Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
84.035exploits catalogados
39.531CVEs com exploração pública
24.695testados em laboratório
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9.678Nuclei 4.478Metasploit 3.524✓ só verificadosrecentespopularesrisco
16.269 exploits
GitHub PoC
Android/ARM64 port
mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
41RISCO
abrir ↗GitHub PoC★ 1
Panduan Praktikum Edukasi: Deteksi Versi Cisco ASA & FTD (CVE-2026-20349)
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
71RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-103849 (BlockStrap) reproduction lab: unauthenticated {{block}} injection on Magento 2.4.9 via guest GraphQL, A/B vs APSB26-153; command execution only through a labeled synthetic gadget, not stock classes.
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
48RISCO
abrir ↗GitHub PoC
Reviewed isolated comparison lab for CVE-2026-71557
go-git: Malicious reference names may modify files outside the reference storage
33RISCO
abrir ↗GitHub PoC
Android/ARM64 port
sched/cache: Decouple sched_cache_group from mm to fix UAF
23RISCO
abrir ↗GitHub PoC
PoC for CVE-2026-92262, CVE-2026-85746, CVE-2026-85748 against MariaDB 13.0.1
MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
48RISCO
abrir ↗GitHub PoC
CVE-2026-98180 — drm/msm use-after-free of the scheduler-containing ring and VM objects (fixed by 01c8d1f385f7)
drm/msm: RCU-free the scheduler-containing ring and VM objects
41RISCO
abrir ↗GitHub PoC
PoC for CVE-2026-104736 — LearnPress ≤4.4.10 unauthenticated PHP object injection via checkout-email (lp-ajax=checkout). Check + exploit. Authorized testing only.
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
48RISCO
abrir ↗GitHub PoC
A slow, from-zero walk through a Linux kernel privilege-escalation bug (CVE-2026-98260)
exec: Cleanup POSIX timers right after de_thread()
41RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-98260 (Timer) Android/ARM64 port
exec: Cleanup POSIX timers right after de_thread()
41RISCO
abrir ↗GitHub PoC
Android/ARM64 port
mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race
41RISCO
abrir ↗GitHub PoC
Incident write-up: unsigned .so in the Plex Media Server codec cache executes a dropper on every transcode (CVE-2026-96656) — IOCs, STIX, YARA
Plex Media Server arbitrary file write
41RISCO
abrir ↗GitHub PoC
Android/ARM64 port
futex: Fix race on the initial mm->futex.phash.ref allocation
23RISCO
abrir ↗GitHub PoC
kingahmadr/CVE-2026-99999-kernel-check
ipv4: validate checksum_start before completing checksum
48RISCO
abrir ↗GitHub PoC
kpatch livepatch build for CVE-2026-99999 on AlmaLinux 8/9 GA kernels
ipv4: validate checksum_start before completing checksum
48RISCO
abrir ↗GitHub PoC
CVE-2026-99999 PwnEscape PoC - Linux kernel IPv4 csum_start validation bug guest-to-host memory leak (CVSS 9.3)
ipv4: validate checksum_start before completing checksum
48RISCO
abrir ↗GitHub PoC
CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
Plex Media Server SSRF
33RISCO
abrir ↗GitHub PoC
0xCyp1337/CVE-2026-48907-RCE
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
98RISCO
abrir ↗GitHub PoC★ 3
PoC for CVE-2026-99999 (PwnEscape) on a prepared TAP.
ipv4: validate checksum_start before completing checksum
48RISCO
abrir ↗GitHub PoC★ 2
cve-2026-99999-audit script (PwnEscape)
ipv4: validate checksum_start before completing checksum
48RISCO
abrir ↗GitHub PoC
Non-destructive behavioral verifier for the MikroTik RouterOS SSH auth-bypass (CVE-2026-67279 / MikroTrick). Measures server reaction only — no exploit payload.
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
63RISCO
abrir ↗GitHub PoC
Probe MCP OAuth discovery issuer validation (CVE-2026-104850 class)
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
21RISCO
abrir ↗GitHub PoC
CVE-2026-89282: Apache Lounge Windows DLL Search Order Hijack → SYSTEM LPE PoC
CVE-2026-89282
48RISCO
abrir ↗GitHub PoC
CVE-2026-97229 GitLab CI lint regex integer overflow RCE — InstaBox version matrix reproduction & libruby gadget reverse engineering
Integer Overflow or Wraparound in GitLab
48RISCO
abrir ↗GitHub PoC
Projet de Cybersécurité (TP1 à TP9) Recherche réseau (Nmap, Scapy) • Attaques DDoS (hping3) • Force brute (Hydra, LaZagne) • Ingénierie sociale (Zphisher, Gophish) • Sécurité Wi-Fi (Airgeddon, Aircrack-ng) • Malwares (msfvenom) • Injection de code (Shellter) • MITM (Ettercap, Yersinia) • Vulnérabilités (CVE-2026-96889).
Librsvg: use-after-free when xml includes have duplicated entities
41RISCO
abrir ↗GitHub PoC★ 3
REDMI K90 Max在OS4.0.0.14.XAACNXM利用CVE-2026-64560获取ROOT权限。
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-64560 temporary-root exploit for realme RMX6699 (Snapdragon 8 Elite, kernel 6.6.118, Android 17/COOS17)
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISCO
abrir ↗GitHub PoC
PMX110 (OPPO MT6995, kernel 6.18.21) CVE-2026-64560 research: port, evidence, bounded run scripts
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISCO
abrir ↗página 1 / 543próximo →
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.