Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.305exploits catalogados

36.465CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.466Referência 23.051GitHub PoC 15.051VulnCheck XDB 8.883Nuclei 4.361Metasploit 3.493✓ só verificadosrecentes populares risco

79.305 exploits

GitHub PoC★ 4

CVE-2026-33267 — Apache Traffic Server @ header internal-metadata spoof (CVSS 10.0). Verified: @ headers leak to plugins on 10.1.2, stripped on 10.1.4

CVE-2026-33267HIGH12 ago 2026

Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata

41RISCO

VulnCheck XDB

remote-with-credentials

CVE-2023-48084—12 ago 2026

Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.

50RISCO

VulnCheck XDB

local

CVE-2024-21413CRITICALsob ataque12 ago 2026

Microsoft Outlook Remote Code Execution Vulnerability

100RISCO

GitHub PoC★ 4

vivo/iQOO 临时 root 工具箱 (免解锁临时root, CVE-2026-43499) - 源码与脚本

CVE-2026-43499HIGH12 ago 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC

CVE-2026-54984 / ZDI-26-543: Windows ICC file parsing out-of-bounds write (CWE-122, CVSS 7.8)

CVE-2026-54984HIGH12 ago 2026

Windows Imaging Component Remote Code Execution Vulnerability

41RISCO

GitHub PoC

关于CVE-2026-64563未完全验证的一种利用思路

CVE-2026-64563HIGH12 ago 2026

rhashtable: clear stale iter->p on table restart

41RISCO

GitHub PoC★ 1

MCP environment-variable blocklist bypass leads to unauthenticated RCE in Flowise 3.1.1

CVE-2026-69263HIGH12 ago 2026

Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

41RISCO

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALsob ataque12 ago 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RISCO

GitHub PoC★ 1

Technical analysis and proof of concept for CVE-2026-59827, a critical unsafe Java deserialization vulnerability in Metabase leading to remote code execution.

CVE-2026-59827CRITICAL12 ago 2026

Metabase: Unsafe Deserialization of H2 Query Results

48RISCO

VulnCheck XDB

local

CVE-2023-32233HIGH12 ago 2026

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused

46RISCO

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALsob ataqueransomware12 ago 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

Public vulnerability advisory and supporting evidence for CVE-2026-67846 affecting the BOOM v3/v4 NBDTLB implementation.

CVE-2026-67846HIGH12 ago 2026

Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect priv

21RISCO

GitHub PoC★ 1

ZildanZ/CVE-2026-64638

CVE-2026-64638HIGH12 ago 2026

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malici

68RISCO

GitHub PoC★ 3

SM-F9360 (Galaxy Z Fold4, q4q) locked-bootloader KernelSU root — CVE-2026-43499 temp root → LD_PRELOAD DEFEX bypass → no-LTO clang-12 kernelsu.ko. Device-verified 2026-08-12.

CVE-2026-43499HIGH12 ago 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC★ 3

CVE-2026-41452 — Krayin CRM unauth installer bypass (X-Requested-With) → admin takeover. Verified: overwrite + login on 2.2.4, blocked on 2.2.5

CVE-2026-41452CRITICAL12 ago 2026

Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup

48RISCO

GitHub PoC★ 5

CVE-2026-72898

CVE-2026-72898CRITICALsob ataque12 ago 2026

Metabase SQL injection via password reset endpoint

100RISCO

GitHub PoC

Defensive analysis of CVE-2009-4496 in Boa 0.94.14rc21, including source-code review, patch analysis, severity assessment, and ethical scope.

CVE-2009-4496—12 ago 2026

Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attacker

28RISCO

GitHub PoC

Leeyoonjoo/CVE-2026-42533

CVE-2026-42533CRITICAL12 ago 2026

NGINX Map directive and Regex matching vulnerability

48RISCO

GitHub PoC★ 1

CVE-2026-73034 — DB-GPT v0.8.1 unauth path traversal → arbitrary file write as root via user-id header. Verified + fix diff

CVE-2026-73034CRITICAL12 ago 2026

DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header

63RISCO

GitHub PoC★ 2

Passive security checker for CVE-2026-48908 affecting SP Page Builder.

CVE-2026-48908CRITICAL12 ago 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

68RISCO

GitHub PoC

CVE-2026-70376 — Pluck CMS site-wide CSRF (fail-open Referer check) → RCE via double-extension upload. CWE-352/434, CVSS 8.0. Advisory + PoC by @IlhomjonR.

CVE-2026-70376CRITICAL12 ago 2026

Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE

48RISCO

VulnCheck XDB

initial-access

CVE-2026-48710MEDIUMsob ataque12 ago 2026

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

83RISCO

GitHub PoC★ 12

CVE-2026-0075 — Android ContactsProvider information disclosure via JSON error side-channel, including PoC, root-cause analysis, and patch details.

CVE-2026-0075HIGH12 ago 2026

In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead t

41RISCO

GitHub PoC

CVE-2026-50656, CVE-2026-69414

CVE-2026-50656HIGH12 ago 2026

Microsoft Defender Elevation of Privilege Vulnerability

46RISCO

GitHub PoC★ 1

PoC funcional de CVE-2026-17106 (CopyEscape): carrera TOCTOU en docker cp que permite escritura arbitraria en el host Docker. Laboratorio Docker + monitor inotify + LD_PRELOAD. Variante macOS inocua y Linux destructiva.

CVE-2026-17106HIGH12 ago 2026

Tar extraction in moby/go-archive can write outside the destination directory via link following

41RISCO

GitHub PoC

Security advisories for CVE-2021-43716/43717/43718 (Epson EH-TW5350)

CVE-2021-43716CRITICAL12 ago 2026

Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector

48RISCO

GitHub PoC★ 10

CVE-2026-68398 Ubuntu PPPoL2TP use-after-free local privilege escalation

CVE-2026-68398HIGH12 ago 2026

ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

41RISCO

GitHub PoC

Defensive security research, SIEM rules, and remediation tools for CVE-2026-18577 & StormEncryptor ransomware.

CVE-2026-18577HIGHsob ataque11 ago 2026

Incomplete patch leads to administrative account takeover

98RISCO

Exploit-DB

LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting

CVE-2026-61876CRITICALdosmultiple11 ago 2026

LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

48RISCO

Exploit-DB

PraisonAI praisonaiagents 1.6.77 - Remote Code Execution

CVE-2026-61447CRITICALremotemultiple11 ago 2026

PraisonAI before 1.6.78 Remote Code Execution via CodeAgent

48RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.