Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
87.464exploits catalogados
40.695CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4.577Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.168 exploits
GitHub PoC
Standalone defensive checker project for CVE-2026-104286: Fortinet FortiMail: Path traversal / NULL-byte arbitrary file write. One exploit per repository; implementation pending.
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
78RISCO
abrir ↗GitHub PoC
CentOS 7 Remi PHP 7.4/8.3 rebuild for CVE-2026-109618/109619
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-58039: Node.js: Permission Model process-report filesystem bypass. One exploit per repository; implementation pending.
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-wr
28RISCO
abrir ↗GitHub PoC
docker-library/php with PHP2Shell (CVE-2026-109618/109619) patched 7.4 and 8.1 buster images
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 8
ZeroHack: Node2Shell (CVE-2026-111497) Docker Lab & PoC Framework
Out-of-Bounds Write in Google Brotli Decoder
70RISCO
abrir ↗GitHub PoC★ 3
Detect systems affected by Node2Shell (CVE-2026-111497) on Unix and Windows
Out-of-Bounds Write in Google Brotli Decoder
70RISCO
abrir ↗GitHub PoC
Offline BeyondTrust Remote Support evidence checker for CVE-2026-102764. Remote Support version and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
100RISCO
abrir ↗GitHub PoC★ 2
Portable PHP asset discovery and exposure scanner for CVE-2026-109618 and CVE-2026-109619.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
CVE-2026-112403: Pillow heap buffer overflow in ImagingJpegDecode via lossless JPEG thumbnail. One POST, 100% crash rate.
Pillow: Heap buffer overflow in ImagingJpegDecode
48RISCO
abrir ↗GitHub PoC
Security reading group demo: Pillow GHSA-5x8w-8jj5-q52h (CVE-2026-112398) heap buffer overflow research note
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
48RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58044: HTTP header-limit request smuggling. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild ou
28RISCO
abrir ↗GitHub PoC
Offline Docker Hub PAT evidence checker for CVE-2026-105445. Supplied evidence only; no token collection, login or API requests. JSON/CSV/HTML reports.
Docker Hub account conversion could reassign an active personal access token to another user
48RISCO
abrir ↗GitHub PoC
Offline Ivanti Connect Secure evidence checker for CVE-2026-104935. Connect Secure build and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb
100RISCO
abrir ↗GitHub PoC★ 1
Defense guide + static scanner for CVE-2026-108551 (openapi-typescript-codegen code injection).
openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates
48RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-71362 — Magento Session Identity Poisoning → Mass Account Takeover (CVSS 9.1, CISA KEV)
Adobe Commerce | Incorrect Authorization (CWE-863)
100RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58045: zlib synchronous API spoofed TypedArray crash. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:z
33RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58041: SQLite cached iterator write replay. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to cont
33RISCO
abrir ↗GitHub PoC★ 1
Descubra se sites da internet é vulnerável a php2shell CVE-2026-109619
RCE via stale global state
100RISCO
abrir ↗GitHub PoC
All-in-one scanner for CVE-2026-109618 / CVE-2026-109619 (php2shell). Domain → subdomain enum → DNS resolve → passive PHP version check.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Detection-only scanner for CVE-2026-109618 & CVE-2026-109619 (PHP). Authorized testing only.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 1
Backport-aware PHP2Shell (CVE-2026-109618/109619) checker for installed PHP packages; knows distro and vendor fixed builds, incl. patched PHP 5.6-8.4 for CentOS 7
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Offline Tinypool evidence checker for CVE-2026-104849. Worker-pool package and options evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Tinypool: Prototype Pollution Gadget to RCE in run() options
48RISCO
abrir ↗GitHub PoC
Offline FortiMail evidence checker for CVE-2026-104286. FortiMail version and deployment evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
78RISCO
abrir ↗GitHub PoC
Offline simple-git evidence checker for CVE-2026-102826. Git configuration and package evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
simple-git allows command execution through unblocked Git configuration includes
41RISCO
abrir ↗GitHub PoC
Live tracker: how fast is the internet patching PHP against PHP2Shell (CVE-2026-109618/-109619)? Hourly, anonymized.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Hunts, logging and audits for PHP2Shell (CVE-2026-109618, CVE-2026-109619) and CVE-2026-115560. Read-only bash; companion to GarphenGate's defender's field guide.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Check a Next.js project against the October 14, 2026 security advisories (CVE-2026-96889, use cache RCE, Server Actions DoS). No dependencies.
Librsvg: use-after-free when xml includes have duplicated entities
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.