Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.899 exploits
GitHub PoC★ 1
fortbridge/cve-2026-108097-research
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
41RISCO
abrir ↗GitHub PoC★ 59
CVE-2026-98260 (Timer) Android/ARM64 port
exec: Cleanup POSIX timers right after de_thread()
41RISCO
abrir ↗GitHub PoC★ 2
Android/ARM64 port
mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
41RISCO
abrir ↗GitHub PoC★ 2
A slow, from-zero walk through a Linux kernel privilege-escalation bug (CVE-2026-98260)
exec: Cleanup POSIX timers right after de_thread()
41RISCO
abrir ↗GitHub PoC
CVE-2015-2291 PoC: Arbitrary Kernel Calls via Intel NAL
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows all
76RISCO
abrir ↗VulnCheck XDB
remote-with-credentials
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
68RISCO
abrir ↗GitHub PoC
PoC for CVE-2024-25600: unauthenticated RCE in WordPress Bricks Builder <=1.9.6. Extracts the render_element nonce, probes both REST endpoints, confirms exploitability, and opens an interactive shell. Usage: python3 bricks_rce.py -u <target>.
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISCO
abrir ↗GitHub PoC
Reviewed isolated comparison lab for CVE-2026-71557
go-git: Malicious reference names may modify files outside the reference storage
33RISCO
abrir ↗VulnCheck XDB
initial-access
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
abrir ↗GitHub PoC★ 2
Android/ARM64 port
mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race
41RISCO
abrir ↗GitHub PoC★ 5
CVE-2026-99999 PwnEscape PoC - Linux kernel IPv4 csum_start validation bug guest-to-host memory leak (CVSS 9.3)
ipv4: validate checksum_start before completing checksum
48RISCO
abrir ↗GitHub PoC
PoC for CVE-2026-104736 — LearnPress ≤4.4.10 unauthenticated PHP object injection via checkout-email (lp-ajax=checkout). Check + exploit. Authorized testing only.
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
63RISCO
abrir ↗GitHub PoC
kpatch livepatch build for CVE-2026-99999 on AlmaLinux 8/9 GA kernels
ipv4: validate checksum_start before completing checksum
48RISCO
abrir ↗VulnCheck XDB
initial-access
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
63RISCO
abrir ↗GitHub PoC★ 3
CVE-2026-103849 (BlockStrap) reproduction lab: unauthenticated {{block}} injection on Magento 2.4.9 via guest GraphQL, A/B vs APSB26-153; command execution only through a labeled synthetic gadget, not stock classes.
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
48RISCO
abrir ↗GitHub PoC
Fire ChatML/Mistral/Llama control-token literals at your self-hosted agent stack and prove role-forgery before an attacker does (CVE-2026-61732).
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
48RISCO
abrir ↗GitHub PoC
kingahmadr/CVE-2026-99999-kernel-check
ipv4: validate checksum_start before completing checksum
48RISCO
abrir ↗VulnCheck XDB
initial-access
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISCO
abrir ↗GitHub PoC★ 3
Android/ARM64 port
futex: Fix race on the initial mm->futex.phash.ref allocation
23RISCO
abrir ↗GitHub PoC★ 1
Panduan Praktikum Edukasi: Deteksi Versi Cisco ASA & FTD (CVE-2026-20349)
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
71RISCO
abrir ↗VulnCheck XDB
initial-access
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
60RISCO
abrir ↗GitHub PoC★ 16
Zeek and Suricata Detections for "php2shell" CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 2
Android/ARM64 port
sched/cache: Decouple sched_cache_group from mm to fix UAF
41RISCO
abrir ↗GitHub PoC★ 2
Python-based security assessment tool for detecting exposed Vite development servers, identifying sensitive file exposure, and validating filesystem access control weaknesses in authorized environments.
Vite bypasses server.fs.deny when using `?raw??`
70RISCO
abrir ↗GitHub PoC
PoC for CVE-2020-36847: unauthenticated file upload to RCE in WordPress Simple File List <=4.2.2. Uploads PHP as .png, renames to .php via ee-file-engine.php, verifies execution. Single target or batch mode. K52-ai.
Simple File List < 4.2.3 - Remote Code Execution
75RISCO
abrir ↗GitHub PoC
Langflow 미인증 RCE 취약점(CVE-2025-3248) 기반 경량화 웹 해킹 CTF 문제 및 PoC 실습 환경
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.