Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.899 exploits
GitHub PoC
PoC for CVE-2026-59970 Blind SSRF in Tandoor Recipes, CWE-918
Tandoor Recipes: Blind SSRF via AI provider URL (api_base)
41RISCO
abrir ↗GitHub PoC
BIBILZERODAY/CVE-2026-61979-miniOrange-SAML-Auth-Bypass-Exploit
WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability
21RISCO
abrir ↗GitHub PoC
azqzazq1/CVE-2026-110896
WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability
33RISCO
abrir ↗GitHub PoC
Reproducer for CVE-2026-79985 (Apache Camel camel-smb): the SMB consumer builds the remote path from the share listing without containment (author-only; see CVE-2026-79983/79984 for the runnable mechanism) — Camel Spring Boot + Camel Quarkus
Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
41RISCO
abrir ↗GitHub PoC
CVE-2026-111283 - BMC Helix Network Management Local Administrator Account Accepts Any Password
BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration
48RISCO
abrir ↗GitHub PoC
cPanel & WHM Authentication Bypass via CVE-2026-41940 explotation
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
abrir ↗GitHub PoC
Reproducer for CVE-2026-79986 (Apache Camel camel-azure-files): the consumer builds the remote path from the share listing without containment (author-only; see CVE-2026-79983/79984 for the runnable mechanism) — Camel Spring Boot + Camel Quarkus
Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
41RISCO
abrir ↗GitHub PoC
A read-only, passive scanner that checks a REDCap host for exposure to and compromise by **CVE-2026-90817** — the unauthenticated survey-endpoint remote-code-execution flaw abused by the XMRig cryptomining campaign documented by Palo Alto Unit 42
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
63RISCO
abrir ↗GitHub PoC
Reproducer for CVE-2026-78165 (Apache Camel camel-spring-redis): default JdkSerializationRedisSerializer deserializes Redis PUBLISH payloads with no ObjectInputFilter (RCE) — Camel Spring Boot + Camel Quarkus
Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads
41RISCO
abrir ↗GitHub PoC★ 105
CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
Plex Media Server SSRF
83RISCO
abrir ↗GitHub PoC
CVE-2026-104715: cifs-utils credentials-file option injection (local root)
Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
41RISCO
abrir ↗GitHub PoC
Defensive, non-exploit detector for CVE-2026-108097 (SA-CORE-2026-014) — Drupal core Field UI RCE
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
41RISCO
abrir ↗GitHub PoC
POC for the CVE-2026-104711 NEW-VARIANT
Apache Struts: OGNL injection in the legacy RESTful action mapper
28RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-110912
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.
41RISCO
abrir ↗GitHub PoC★ 1
ekacs/predicted-CVE-2026-20329
Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Exceptional Conditions Handling Vulnerabilities
48RISCO
abrir ↗GitHub PoC
Unauthenticated RCE via Velocity Template Language (VTL) injection in Floci API Gateway mapping templates (versions 1.1.0–2.2.0). CVSS 9.8 Critical.
Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates
48RISCO
abrir ↗GitHub PoC
CTF writeup: rooting a Linux box via CVE-2024-23334 (directory traversal) and CVE-2025-32463 (sudo privilege escalation)
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
70RISCO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
CVE-2026-0322
PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
71RISCO
abrir ↗GitHub PoC★ 2
Neterbit NW-431F unauthenticated SMS disclosure
Neterbit NW-431F Embedded Web Server sms.json information disclosure
48RISCO
abrir ↗VulnCheck XDB
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗VulnCheck XDB
initial-access
Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2
41RISCO
abrir ↗GitHub PoC
Proof of concept and vulnerability checker for CVE-2026-18963, an unauthenticated account takeover in the Keycloak reset-credentials flow. Single-file Python, optional Playwright browser component.
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗VulnCheck XDB
remote-with-credentials
Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
56RISCO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
Free CLI: check a Nextcloud instance for CVE-2026-110447 exposure. Stdlib only, honest verdicts. By Ingenious AI.
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.