Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.056exploits catalogados

40.804CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentes populares risco

87.936 exploits

VulnCheck XDB

info-leak

CVE-2020-1938CRITICALsob ataque10 out 2026

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RISCO

abrir ↗

GitHub PoC

CVE-2026-102428 PoC: OrdaSoft Joomla OS CCK (com_os_cck) <=8.3.15 unauth SQLi — order_field/order_direction ORDER BY injection on public listings. Check + mass exploit, POCBIT-102428-OK marker, CVSS 9.3. https://pocbit.org/pocs/cve-2026-102428

CVE-2026-102428CRITICAL10 out 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16

48RISCO

abrir ↗

GitHub PoC

FortiMail CVE-2026-104286 (CVSS 9.8) 점검·대응 도구 (버전 확인, IoC 점검, 완화·패치 체크리스트)

CVE-2026-104286CRITICALsob ataque10 out 2026

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.

78RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-85097CRITICAL10 out 2026

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

63RISCO

abrir ↗

GitHub PoC★ 12

Reproducible macOS automountd research and lab PoCs for CVE-2026-84568 and CVE-2026-84570: fstype path traversal, NFS payload delivery, Gatekeeper behavior, and root code execution.

CVE-2026-84568HIGH10 out 2026

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS S

41RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-85706CRITICALsob ataque10 out 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

100RISCO

abrir ↗

GitHub PoC★ 2

CVE-2026-106445 — Handlebars 4.0.0–4.7.9 RCE via Function.prototype.constructor bypass (GHSA-p8wg-vrv2-v86f). PoCbit PoC + Docker lab (4.7.9), check/exploit HTTP client, GHSA template chain. Fixed 4.7.10. https://pocbit.org/pocs/cve-2026-106445

CVE-2026-106445CRITICAL10 out 2026

Handlebars: JavaScript Injection via Own Property Check Bypass

48RISCO

abrir ↗

GitHub PoC★ 20

Telegram CVE-2026-107181

CVE-2026-107181HIGH10 out 2026

Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

41RISCO

abrir ↗

GitHub PoC

Synthetic-data billing portal pinned to next@14.2.24 (CVE-2025-29927) — test customer for oopsie

CVE-2025-29927CRITICAL10 out 2026

Authorization Bypass in Next.js Middleware

85RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-35914CRITICALsob ataque10 out 2026

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-23744CRITICAL10 out 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2017-12615HIGHsob ataqueransomware10 out 2026

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati

100RISCO

abrir ↗

GitHub PoC

Zombify <= 1.7.7 Unauthenticated Arbitrary File Upload

CVE-2026-94503CRITICAL10 out 2026

WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

48RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-94503CRITICAL10 out 2026

WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

48RISCO

abrir ↗

GitHub PoC★ 1

PoC: OrdaSoft Joomla OS CCK (com_os_cck) 8.3.15 unauth SQLi —mass+exploit+dork

CVE-2026-102428CRITICAL10 out 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16

48RISCO

abrir ↗

GitHub PoC

CVE-2026-108592 — Environment Variable Exposure PoC in mini-swe-agent

CVE-2026-108592MEDIUM10 out 2026

mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment

33RISCO

abrir ↗

GitHub PoC

webserverdude/f5_CVE-2026-21589_mitigation

CVE-2026-21589CRITICALsob ataque10 out 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RISCO

abrir ↗

GitHub PoC

MIT-licensed braces 3.0.3 with reviewed CVE-2026-93687 depth backport; pinned consumption only

CVE-2026-93687HIGH10 out 2026

braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

41RISCO

abrir ↗

GitHub PoC

KyrieKlay/CVE-2026-37107

CVE-2026-37107CRITICAL10 out 2026

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php com

48RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2018-14667CRITICALsob ataque10 out 2026

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou

100RISCO

abrir ↗

GitHub PoC★ 1

AppleFDEKeyStore poc

CVE-2026-84520CRITICAL10 out 2026

A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27. A local atta

48RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-21589CRITICALsob ataque10 out 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RISCO

abrir ↗

GitHub PoC

**CVE-2026-69414** is an elevation of privilege vulnerability in the **Microsoft Malware Protection Engine** (part of Windows Defender / Microsoft Defender Antivirus), publicly referred to as **"RoguePlanet"**. It represents a **patch bypass** of the original vulnerability **CVE-2026-50656**.

CVE-2026-69414HIGH10 out 2026

Microsoft Defender Elevation of Privilege Vulnerability

41RISCO

abrir ↗

VulnCheck XDB

local

CVE-2019-2215HIGHsob ataque10 out 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RISCO

abrir ↗

GitHub PoC★ 1

Bricksforge <= 3.1.8.9 Unauthenticated Arbitrary File Upload

CVE-2026-85097CRITICAL10 out 2026

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

63RISCO

abrir ↗

GitHub PoC

Technical analysis of Log4Shell (CVE-2021-44228) for CS50 Cybersecurity.

CVE-2021-44228CRITICALsob ataqueransomware10 out 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2015-1427CRITICALsob ataque09 out 2026

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2023-46604CRITICALsob ataqueransomware09 out 2026

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2021-43798HIGHsob ataque09 out 2026

Grafana path traversal

100RISCO

abrir ↗

GitHub PoC

hoangvvthu/CVE-2021-44228-Log4Shell-Lab

CVE-2021-44228CRITICALsob ataqueransomware09 out 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.