITICAL26 out 2026
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable param
63RISCO
abrir ↗
GitHub PoC★ 1
node2shell-detector - local + network detections for Node2Shell (CVE-2026-111497) by IONSEC. Python CLI: runtime posture, Brotli decoder fingerprints, dependency exposure, log fingerprints, opt-in self-test; plus Sigma, Suricata, ModSecurity, YARA rules and edge/app snippets.
CVE-2026-111497CRITICAL26 out 2026
Out-of-Bounds Write in Google Brotli Decoder
70RISCO
abrir ↗
GitHub PoC★ 2
Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, no dependencies or exploit payloads.
CVE-2026-111497CRITICAL26 out 2026
Out-of-Bounds Write in Google Brotli Decoder
70RISCO
abrir ↗
GitHub PoC★ 24
Android LPE (CVE-2026-98260) on Honor MagicPad3 Pro 13.3 (YLP-W00), kernel 6.12.38 — PoC/EXP, uid-0 shell, KernelSU app
CVE-2026-98260HIGH26 out 2026
exec: Cleanup POSIX timers right after de_thread()
41RISCO
abrir ↗
GitHub PoC
CVE-2026-101767
CVE-2026-101767CRITICAL26 out 2026
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported
48RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2024-10441CRITICAL26 out 2026
Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before
48RISCO
abrir ↗
GitHub PoC★ 6
Xiaomi Pad7S Pro12.5在OS4.0.0.14.XOTCNXM利用CVE-2026-98260获取ROOT权限并加载KernelSU。
CVE-2026-98260HIGH26 out 2026
exec: Cleanup POSIX timers right after de_thread()
41RISCO
abrir ↗
VulnCheck XDB
denial-of-service
CVE-2026-109618CRITICALsob ataque26 out 2026
RCE via OOM corruption
100RISCO
abrir ↗
GitHub PoC
Offline Python detector for CVE-2026-91403 certificate indicators in Java trust stores, with fingerprint matching and JSON reports.
CVE-2026-91403CRITICAL26 out 2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE
48RISCO
abrir ↗
← anteriorpágina 28 / 2.916próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.