Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.277exploits catalogados
41.245CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.769Exploit-DB 24.490GitHub PoC 18.551inteligência de exploração 11.299Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
11.299 exploits
initial-access
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
100RISCO
initial-access
TP-LINK Tapo C200 remote code execution vulnerability
70RISCO
initial-access
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh
60RISCO
info-leak
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and
76RISCO
local
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
68RISCO
initial-access
WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability
68RISCO
initial-access
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
100RISCO
initial-access
TBK DVR-4104/DVR-4216 os command injection
55RISCO
initial-access
Authorization Bypass in Next.js Middleware
85RISCO
initial-access
User Authentication Bypass in VPN Remote Access and Mobile Access
100RISCO
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
initial-access
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote
100RISCO
denial-of-service
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
100RISCO
initial-access
Langflow - Path Traversal Arbitrary File Write via upload_user_file
68RISCO
initial-access
SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
100RISCO
local
Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks
56RISCO
local
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlay
61RISCO
initial-access
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
client-side
Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting
41RISCO
remote-with-credentials
Flowise has Remote Code Execution vulnerability
85RISCO
initial-access
Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload
63RISCO
initial-access
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
83RISCO
initial-access
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote
100RISCO
initial-access
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISCO
initial-access
Unauthenticated SQL Injection in dotCMS Publish Audit API
63RISCO
initial-access
Samba: samba: remote code execution in printing subsystem via unescaped job description
68RISCO
initial-access
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in
100RISCO
info-leak
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISCO
initial-access
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISCO
remote-with-credentials
Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
41RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.