Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.056exploits catalogados

40.804CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentes populares risco

87.899 exploits

VulnCheck XDB

initial-access

CVE-2024-25600CRITICAL18 out 2026

WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

85RISCO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-80343 (Apache Camel camel-netty-http): security constraint case-sensitivity bypass — altering the path case skips the constraint while routing still dispatches to the protected endpoint — Camel Spring Boot + Camel Quarkus

CVE-2026-80343HIGH18 out 2026

Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching

41RISCO

abrir ↗

GitHub PoC

CVE-2026-98180 — drm/msm use-after-free of the scheduler-containing ring and VM objects (fixed by 01c8d1f385f7)

CVE-2026-98180HIGH18 out 2026

drm/msm: RCU-free the scheduler-containing ring and VM objects

41RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-3248CRITICALsob ataqueransomware18 out 2026

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RISCO

abrir ↗

GitHub PoC★ 2

Android/ARM64 port

CVE-2026-97941HIGH18 out 2026

mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race

41RISCO

abrir ↗

GitHub PoC★ 16

Zeek and Suricata Detections for "php2shell" CVE-2026-109618 and CVE-2026-109619

CVE-2026-109618CRITICALsob ataque18 out 2026

RCE via OOM corruption

100RISCO

abrir ↗

GitHub PoC

Reviewed isolated comparison lab for CVE-2026-71557

CVE-2026-71557MEDIUM18 out 2026

go-git: Malicious reference names may modify files outside the reference storage

33RISCO

abrir ↗

GitHub PoC★ 2

Android/ARM64 port

CVE-2026-98256HIGH18 out 2026

signal: Prevent exec() race

41RISCO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-80312 (Apache Camel camel-oauth): fail-open authentication guard — the OAuth processors returned control to the route instead of terminating when auth could not complete — Camel Spring Boot + Camel Quarkus

CVE-2026-80312HIGH18 out 2026

Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors

41RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-104736CRITICAL18 out 2026

LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter

63RISCO

abrir ↗

VulnCheck XDB

remote-with-credentials

CVE-2025-54123CRITICAL18 out 2026

Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

68RISCO

abrir ↗

GitHub PoC

Probe MCP OAuth discovery issuer validation (CVE-2026-104850 class)

CVE-2026-104850HIGH17 out 2026

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

41RISCO

abrir ↗

GitHub PoC

songzzzz/CVE-2026-8933

CVE-2026-8933HIGH17 out 2026

snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup

41RISCO

abrir ↗

GitHub PoC

Non-destructive behavioral verifier for the MikroTik RouterOS SSH auth-bypass (CVE-2026-67279 / MikroTrick). Measures server reaction only — no exploit payload.

CVE-2026-67279MEDIUMsob ataque17 out 2026

SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

63RISCO

abrir ↗

GitHub PoC★ 1

0xCyp1337/CVE-2026-48907-RCE

CVE-2026-48907CRITICALsob ataque17 out 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

GitHub PoC

Projet de Cybersécurité (TP1 à TP9) Recherche réseau (Nmap, Scapy) • Attaques DDoS (hping3) • Force brute (Hydra, LaZagne) • Ingénierie sociale (Zphisher, Gophish) • Sécurité Wi-Fi (Airgeddon, Aircrack-ng) • Malwares (msfvenom) • Injection de code (Shellter) • MITM (Ettercap, Yersinia) • Vulnérabilités (CVE-2026-96889).

CVE-2026-96889HIGH17 out 2026

Librsvg: use-after-free when xml includes have duplicated entities

41RISCO

abrir ↗

GitHub PoC★ 1

Passive internet-wide discovery + responsible-disclosure helper for CVE-2026-74580 (Linux vhost metadata-cache bug) — queries existing scan data (Sonar/Shodan/Censys), triages exposure, and drafts (never auto-sends) notices to owners.

CVE-2026-74580HIGH17 out 2026

vhost: reset the vring metadata cache on vring reconfiguration

41RISCO

abrir ↗

GitHub PoC

rank03031/CVE-2025-49113-CTF

CVE-2025-49113CRITICALsob ataque17 out 2026

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

100RISCO

abrir ↗

GitHub PoC★ 6

REDMI K90 Max在OS4.0.0.14.XAACNXM利用CVE-2026-64560获取ROOT权限。

CVE-2026-64560HIGH17 out 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISCO

abrir ↗

GitHub PoC

Vulnerability analysis, exploitation, and multi-layered defense hardening for Apache Struts 2 (CVE-2017-5638) & Windows Print Spooler / PrintNightmare (CVE-2021-34527) with ELK SIEM monitoring and Windows Event Log auditing.

CVE-2017-5638CRITICALsob ataqueransomware17 out 2026

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RISCO

abrir ↗

GitHub PoC★ 3

cve-2026-99999-audit script (PwnEscape)

CVE-2026-99999CRITICAL17 out 2026

ipv4: validate checksum_start before completing checksum

48RISCO

abrir ↗

GitHub PoC★ 2

CVE-2026-97229 GitLab CI lint regex integer overflow RCE — InstaBox version matrix reproduction & libruby gadget reverse engineering

CVE-2026-97229CRITICALsob ataque17 out 2026

Integer Overflow or Wraparound in GitLab

100RISCO

abrir ↗

GitHub PoC

SQL Injection via unquoted numeric concatenation in SLiMS 9.8.0 admin modules (subscription.php & dl_detail.php). CVE-2026-107083.

CVE-2026-107083CRITICAL17 out 2026

SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/r

48RISCO

abrir ↗

GitHub PoC

PMX110 (OPPO MT6995, kernel 6.18.21) CVE-2026-64560 research: port, evidence, bounded run scripts

CVE-2026-64560HIGH17 out 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISCO

abrir ↗

GitHub PoC

CVE-2026-89282: Apache Lounge Windows DLL Search Order Hijack → SYSTEM LPE PoC

CVE-2026-89282CRITICAL17 out 2026

CVE-2026-89282

48RISCO

abrir ↗

GitHub PoC

CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656

CVE-2026-96652MEDIUMsob ataque17 out 2026

Plex Media Server SSRF

83RISCO

abrir ↗

GitHub PoC

PoC for CVE-2026-111823 — Mage AI OAuth session auth bypass (POST /api/sessions). Check + exploit modes. Authorized testing only.

CVE-2026-111823CRITICAL17 out 2026

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

48RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-96652MEDIUMsob ataque17 out 2026

Plex Media Server SSRF

83RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALsob ataque17 out 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2024-32507HIGH17 out 2026

WordPress Login with phone number plugin <= 1.7.16 - Privilege Escalation vulnerability

41RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.