Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.056exploits catalogados

40.804CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentes populares risco

87.899 exploits

VulnCheck XDB

initial-access

CVE-2018-16763—21 out 2026

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca

60RISCO

abrir ↗

VulnCheck XDB

local

CVE-2023-21768HIGH21 out 2026

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

68RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALsob ataqueransomware21 out 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

VulnCheck XDB

local

CVE-2026-31431HIGHsob ataque21 out 2026

crypto: algif_aead - Revert to operating out-of-place

100RISCO

abrir ↗

GitHub PoC★ 1

Free, read-only checker for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Finds every PHP build, detects vendor back-ports and unrestarted services, and prints next steps.

CVE-2026-109618CRITICALsob ataque21 out 2026

RCE via OOM corruption

100RISCO

abrir ↗

GitHub PoC

Fix Php2Shell ( CVE-2026-109618 and CVE-2026-109619)

CVE-2026-109618CRITICALsob ataque21 out 2026

RCE via OOM corruption

100RISCO

abrir ↗

GitHub PoC★ 4

Hunting pack for PHP2Shell (CVE-2026-109618/109619): find vulnerable PHP assets and hunt for exploitation with Microsoft Defender, Sentinel and Azure tooling

CVE-2026-109618CRITICALsob ataque21 out 2026

RCE via OOM corruption

100RISCO

abrir ↗

GitHub PoC

cve-2018-16763-exploit

CVE-2018-16763—21 out 2026

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca

60RISCO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-85300 — Apache Camel camel-pqc private key written with permissive file permissions (CWE-276); Spring Boot + Quarkus, affected vs fixed

CVE-2026-85300MEDIUM20 out 2026

Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

33RISCO

abrir ↗

GitHub PoC

Exploit and writeup for CVE-2026-87690

CVE-2026-87690HIGH20 out 2026

Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution

41RISCO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-85301 — Apache Camel camel-keycloak issuer validation bypass (CWE-287). Camel Spring Boot + Camel Quarkus.

CVE-2026-85301MEDIUM20 out 2026

Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim

33RISCO

abrir ↗

GitHub PoC

利用CVE-2019-2215给小米5获取临时root（比较通用？）

CVE-2019-2215HIGHsob ataque20 out 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RISCO

abrir ↗

GitHub PoC

MARIMO RCE & NKABUSE EXPLOIT FRAMEWORK (CVE-2026-39987) - RE-WEAPONIZED - This framework exploits CVE-2026-39987, a critical Remote Code Execution (RCE) vulnerability in Marimo, a popular Python-based data visualization tool. Attackers actively exploit this flaw to deploy NKAbuse, a blockchain-based botnet malware.

CVE-2026-39987CRITICALsob ataque20 out 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISCO

abrir ↗

VulnCheck XDB

local

CVE-2019-2215HIGHsob ataque20 out 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-41773HIGHsob ataqueransomware20 out 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

abrir ↗

VulnCheck XDB

local

CVE-2026-43284HIGH20 out 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RISCO

abrir ↗

GitHub PoC★ 5

OnePlus 16 (PYB110) jailbreak: CVE-2026-64560 + KernelSU / KernelSU Next / BakaSU / SukiSU Ultra LKM

CVE-2026-64560HIGH20 out 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISCO

abrir ↗

GitHub PoC

Log4Shell (CVE-2021-44228) audit findings and Actions smoke-test workflow

CVE-2021-44228CRITICALsob ataqueransomware20 out 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-106173CRITICAL20 out 2026

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5

48RISCO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-85313 — Apache Camel camel-jetty enableCORS credentialed any-origin CORS (CWE-942). Camel Spring Boot.

CVE-2026-85313MEDIUM20 out 2026

Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set

33RISCO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-85260 — Apache Camel camel-mllp protected health information logging (CWE-532); Spring Boot + Quarkus, affected vs fixed

CVE-2026-85260MEDIUM20 out 2026

Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default

33RISCO

abrir ↗

GitHub PoC

Working, stdlib-only PoC. A low-privileged authenticated user stores a shell palistener

CVE-2026-72867CRITICAL20 out 2026

Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)

63RISCO

abrir ↗

GitHub PoC

Work 1 — secure Flask REST API with CI/CD (bandit, pip-audit) and a CVE-2021-41773 analysis

CVE-2021-41773HIGHsob ataqueransomware20 out 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

abrir ↗

GitHub PoC

Datxzzz/CVE-2026-93300

CVE-2026-93300HIGH20 out 2026

EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter

41RISCO

abrir ↗

GitHub PoC

OFRPurpose/poc-cve-2026-64638

CVE-2026-64638HIGH20 out 2026

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malici

56RISCO

abrir ↗

GitHub PoC

Fork optimizado de Bytebot: Agente de IA para control de escritorio. Reducido de 7GB a 1.09GB, parcheada CVE-2026-78250, con documentación viva (Obsidian) y protocolo de trabajo Human-in-the-loop.

CVE-2026-78250MEDIUM20 out 2026

bytebot-ai bytebot Agent Execution Workflow infinite loop

33RISCO

abrir ↗

GitHub PoC★ 1

cve-2026-62911-exploit

CVE-2026-62911HIGH20 out 2026

Microsoft Exchange Server Elevation of Privilege Vulnerability

41RISCO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-85314 — Apache Camel camel-mail MimeMultipart mail.smtp header injection (CWE-20). Camel Spring Boot + Camel Quarkus.

CVE-2026-85314MEDIUM20 out 2026

Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)

33RISCO

abrir ↗

GitHub PoC★ 2

CVE-2026-106173

CVE-2026-106173CRITICAL20 out 2026

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5

48RISCO

abrir ↗

GitHub PoC

Research attribution and coordinated disclosure status for CVE-2026-105484.

CVE-2026-105484CRITICAL20 out 2026

TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

48RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.