Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.220exploits catalogados
41.197CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.738Exploit-DB 24.490GitHub PoC 18.525inteligência de exploração 11.299Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
11.299 exploits
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
initial-access
Potential authentication bypass leading to administrative access in Artifactory
98RISCO
initial-access
Langflow code Code Injection Remote Code Execution Vulnerability
68RISCO
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISCO
local
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
78RISCO
initial-access
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
100RISCO
initial-access
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0
100RISCO
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
local
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o
98RISCO
initial-access
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
100RISCO
initial-access
Langflow code Code Injection Remote Code Execution Vulnerability
68RISCO
initial-access
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
initial-access
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RISCO
initial-access
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RISCO
initial-access
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or
63RISCO
initial-access
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RISCO
initial-access
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
60RISCO
initial-access
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RISCO
initial-access
NGINX ngx_http_rewrite_module vulnerability
60RISCO
initial-access
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RISCO
initial-access
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
75RISCO
initial-access
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
initial-access
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISCO
initial-access
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISCO
initial-access
Unauthenticated Command Injection
100RISCO
initial-access
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
initial-access
WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
63RISCO
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.