Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.900 exploits
GitHub PoC
CVE-2026-102255 - Draft or TODO
CVE-2026-102255CRITICAL12 out 2026
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern
48RISCO
abrir ↗
VulnCheck XDB
local
CVE-2026-43284HIGH12 out 2026
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISCO
abrir ↗
VulnCheck XDB
local
CVE-2018-19323CRITICALsob ataqueransomware12 out 2026
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING
78RISCO
abrir ↗
VulnCheck XDB
local
CVE-2026-31431HIGHsob ataque12 out 2026
crypto: algif_aead - Revert to operating out-of-place
100RISCO
abrir ↗
VulnCheck XDB
local
CVE-2026-31431HIGHsob ataque12 out 2026
crypto: algif_aead - Revert to operating out-of-place
100RISCO
abrir ↗
GitHub PoC★ 5
CVE-2026-85097 – Bricksforge WordPress Plugin Unauth File Upload to RCE Toolkit (CVSS 10.0) | Red/Blue Team suite for Bricksforge Pro Forms < 3.1.8.9. 2 tools: Full Exploit (polyglot upload, web shell, mass scan, OPSEC, SQLite/JSON output) + SafeChecker (version detect, non-intrusive audit). Ethical & educational use only.
CVE-2026-85097CRITICAL12 out 2026
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
63RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2025-47812CRITICALsob ataque12 out 2026
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2025-55182CRITICALsob ataqueransomware12 out 2026
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2025-55182CRITICALsob ataqueransomware12 out 2026
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗
VulnCheck XDB
denial-of-service
CVE-2026-41089CRITICAL12 out 2026
Windows Netlogon Remote Code Execution Vulnerability
70RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2023-22515CRITICALsob ataqueransomware12 out 2026
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-33017CRITICALsob ataque12 out 2026
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2023-54391CRITICAL12 out 2026
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2025-10353CRITICAL12 out 2026
Missing Authorization vulnerability in Melis Platform
63RISCO
abrir ↗
GitHub PoC
Independent reconstruction, lab validation, and PoC for CVE-2026-72898 — Metabase unauthenticated SQLi (patched in 0.63.5)
CVE-2026-72898CRITICALsob ataque12 out 2026
Metabase SQL injection via password reset endpoint
100RISCO
abrir ↗
VulnCheck XDB
remote-with-credentials
CVE-2021-26828HIGHsob ataque12 out 2026
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe
83RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2017-1000486CRITICALsob ataque12 out 2026
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
100RISCO
abrir ↗
GitHub PoC★ 3
0xad3m/CVE-2026-13078-POC
CVE-2026-13078MEDIUM12 out 2026
Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
33RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2025-49132CRITICAL12 out 2026
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2022-46169CRITICALsob ataque12 out 2026
Unauthenticated Command Injection
100RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-66066CRITICAL12 out 2026
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
75RISCO
abrir ↗
VulnCheck XDB
remote-with-credentials
CVE-2025-59528CRITICAL12 out 2026
Flowise has Remote Code Execution vulnerability
85RISCO
abrir ↗
VulnCheck XDB
initial-access
CVE-2018-16763—12 out 2026
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISCO
abrir ↗
VulnCheck XDB
local
CVE-2025-7771HIGH12 out 2026
Code Execution / Escalation of Privileges in ThrottleStop
41RISCO
abrir ↗
GitHub PoC
AraxyAI/CVE-2026-92956__vm2__test__20261012
CVE-2026-92956CRITICAL12 out 2026
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
48RISCO
abrir ↗
GitHub PoC★ 8
CVE-2026-91737 Chrome renderer RCE PoC (PDFium)
CVE-2026-91737HIGH12 out 2026
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside
41RISCO
abrir ↗
GitHub PoC
Independent reconstruction, lab validation, and PoC for CVE-2026-9198, the Langflow unauthenticated RCE (fixed in 1.10.1)
CVE-2026-9198CRITICALsob ataque12 out 2026
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RISCO
abrir ↗
GitHub PoC★ 1
For new CVEs without existing/working/non-mangled POCs
CVE-2026-9586CRITICALsob ataque12 out 2026
Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB
98RISCO
abrir ↗
VulnCheck XDB
local
CVE-2024-21626HIGH12 out 2026
runc container breakout through process.cwd trickery and leaked fds
61RISCO
abrir ↗
GitHub PoC
0xCyp1337/CVE-2026-63030-CVE-2026-60137-WP2SHELL
CVE-2026-63030CRITICALsob ataque12 out 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗
← anteriorpágina 93 / 2.930próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.