Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.900exploits catalogados

36.847CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.475Referência 23.360GitHub PoC 15.228VulnCheck XDB 8.946Nuclei 4.390Metasploit 3.501✓ só verificadosrecentes populares risco

79.900 exploits

GitHub PoC★ 101

Proof-of-concept exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining a broken access, CAB arbitrary-write path traversal, certificate verification bypass, and DLL hijacking to achieve SYSTEM-level code execution.

CVE-2026-47301HIGH03 ago 2026

Configuration Manager Elevation of Privilege Vulnerability

41RISCO

VulnCheck XDB

initial-access

CVE-2022-22965CRITICALsob ataque03 ago 2026

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISCO

VulnCheck XDB

initial-access

CVE-2026-16232CRITICALsob ataque03 ago 2026

Authentication Bypass in the SmartConsole Login Process Using an Application Token

100RISCO

GitHub PoC

fastjson vulnerability scanner - detect fastjson in JARs and Spring Boot fat-JARs, check exposure to CVE-2026-16723, and verify whether you already run the official patch 1.2.84. Zero-dependency offline CLI. fastjson 漏洞检测与排查工具：一条命令扫描依赖，支持 fat-JAR 与 shaded 依赖，并判定是否已升到官方补丁版本 1.2.84。

CVE-2026-16723CRITICAL03 ago 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

53RISCO

GitHub PoC★ 60

villager1314/CVE-2026-64560-Analysis

CVE-2026-64560HIGH03 ago 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISCO

GitHub PoC

siboy17/CVE-2022-21907-http.sys

CVE-2022-21907CRITICAL03 ago 2026

HTTP Protocol Stack Remote Code Execution Vulnerability

70RISCO

GitHub PoC

George0Papasotiriou/CVE-2026-6666-XPC-Service-NSKeyedUnarchiver-Deserialization-Attack-macOS-iOS-simulation-

CVE-2026-6666MEDIUM03 ago 2026

PgBouncer crash in kill_pool_logins_server_error

33RISCO

GitHub PoC

Path traversal (Tar Slip) in Cornac via _extract_archive (CVE-2026-43637)

CVE-2026-43637HIGH03 ago 2026

Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py

41RISCO

GitHub PoC★ 2

Kangaroo is a exploit built on CVE-2026-32746. i made this for security researchers, IT professionals, DevOps. so they can understand it better. DO NOT USE THIS FOR ILLEGAL USE, IF YOU DO... YOU MAY BE SUBJECT TO ARREST, AND FINES.

CVE-2026-32746CRITICAL02 ago 2026

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption

53RISCO

GitHub PoC

Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

CVE-2026-13714CRITICAL02 ago 2026

Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

48RISCO

GitHub PoC

Mass vulnerability scanner for CVE-2026-49049 – Unauthenticated Remote Code Execution in Joomla Helix3 plugin. Multi‑threaded, detects both executed and raw PHP payloads.

CVE-2026-49049HIGH02 ago 2026

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

56RISCO

GitHub PoC

CVE-2026-9809 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting Mautic 7 (versions 7.0.0 through 7.1.1).

CVE-2026-9809HIGH02 ago 2026

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project

41RISCO

GitHub PoC

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

CVE-2026-59941MEDIUM02 ago 2026

Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

33RISCO

GitHub PoC★ 3

WordPress CVE-2026-63030 and CVE-2026-60137 security tool for detecting exposure to the WP2Shell pre-authentication RCE chain.

CVE-2026-63030CRITICALsob ataque02 ago 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

GitHub PoC★ 1

TryHackMe Dirty Frag (CVE-2026-43284) — Linux LPE writeup

CVE-2026-43284HIGH02 ago 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RISCO

GitHub PoC★ 2

A flaw in Gitea Open Source Git Server’s approval‑gate logic allows a pull request that originates from a permanent fork to merge without satisfying the repository’s configured approval gates.

CVE-2026-58424HIGH02 ago 2026

Permanent Fork PR Workflow Approval Gate Bypass

41RISCO

GitHub PoC★ 3

CVE-2026-43499 for the Meta Quest

CVE-2026-43499HIGH02 ago 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC

VMware vCenter Server CVE-2021-21972 (RCE) — vulnerability analysis, detection, and mitigation

CVE-2021-21972CRITICALsob ataqueransomware02 ago 2026

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor

100RISCO

GitHub PoC

Log4Shell (CVE-2021-44228) research report — technical breakdown, root cause analysis, and end-to-end lab-reproduced exploit chain with evidence screenshots.

CVE-2021-44228CRITICALsob ataqueransomware02 ago 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

GitHub PoC

CVE-2026-9811 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting Mautic 7 (versions 7.0.0 through 7.1.1).

CVE-2026-9811MEDIUM02 ago 2026

A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering s

33RISCO

GitHub PoC★ 20

the CVE-2026-43499 by iqooneo11

CVE-2026-43499HIGH02 ago 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC★ 9

Unauthenticated File Upload → RCE PoC for CVE-2026-57827 (RSFiles! Joomla < 1.17.12). Authorized security research use only.

CVE-2026-57827CRITICAL02 ago 2026

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

63RISCO

GitHub PoC

CVE-2026-9806 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting CTI Transmute versions prior to the patched release.

CVE-2026-9806MEDIUM02 ago 2026

Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Names

33RISCO

GitHub PoC

Simple POC for CVE-2026-39987

CVE-2026-39987CRITICALsob ataque02 ago 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISCO

GitHub PoC

CVE-2026-39987 poc

CVE-2026-39987CRITICALsob ataque02 ago 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISCO

GitHub PoC

Marimo exploit prior to 0.23.0. Pre-Auth RCE vulnerability via websocket endpoint : /terminal/ws.

CVE-2026-39987CRITICALsob ataque02 ago 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISCO

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALsob ataque02 ago 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISCO

GitHub PoC★ 170

Jailbreak supported Google Pixel phones with CVE-2026-43499

CVE-2026-43499HIGH02 ago 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALsob ataque02 ago 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISCO

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALsob ataque02 ago 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.