Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
84.035exploits catalogados
39.531CVEs com exploração pública
24.695testados em laboratório
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9.678Nuclei 4.478Metasploit 3.524✓ só verificadosrecentespopularesrisco
16.200 exploits
GitHub PoC
Bilingual PoC and technical analysis for CVE-2026-105950 — Formwork formaction URI sanitizer bypass
getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
33RISCO
abrir ↗GitHub PoC
PoCs for CVE-2026-102262 & CVE-2026-101893 — code execution and XXE in DYMO ID (reported & fixed)
Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control
41RISCO
abrir ↗GitHub PoC
POC for the CVE-2026-104711
Apache Struts: OGNL injection in the legacy RESTful action mapper
48RISCO
abrir ↗GitHub PoC★ 33
CVE-85884 POC
Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability
41RISCO
abrir ↗GitHub PoC
POC EXPLOIT CVE-2026-104711
Apache Struts: OGNL injection in the legacy RESTful action mapper
48RISCO
abrir ↗GitHub PoC★ 1
POC for CVE-2026-104711 - New
Apache Struts: OGNL injection in the legacy RESTful action mapper
48RISCO
abrir ↗GitHub PoC★ 1
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length.
hey,
`_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length agains
41RISCO
abrir ↗GitHub PoC★ 1
MiniUPnPd <= 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header
MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header
41RISCO
abrir ↗GitHub PoC
POC for CVE-2026-104711-Advanced-Variant
Apache Struts: OGNL injection in the legacy RESTful action mapper
48RISCO
abrir ↗GitHub PoC★ 56
GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image
Integer Overflow or Wraparound in GitLab
48RISCO
abrir ↗GitHub PoC
SSRF in Hyperledger FireFly Webhook Subscriptions (CVE-2026-82957)
hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery
33RISCO
abrir ↗GitHub PoC
CVE-2026-108924: didactic PoC for Kirby dynamic option authorization bypass
getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
33RISCO
abrir ↗GitHub PoC★ 1
POC CVE-2026-85097
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
48RISCO
abrir ↗GitHub PoC
Exploits CVE-2026-58222 to recover Samba KDS root keys and derive gMSA credentials from a low-privilege domain account.
Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes
41RISCO
abrir ↗GitHub PoC
PoC for CVE-2026-68582 / GHSA-rj9j-8772-4h6c — Vikunja link-share BOLA
Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
48RISCO
abrir ↗GitHub PoC
CVE-2026-72898 Metabase Security Tools
Metabase SQL injection via password reset endpoint
100RISCO
abrir ↗GitHub PoC★ 2
Command execution and patch bypass of CVE-2026-28291 in git-js.
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
41RISCO
abrir ↗GitHub PoC
CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE
Integer Overflow or Wraparound in GitLab
48RISCO
abrir ↗GitHub PoC★ 1
Write-up for CVE-2026-109721
Incorrect boundary conditions in the JavaScript Engine: JIT component
23RISCO
abrir ↗GitHub PoC
Unauthenticated remote code execution in Ivanti Connect Secure (CWE-290, CVSS 8.6)
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb
91RISCO
abrir ↗GitHub PoC★ 7
CVE-2026-76268 PoC: Splunk Enterprise SHC Patroni REST unauth RCE — PATCH /config archive_command + POST /restart. Check + mass exploit, OOB POCBIT-76268-OK, CVSS 9.8. https://pocbit.org/pocs/cve-2026-76268
Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
48RISCO
abrir ↗GitHub PoC
CVE-2026-110025: bilingual analysis and safe local PoC for phpwcms unrestricted upload to RCE
slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
33RISCO
abrir ↗GitHub PoC★ 9
CVE-2026-91737 Chrome renderer RCE PoC (PDFium)
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside
41RISCO
abrir ↗GitHub PoC
Independent public PoC for CVE-2026-79987 — Craft CMS 5.9.0–5.10.12 authenticated RCE. Patch-analysis n-day implementation, verified on vanilla lab. Advisory: GHSA-9c4j-cjw3-r3xx
Low-privilege RCE through element-search eager loading
41RISCO
abrir ↗GitHub PoC
AraxyAI/CVE-2026-92956__vm2__test__20261012
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
48RISCO
abrir ↗GitHub PoC★ 3
0xad3m/CVE-2026-13078-POC
Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
33RISCO
abrir ↗GitHub PoC
Independent reconstruction, lab validation, and PoC for CVE-2026-72898 — Metabase unauthenticated SQLi (patched in 0.63.5)
Metabase SQL injection via password reset endpoint
100RISCO
abrir ↗GitHub PoC★ 1
For new CVEs without existing/working/non-mangled POCs
Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB
98RISCO
abrir ↗GitHub PoC
0xCyp1337/CVE-2026-63030-CVE-2026-60137-WP2SHELL
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.