Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.900exploits catalogados

36.847CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.475Referência 23.360GitHub PoC 15.228VulnCheck XDB 8.946Nuclei 4.390Metasploit 3.501✓ só verificadosrecentes populares risco

79.900 exploits

GitHub PoC★ 1

ThorVG NULL pointer dereference via malformed SVG — AFL++ fuzzing writeup

CVE-2026-45729MEDIUM22 jul 2026

ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input

33RISCO

abrir ↗

GitHub PoC

CVE-2026-63030 & CVE-2026-60137 Wp2shell Poc

CVE-2026-63030CRITICALsob ataque22 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

abrir ↗

GitHub PoC★ 3

CVE-2026-14266 - XZ Heap Buffer Overflow PoC Generator for 7-Zip

CVE-2026-14266HIGH22 jul 2026

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

41RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-58138CRITICAL22 jul 2026

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

63RISCO

abrir ↗

Metasploit600

Check Point SmartConsole Authentication Bypass Run Script RCE

CVE-2026-16232CRITICALsob ataque22 jul 2026

Authentication Bypass in the SmartConsole Login Process Using an Application Token

100RISCO

abrir ↗

GitHub PoC★ 12

CVE-2026-46331 and CVE-2026-43503

CVE-2026-46331HIGH22 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-60137MEDIUMsob ataque22 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-60137MEDIUMsob ataque22 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

100RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-16540 — Simply Schedule Appointments < 1.6.12.6 Unauthenticated Appointment Data Disclosure and Mass Deletion

CVE-2026-16540HIGH22 jul 2026

Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

41RISCO

abrir ↗

GitHub PoC

PoC reproducer for CVE-2026-55993 (Apache Camel camel-atmosphere-websocket): the WebSocket consumer copies connection query parameters onto the Exchange unfiltered, so an injected CamelHttpUri drives a server-side request (SSRF) and leaks resolved property placeholders. Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-55993HIGH22 jul 2026

Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling influencing internal behaviour

41RISCO

abrir ↗

GitHub PoC★ 17

CVE-2026-43499 PoC Scanner

CVE-2026-43499HIGH22 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

abrir ↗

VulnCheck XDB

denial-of-service

CVE-2026-41089CRITICAL22 jul 2026

Windows Netlogon Remote Code Execution Vulnerability

70RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-63030CRITICALsob ataque22 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

abrir ↗

GitHub PoC

CVE-2026-58138 - Conductor (3.21.21..<3.30.2) unauthenticated RCE via INLINE GraalVM evaluator

CVE-2026-58138CRITICAL22 jul 2026

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

63RISCO

abrir ↗

VulnCheck XDB

local

CVE-2023-32629HIGH22 jul 2026

Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks

61RISCO

abrir ↗

VulnCheck XDB

local

CVE-2023-2640HIGH22 jul 2026

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlay

61RISCO

abrir ↗

GitHub PoC★ 15

Pre-auth RCE PoC for WordPress core — chains CVE-2026-63030 (REST /batch/v1 route-confusion desync) with CVE-2026-60137 (author__not_in SQLi) into an unauthenticated shell. Authorized testing only.

CVE-2026-63030CRITICALsob ataque22 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

abrir ↗

VulnCheck XDB

local

CVE-2026-46331HIGH22 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISCO

abrir ↗

GitHub PoC

full javascript reproduction of CVE-2026-63030 (author_exclude, author__not_in and misalignment between validations and matches)

CVE-2026-63030CRITICALsob ataque22 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

abrir ↗

GitHub PoC

Full ML-KEM-1024 key recovery from a partial Fujisaki-Okamoto comparison in wolfSSL (CVE-2026-6330 NEON, CVE-2026-10097 AVX2)

CVE-2026-6330MEDIUM22 jul 2026

ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

33RISCO

abrir ↗

GitHub PoC★ 1

Scan Windows Domain Controllers for CVE-2026-41089 to detect unauthenticated remote code execution vulnerabilities in the Netlogon service.

CVE-2026-41089CRITICAL22 jul 2026

Windows Netlogon Remote Code Execution Vulnerability

70RISCO

abrir ↗

GitHub PoC

PoC reproducer for CVE-2026-56139 (Apache Camel camel-undertow Rest DSL): the Rest DSL binding hard-codes muteException=false, so a configured muteException=true is ignored and an uncaught exception's full stack trace is returned to the client (CWE-209). Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-56139MEDIUM22 jul 2026

Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients

33RISCO

abrir ↗

GitHub PoC

CVE-2026-50522

CVE-2026-50522CRITICALsob ataque22 jul 2026

Microsoft SharePoint Remote Code Execution Vulnerability

100RISCO

abrir ↗

GitHub PoC

This repository documents the process of identifying, analyzing, and gathering Open Source Intelligence (OSINT) on a specific security vulnerability detected during a target network scan.

CVE-2012-1823CRITICALsob ataque22 jul 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RISCO

abrir ↗

GitHub PoC★ 1

Vulnerabilidad en NGINX

CVE-2026-42533CRITICAL22 jul 2026

NGINX Map directive and Regex matching vulnerability

48RISCO

abrir ↗

GitHub PoC

my exploit for GLPI

CVE-2022-35914CRITICALsob ataque21 jul 2026

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

100RISCO

abrir ↗

GitHub PoC

WhatsWrongAndWhy/CVE-2021-22555

CVE-2021-22555HIGHsob ataque21 jul 2026

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-9198CRITICALsob ataque21 jul 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

100RISCO

abrir ↗

GitHub PoC

mass_cve-2021-41773

CVE-2021-41773HIGHsob ataqueransomware21 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

abrir ↗

GitHub PoC

CVE-2026-13156 Vulnerability Advisory & PoC — Discovered by Huynh Kien Minh (MinhHK).

CVE-2026-13156MEDIUM21 jul 2026

MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF

33RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.