Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
87.950exploits catalogados
40.798CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.343VulnCheck XDB 10.507Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.464 exploits
GitHub PoC
Docker Image php:7.4-fpm with security fixes for CVE-2026-109618 and CVE-2026-109619 updated to build and run on Debian Trixie
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58040: HTTPS Agent TLS session identity-policy bypass. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across ident
33RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-56846: HTTP/2 retained header memory exhaustion. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memor
41RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58042: DNS resolveAny process abort. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Rec
33RISCO
abrir ↗GitHub PoC
Offline Flowise evidence checker for CVE-2026-69254. Flowise version and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
48RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-56848: HTTP/2 reentrant send use-after-free. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_m
41RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-56850: HTTPS Agent PFX client identity collision. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cli
33RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58043: Permission Model path-prefix over-grant. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
41RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-56847: Permission Model trace-log filesystem bypass. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside
28RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58039: Permission Model process-report filesystem bypass. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-wr
28RISCO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-102257: SonicWall SMA1000 (6210, 7210, 8200v): AMC archive path traversal. One exploit per repository; implementation pending.
A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extrac
41RISCO
abrir ↗GitHub PoC
Nightmare begins / CVE-2026-109518 / CVE-109619/ CVE-2026-109613 ERP Next
APT RCE via hard link reuse
41RISCO
abrir ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88771. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RISCO
abrir ↗VulnCheck XDB
initial-access
Laravel TokenGuard authentication bypass through non-string API credentials
63RISCO
abrir ↗GitHub PoC
Offline Docker CopyEscape evidence checker for CVE-2026-17106. Docker version and build-configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Tar extraction in moby/go-archive can write outside the destination directory via link following
41RISCO
abrir ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-19489. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: from 14.1 through 73.32 and from 13.1 thr
41RISCO
abrir ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-19490. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
90RISCO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-102256: SonicWall SMA1000 (6210, 7210, 8200v): Authenticated remote code execution. One exploit per repository; implementation pending.
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi
41RISCO
abrir ↗GitHub PoC
Offline Sharp / librsvg evidence checker for CVE-2026-96889. Sharp and librsvg version and build evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Librsvg: use-after-free when xml includes have duplicated entities
41RISCO
abrir ↗GitHub PoC★ 6
PHP2Shell (CVE-2026-109618/109619) security research and PoC validation using OrcaCyber Zero & Ultra. Includes technical analysis, RCE evidence, and defensive verification tools.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Aplikasi yang berguna untuk mengecek versi PHP dan apakah versi yang lu Pake, kena CVE-2026-109618 & CVE-2026-109619
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 1
Risk-reduction WordPress plugin for the PHP2Shell exploit (CVE-2026-109618 / CVE-2026-109619) on sites that cannot update PHP yet. A shield, not a cure.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
isaca0315/cve-2026-109618-109619-session-upload-progress-trigger
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 5
Critical Vulnerabilities in PHP Core (CVE-2026-109618/CVE-2026-109619) Recon → Passive Fingerprinting → Behavioral Probing → WAF Diagnostics) and separately opt-in exploit/shell functions.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 2
Passive Node2Shell (CVE-2026-111497) exposure checker and offline Node.js runtime assessment with branded HTML reports. Python 3.10+, no dependencies, no exploit payloads.
Out-of-Bounds Write in Google Brotli Decoder
70RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58044: HTTP header-limit request smuggling. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild ou
28RISCO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58045: zlib synchronous API spoofed TypedArray crash. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:z
33RISCO
abrir ↗GitHub PoC
Detection-only scanner for CVE-2026-109618 & CVE-2026-109619 (PHP). Authorized testing only.
RCE via OOM corruption
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.