Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
87.464exploits catalogados
40.695CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4.577Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.464 exploits
GitHub PoC
Offline vm2 evidence checker for CVE-2026-92935. Sandbox package and nesting evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
vm2 NodeVM Remote Code Execution via Array-Shaped Require
48RISCO
abrir ↗GitHub PoC
Offline BeyondTrust Remote Support evidence checker for CVE-2026-102764. Remote Support version and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
100RISCO
abrir ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88775. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
41RISCO
abrir ↗GitHub PoC
BotProtection, blocking reconnaissance scans used in exploits like PHP2Shell (CVE-2026-109618 / CVE-2026-109619) before malicious payloads reach the PHP runtime.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88773. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
HTTP Request Smuggling
63RISCO
abrir ↗GitHub PoC
Offline Flowise evidence checker for CVE-2026-69254. Flowise version and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
48RISCO
abrir ↗GitHub PoC★ 1
Engine-level PHP2SHELL (CVE-2026-109618/109619) lab: stock PHP RCE, interactive exploit, multi-worker/TLS/OOB, Docker evidence.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58042: DNS resolveAny process abort. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Rec
33RISCO
abrir ↗GitHub PoC
Detection-only scanner for CVE-2026-109618 & CVE-2026-109619 (PHP). Authorized testing only.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-56846: HTTP/2 retained header memory exhaustion. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memor
41RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58044: HTTP header-limit request smuggling. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild ou
28RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58045: zlib synchronous API spoofed TypedArray crash. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:z
33RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58041: SQLite cached iterator write replay. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to cont
33RISCO
abrir ↗GitHub PoC
regex2shell (CVE-2026-110264 + family) — GitLab/Onigmo unauth regex RCE research: safe differential detector, deterministic interpreter kill, match-time write primitive
Integer Overflow or Wraparound in GitLab
48RISCO
abrir ↗GitHub PoC
Defensive remediation helper for the PHP2Shell RCE (CVE-2026-109618 / CVE-2026-109619): detects exposure and applies the official fix, with a source-build drop-in for end-of-life PHP 7.4/8.0/8.1.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 3
🧪 Laboratorio Docker aislado para reproducir y estudiar PHP2Shell (CVE-2026-109618 / CVE-2026-109619), RCE no autenticado en PHP ≤8.5.11. Incluye exploit unificado en Python, verificación automática y documentación fase a fase con fines defensivos.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Free PHP2Shell (CVE-2026-109618, CVE-2026-109619) check skill for Claude Code and Codex. Reads the PHP package and runtime evidence you supply. MIT.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-109618/109619 (php2shell) PHP exposure classifier and remediation planner. BSD-2-Clause.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
48RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-106070: ZipFile invalid-header content substitution. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after th
28RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-106073: Permission Model realpathSync read bypass. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissio
28RISCO
abrir ↗GitHub PoC★ 4
PoC exploit harness and research framework for CVE-2026-109618 and CVE-2026-109619 (PHP session.upload_progress UAF).
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 7
Drop-in php:7.4-apache/fpm/cli Docker images with the official fix for CVE-2026-109618 / CVE-2026-109619 (critical PHP RCE). amd64 + arm64.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-56846: Node.js: HTTP/2 retained header memory exhaustion. One exploit per repository; implementation pending.
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memor
41RISCO
abrir ↗GitHub PoC
Check and fix hosts, Docker containers and k8s pods: leaked eMudhra CA trust, and Brotli decoder CVE-2026-111497 scanner
Out-of-Bounds Write in Google Brotli Decoder
70RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.