Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.899 exploits
GitHub PoC★ 2
CVE-2026-110912
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.
41RISCO
abrir ↗GitHub PoC
CVE-2026-64507 — PoC: IBPB flush on BPF JIT allocation
x86/bugs: Enable IBPB flush on BPF JIT allocation
23RISCO
abrir ↗GitHub PoC
POC for CVE-2026-12118
IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data
48RISCO
abrir ↗GitHub PoC
Unauthenticated RCE via Velocity Template Language (VTL) injection in Floci API Gateway mapping templates (versions 1.1.0–2.2.0). CVSS 9.8 Critical.
Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates
48RISCO
abrir ↗GitHub PoC
Benign, self-contained reproduction of CVE-2026-77521 (MaxKB prompt-injectable command execution)
MaxKB: Prompt-injectable agent can lead to command execution
48RISCO
abrir ↗GitHub PoC
A PoC for CVE-2026-110912 'arpbleed'
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.
41RISCO
abrir ↗GitHub PoC
POC for the CVE-2026-104711 NEW-VARIANT
Apache Struts: OGNL injection in the legacy RESTful action mapper
28RISCO
abrir ↗VulnCheck XDB
remote-with-credentials
Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
56RISCO
abrir ↗VulnCheck XDB
initial-access
Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
63RISCO
abrir ↗VulnCheck XDB
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗VulnCheck XDB
initial-access
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
63RISCO
abrir ↗VulnCheck XDB
initial-access
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
100RISCO
abrir ↗VulnCheck XDB
initial-access
Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2
41RISCO
abrir ↗GitHub PoC
BlindLlama: CVE-2026-102697 Reproduction
Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization
41RISCO
abrir ↗GitHub PoC
Free CLI: check a Nextcloud instance for CVE-2026-110447 exposure. Stdlib only, honest verdicts. By Ingenious AI.
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution
100RISCO
abrir ↗GitHub PoC★ 1
SQL Injection via identifier injection in SLiMS 9.8.0 admin AJAX endpoints (tableName/tableFields). Any authenticated staff can dump password hashes.
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/A
48RISCO
abrir ↗GitHub PoC★ 26
Mr-Ochobot/CVE-2016-5195
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISCO
abrir ↗GitHub PoC
CVE-2026-106991 report
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sti
41RISCO
abrir ↗GitHub PoC★ 3
Unauthenticated privilege escalation in SimpleForm WordPress plugin <= 3.10.0. Registers an administrator account without authentication
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
48RISCO
abrir ↗GitHub PoC
Autonomous submission for "Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability" (MSRC / GitHub Security Advisory)
ASP.NET Core Remote Code Execution Vulnerability
41RISCO
abrir ↗VulnCheck XDB
local
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISCO
abrir ↗GitHub PoC
Defensive exposure checker and poc for cURL CVE-2026-92392
HTTP/2 upload Use-After-Free
41RISCO
abrir ↗GitHub PoC
Unauthenticated remote code execution on Cisco Secure Email Gateway via crafted email attachment. Path traversal in AMP File Reputation handling allows arbitrary file write as root when the service is enabled on a mail policy.
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
73RISCO
abrir ↗GitHub PoC
CVE-2026-104748 POC
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
48RISCO
abrir ↗GitHub PoC★ 1
Heartbleed (CVE-2014-0160) reproduction and analysis —CSP Application Security project
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISCO
abrir ↗GitHub PoC★ 2
Wazuh PoC chaining CVE-2026-74034 file read and CVE-2026-74041 command execution; fixed in 4.14.8. Python standard library only.
Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
41RISCO
abrir ↗GitHub PoC★ 8
abdugafforov-bobur/cve-2026-107181-poc
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
41RISCO
abrir ↗GitHub PoC
myeongji1/cve-2026-63223-ctf
CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
48RISCO
abrir ↗VulnCheck XDB
info-leak
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.