Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.697exploits catalogados

36.715CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.475Referência 23.264GitHub PoC 15.172VulnCheck XDB 8.920Nuclei 4.373Metasploit 3.493✓ só verificadosrecentes populares risco

14.997 exploits

GitHub PoC★ 2

Educational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only — no exploit code. TLP:CLEAR.

CVE-2026-43503HIGH27 jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

41RISCO

GitHub PoC

Defensive analysis and non-weaponized validation of CVE-2016-5195 (Dirty COW), including root-cause research, patch analysis, and reproducible evidence.

CVE-2016-5195HIGHsob ataque27 jun 2026

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISCO

GitHub PoC★ 4

SQL Injection at Cacti

CVE-2026-40083HIGH27 jun 2026

Cacti: SQL Injection in managers.php

41RISCO

GitHub PoC★ 3

CVE-2026-0073-Android-ADBD-bypass-POC汉化版

CVE-2026-0073HIGH27 jun 2026

In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic err

41RISCO

GitHub PoC

Hack The Box - Orion (Easy) | CVE-2025-32432 & CVE-2026-24061

CVE-2025-32432CRITICALsob ataque27 jun 2026

Craft CMS Allows Remote Code Execution

100RISCO

GitHub PoC

SugiB3o/CVE-2026-31431

CVE-2026-31431HIGHsob ataque27 jun 2026

crypto: algif_aead - Revert to operating out-of-place

100RISCO

GitHub PoC★ 8

OpenSTAManager-RCE-Exploit-CVE-2026-38751

CVE-2026-38751HIGH27 jun 2026

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionali

41RISCO

GitHub PoC★ 1

WP Full Stripe Free <= 8.4.3 - Missing Authorization

CVE-2026-12432MEDIUM27 jun 2026

Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter

33RISCO

GitHub PoC

Hunt-Benito/traefik-stripprefix-auth-bypass-cve-2026-48020-path-normalization

CVE-2026-48020HIGH27 jun 2026

Traefik StripPrefix Route-Level Auth Bypass via Path Normalization

41RISCO

GitHub PoC

CVE-2026-46331 - Draft

CVE-2026-46331HIGH27 jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISCO

GitHub PoC

patched ffmpeg-tools for jellyfin to patch CVE-2026-8461 aka PixelSmash

CVE-2026-8461HIGH27 jun 2026

Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

41RISCO

GitHub PoC

Hack The Box - Orion (Easy) | CVE-2025-32432 & CVE-2026-24061

CVE-2026-24061CRITICALsob ataque27 jun 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

GitHub PoC★ 3

CVE-2026-0073-Android-ADBD-bypass-POC汉化版

CVE-2026-0073HIGH27 jun 2026

In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic err

41RISCO

GitHub PoC

CVE-2026-48907 is a CVSS 10.0 pre-auth RCE in Joomla Content Editor affecting all versions ≤ 2.9.99.4. The Grayxploit team breaks down the 3-weakness chain — missing auth, no extension validation, and an unsafe upload flag — that lets attackers pop a shell in 3 HTTP requests.

CVE-2026-48907CRITICALsob ataque27 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

GitHub PoC★ 59

cve-2026-48907 scanner

CVE-2026-48907CRITICALsob ataque27 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

GitHub PoC

PoC for CVE-2026-5366: git argument injection in Prefect's GitRepository leading to RCE on the worker.

CVE-2026-5366CRITICAL27 jun 2026

Git Argument Injection in prefecthq/prefect

48RISCO

GitHub PoC★ 148

CVE-2026-43499 PoC

CVE-2026-43499HIGH27 jun 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC

Flowiseai Flowise Auth Bypass Vulnerability Proof of Concept

CVE-2025-58434CRITICAL26 jun 2026

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

75RISCO

GitHub PoC

The SSRF filter checked hostname text, but the actual destination was decided later by DNS. That gap let attacker-controlled Webhook URLs reach loopback, metadata, and private network targets.

CVE-2026-34207HIGH26 jun 2026

TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation

41RISCO

GitHub PoC

12hrformat/CVE-2026-35273-POC

CVE-2026-35273CRITICALsob ataqueransomware26 jun 2026

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana

100RISCO

GitHub PoC

A low-privileged Docmost user could supply a victim attachmentId to the generic upload endpoint and overwrite another page's stored attachment inside the same workspace.

CVE-2026-34213MEDIUM26 jun 2026

Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation

33RISCO

GitHub PoC

A public share looked clean in the page tree, but the search endpoint told a different story. In Docmost, restricted child pages hidden from public share viewers could still leak through public share search results.

CVE-2026-33146MEDIUM26 jun 2026

Docmost's Public Share Search Exposes Metadata of Restricted Children

33RISCO

GitHub PoC★ 1

Ghost CMS Content API Blind SQL Injection

CVE-2026-26980CRITICAL26 jun 2026

Ghost has a SQL Injection in its Content API

85RISCO

GitHub PoC★ 11

CVE-2026-26980 - Ghost CMS Content API SQL Injection

CVE-2026-26980CRITICAL26 jun 2026

Ghost has a SQL Injection in its Content API

85RISCO

GitHub PoC★ 1

CVE-2026-24207 — NVIDIA Triton SageMaker auth bypass to unauth RCE. Detection script, bypass demo, RCE-chain PoC, and IDS rules.

CVE-2026-24207CRITICAL26 jun 2026

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A succes

63RISCO

GitHub PoC

Plane’s V2 asset subsystem trusted workspace slugs and asset UUIDs without enforcing the right membership checks, which let one authenticated user read, copy, delete, and overwrite assets in other workspaces.

CVE-2026-46558HIGH26 jun 2026

Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces

41RISCO

GitHub PoC★ 17

mooder1/dirtyclone-CVE-2026-43503

CVE-2026-43503HIGH26 jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

41RISCO

GitHub PoC

sec0x/CVE-2026-43503

CVE-2026-43503HIGH26 jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

41RISCO

GitHub PoC★ 3

CVE-2026-20251 — Splunk Secure Gateway jsonpickle deserialization RCE (CVSS 8.8) | ReactiveZero Security Research

CVE-2026-20251HIGH26 jun 2026

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

53RISCO

GitHub PoC

CVE-2026-12415-or-CVE-2026-12416.py

CVE-2026-12415CRITICAL26 jun 2026

Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter

48RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.