Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
87.464exploits catalogados
40.695CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4.577Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.464 exploits
GitHub PoC★ 1
Audit & interim mitigation for CVE-2026-123158 (*SSHole) — OpenSSH password bypass on musl/Alpine — across Docker containers, images and host
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC★ 1
Scanner CVE-2026-123158 *SSHHole
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
0xg33k/CVE-2026-18470
Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response
41RISCO
abrir ↗VulnCheck XDB
initial-access
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attac
50RISCO
abrir ↗GitHub PoC
Temporary nftables mitigation + installer for CVE-2026-98432 (Ubuntu)
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISCO
abrir ↗GitHub PoC
PoC and firmware emulation recipe for CVE-2026-122051 — unauthenticated command injection in the Edimax BR-6208AC /goform/mp handler (firmware ≤ 1.32)
Edimax BR-6208AC mp command injection
48RISCO
abrir ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗GitHub PoC
CVE-2026-114550 / ZDI-CAN-31039: libwebsockets MQTT PUBACK OOB write PoC lab (podman)
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
41RISCO
abrir ↗GitHub PoC
charlie-goldenowl/cve-2026-122006-check
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server
48RISCO
abrir ↗VulnCheck XDB
initial-access
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26
53RISCO
abrir ↗VulnCheck XDB
initial-access
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by
100RISCO
abrir ↗VulnCheck XDB
initial-access
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability i
100RISCO
abrir ↗GitHub PoC
datacenter-metrotel/Mitigating-CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISCO
abrir ↗GitHub PoC
Docker config that patches/builds kernel w/ CVE_2026_98432 fix
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISCO
abrir ↗GitHub PoC★ 3
CVE-2026-98432 UAF Detection for Wazuh
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISCO
abrir ↗VulnCheck XDB
info-leak
An issue in the getcfg.php component of D-Link DIR816L_FW206b01 allows attackers to access the device via a crafted payl
28RISCO
abrir ↗VulnCheck XDB
info-leak
Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path
56RISCO
abrir ↗VulnCheck XDB
initial-access
The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when re
35RISCO
abrir ↗GitHub PoC
CVE-2026-98260 temporary-root runner
exec: Cleanup POSIX timers right after de_thread()
41RISCO
abrir ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RISCO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗VulnCheck XDB
remote-with-credentials
Redis Lua Use-After-Free may lead to remote code execution
85RISCO
abrir ↗VulnCheck XDB
initial-access
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `sys
33RISCO
abrir ↗GitHub PoC
Temporary iptables mitigation for CVE-2026-98432 (CVSS 9.8) on Ubuntu Linux. Filters inbound IPv4 TCP packets containing IP options while awaiting kernel security updates. Not a kernel patch.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISCO
abrir ↗GitHub PoC
This nftables configuration ruleset can help mitigate attacks on your hosts that are vulnerable to CVE-2026-98432. The rule can help block incoming IPv4 TCP connections that contain IP options. Regular TCP connections without IP options can still go through. This is a temporary solution until the Linux Kernels are fully patched.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RISCO
abrir ↗VulnCheck XDB
initial-access
Adobe ColdFusion Improper Access Control Arbitrary code execution
100RISCO
abrir ↗GitHub PoC
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) 분석과 패치 기준 확인 예제
RCE via OOM corruption
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.