Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

87.948exploits catalogados

40.797CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.341VulnCheck XDB 10.507Nuclei 4.578Metasploit 3.539✓ só verificadosrecentes populares risco

87.464 exploits

GitHub PoC

Standalone defensive checker project for CVE-2026-104286: Fortinet FortiMail: Path traversal / NULL-byte arbitrary file write. One exploit per repository; implementation pending.

CVE-2026-104286CRITICALsob ataque23 out 2026

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.

78RISCO

GitHub PoC

Offline Node.js evidence checker for CVE-2026-56846: HTTP/2 retained header memory exhaustion. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.

CVE-2026-56846HIGH23 out 2026

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memor

41RISCO

GitHub PoC

A defensive incident-response scanner for the PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619). am-i-infected answers one question: does this server show signs that PHP2Shell was used against it?

CVE-2026-109618CRITICALsob ataque23 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

Offline SonicWall SMA1000 evidence checker for CVE-2026-102258. Reported build and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.

CVE-2026-102258MEDIUM23 out 2026

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Managem

33RISCO

GitHub PoC★ 2

PHP2Shell (CVE-2026-109618/109619): mod_php pre-auth heap-corruption RCE — working PoC, non-destructive checker, per-build offset recovery for stripped distro packages, lab harness

CVE-2026-109618CRITICALsob ataque23 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

Offline Node.js evidence checker for CVE-2026-58044: HTTP header-limit request smuggling. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.

CVE-2026-58044LOW23 out 2026

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild ou

28RISCO

GitHub PoC

Offline Node.js evidence checker for CVE-2026-58045: zlib synchronous API spoofed TypedArray crash. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.

CVE-2026-58045MEDIUM23 out 2026

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:z

33RISCO

GitHub PoC

Offline Node.js evidence checker for CVE-2026-58041: SQLite cached iterator write replay. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.

CVE-2026-58041MEDIUM23 out 2026

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to cont

33RISCO

GitHub PoC★ 2

Apache Tomcat WebSocket security constraint bypass (CVE-2026-76183) reproduction

CVE-2026-76183CRITICAL23 out 2026

Apache Tomcat: Bypass of security constraints for WebSocket endpoints

48RISCO

GitHub PoC★ 3

Detect systems affected by Node2Shell (CVE-2026-111497) on Unix and Windows

CVE-2026-111497CRITICAL23 out 2026

Out-of-Bounds Write in Google Brotli Decoder

70RISCO

GitHub PoC★ 3

Hybrid PHP2Shell Security Toolkit (CVE-2026-109618 & 109619). Features an automated vulnerability scanner, session-state analyzer, and application upload handler validator. For authorized security testing only.

CVE-2026-109618CRITICALsob ataque23 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC★ 1

Defensive research and tooling for PHP2Shell (CVE-2026-109618 / CVE-2026-109619)** - two critical memory-safety vulnerabilities in the PHP engine disclosed with the PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 security releases (2026-10-21).

CVE-2026-109618CRITICALsob ataque23 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

Find and fix PHP2Shell (CVE-2026-109618, CVE-2026-109619) on Linux, Windows and Docker without changing the PHP minor version. Same-branch patching, admin-locked mitigations, automatic rollback.

CVE-2026-109618CRITICALsob ataque23 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

Standalone defensive checker project for CVE-2026-58040: Node.js: HTTPS Agent TLS session identity-policy bypass. One exploit per repository; implementation pending.

CVE-2026-58040MEDIUM23 out 2026

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across ident

33RISCO

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-112900CRITICAL23 out 2026

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

48RISCO

GitHub PoC

Defensive toolkit for PHP servers after PHP2Shell (CVE-2026-109618/9): fleet patch audit incl. distro backports & end-of-life PHP, php.ini hardening, owner-only website leak check, and access-log attack detection with canary traps. A–F graded, fix-first reports. Python, no dependencies.

CVE-2026-109618CRITICALsob ataque23 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

Metodologia completa de auditoria web - 7 fases - PHP2Shell RCE CVE-2026-109618, Wazuh Baseline 17 regras, MITRE ATT&CK - Por Filipe Gabriel SOC Analyst Luanda

CVE-2026-109618CRITICALsob ataque23 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

Standalone defensive checker project for CVE-2026-56847: Node.js: Permission Model trace-log filesystem bypass. One exploit per repository; implementation pending.

CVE-2026-56847LOW23 out 2026

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside

28RISCO

GitHub PoC★ 8

ZeroHack: Node2Shell (CVE-2026-111497) Docker Lab & PoC Framework

CVE-2026-111497CRITICAL23 out 2026

Out-of-Bounds Write in Google Brotli Decoder

70RISCO

GitHub PoC

PHP 8.4.4 Use-After-Free CVE-2026-109618 lab — tested against a real PHP app with mitigation applied

CVE-2026-109618CRITICALsob ataque23 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

Offline Node.js evidence checker for CVE-2026-106069: TLS leading-zero IPv4 resolver mismatch. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.

CVE-2026-106069HIGH23 out 2026

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addres

41RISCO

GitHub PoC

Offline SonicWall SMA1000 evidence checker for CVE-2026-102256. Reported build and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.

CVE-2026-102256HIGH23 out 2026

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

41RISCO

GitHub PoC

php2shell CVE-2026-109618 CVE-2026-109619 detection tooling for Linux and Windows

CVE-2026-109618CRITICALsob ataque23 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC★ 1

PHP vulnerability checker and fix: free read-only checker, guided patch script and AI agent skill for PHP2Shell (CVE-2026-109618, CVE-2026-109619). Docker, cPanel, Plesk, DirectAdmin, CloudLinux, shared hosting, VPS. WordPress, Magento, Laravel. PHP 5 to 8.5.

CVE-2026-109618CRITICALsob ataque23 out 2026

RCE via OOM corruption

100RISCO

GitHub PoC

Hardik007007/CVE-2026-31158-Boolean-Based-SQL-Injection-in-CRM-Login

CVE-2026-31158CRITICAL23 out 2026

SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbit

48RISCO

GitHub PoC★ 5

Target-specific Android CVE-2026-98260 research port for Xiaomi nezha

CVE-2026-98260HIGH23 out 2026

exec: Cleanup POSIX timers right after de_thread()

41RISCO

GitHub PoC

Independent, measured check of CVE-2026-93687 (braces stack exhaustion): reproducible cold-process crash under the default 10000 maxLength, and what actually mitigates it.

CVE-2026-93687HIGH23 out 2026

braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

41RISCO

GitHub PoC

regex2shell (CVE-2026-110264 + family) — GitLab/Onigmo unauth regex RCE research: safe differential detector, deterministic interpreter kill, match-time write primitive

CVE-2026-110264CRITICAL23 out 2026

Integer Overflow or Wraparound in GitLab

48RISCO

GitHub PoC

Offline BeyondTrust Remote Support evidence checker for CVE-2026-102764. Remote Support version and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.

CVE-2026-102764CRITICALsob ataque23 out 2026

Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

100RISCO

GitHub PoC★ 2

Scans a domain for CVE-2026-109618 / CVE-2026-109619 (php2shell) exposure, then audits and fixes the vulnerable PHP runtime pin in your code base. Python, stdlib only

CVE-2026-109618CRITICALsob ataque23 out 2026

RCE via OOM corruption

100RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.