Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.958exploits catalogados

36.206CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8.829Nuclei 4.357Metasploit 3.489✓ só verificadosrecentes populares risco

14.991 exploits

GitHub PoC★ 1

Full VAPT writeup of OWASP CICD-Goat — 9 CTFd flags captured, 4 critical + 5 high findings (incl. CVE-2024-23897) mapped to the OWASP Top 10 CI/CD Security Risks, with PoCs, remediation, and interview-ready summaries.

CVE-2024-23897CRITICALsob ataqueransomware31 jul 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISCO

GitHub PoC

Unauthenticated Address Book Modification on Sharp MX/BP Multifunction Printers

CVE-2026-63563MEDIUM31 jul 2026

Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication

33RISCO

GitHub PoC★ 1

CVE-2026-54121(CertiGhost) without MachineAccountQuota POC

CVE-2026-54121HIGH31 jul 2026

Active Directory Certificate Services Elevation of Privilege Vulnerability

41RISCO

GitHub PoC

Comprehensive technical research on CVE-2026-43284 (Dirty Frag), including Linux kernel internals, root cause analysis, patch analysis, detection engineering, threat hunting, incident response, and Kubernetes security implications.

CVE-2026-43284HIGH31 jul 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RISCO

GitHub PoC

CVE-2026-8337 is an Insecure Direct Object Reference (IDOR) vulnerability in Concrete CMS that affects the Survey feature. Unlike CVE-2026-8347 (which involved Express associations), this vulnerability allows an unauthenticated attacker to participate in a restricted/private survey under specific site configurations.

CVE-2026-8337MEDIUM31 jul 2026

Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys

33RISCO

GitHub PoC★ 1

This is N-day patch we releasing by testing our model capabilities

CVE-2026-16723CRITICAL31 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

53RISCO

GitHub PoC

Unauthenticated RCE in DBGate <= 7.1.8

CVE-2026-47668CRITICAL31 jul 2026

DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

63RISCO

GitHub PoC

DJ-Classifieds Joomla Component Unauthenticated File Upload RCE. 3-string filter bypass via PHP short tags. CVSS 10.0 | CWE-434 | com_djclassifieds < 3.11.2

CVE-2026-61424CRITICAL30 jul 2026

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

48RISCO

GitHub PoC★ 1

CVE-2026-60004

CVE-2026-60004CRITICAL30 jul 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

85RISCO

GitHub PoC

Security Advisory: Stored Cross-Site Scripting Via Agent Messages Leading To Session Token Theft (openclaw-dashboard)

CVE-2026-66421HIGH30 jul 2026

OpenClaw Dashboard Stored XSS via lastMessage Session Field

41RISCO

GitHub PoC

CVE-2026-59726 - Draft or Todo

CVE-2026-59726CRITICAL30 jul 2026

Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

48RISCO

GitHub PoC★ 26

rails/rails-forensics-CVE-2026-66066

CVE-2026-66066CRITICAL30 jul 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

68RISCO

GitHub PoC

CVE-2026-63030 Exploit | by gr1tx

CVE-2026-63030CRITICALsob ataque30 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

GitHub PoC★ 1

Fastjson RCE

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

53RISCO

GitHub PoC★ 2

Nowafen/CVE-2026-16723

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

53RISCO

GitHub PoC

KunalKhandelwal-dev/cve-2021-41773-lab

CVE-2021-41773HIGHsob ataqueransomware30 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

GitHub PoC

shootcannon/CVE-2026-61511

CVE-2026-61511CRITICAL30 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

85RISCO

GitHub PoC★ 1

Gitea diffpatch RCE

CVE-2026-60004CRITICAL30 jul 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

85RISCO

GitHub PoC★ 2

A critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83.

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

53RISCO

GitHub PoC

nawalacheker1/CVE-2026-46331

CVE-2026-46331HIGH30 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISCO

GitHub PoC

Demonstrate the unauthenticated remote code execution vulnerability in the RSFiles! Joomla component through an arbitrary file upload.

CVE-2026-57827CRITICAL30 jul 2026

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

63RISCO

GitHub PoC★ 1

CVE-2026-10702

CVE-2026-10702MEDIUM30 jul 2026

JIT miscompilation in the JavaScript Engine: JIT component

33RISCO

GitHub PoC

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover (openclaw-dashboard)

CVE-2026-66418CRITICAL30 jul 2026

OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field

48RISCO

GitHub PoC

HeltonPojo/CVE-2025-32432

CVE-2025-32432CRITICALsob ataque30 jul 2026

Craft CMS Allows Remote Code Execution

100RISCO

GitHub PoC★ 1

JetBrains TeamCity On-Premises CVE-2026-63077 Emergency Hardening & Patch Runbook Package

CVE-2026-63077CRITICALsob ataque30 jul 2026

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin

100RISCO

GitHub PoC

Hands-on exploit lab for CVE-2024-28000 — unauthenticated privilege escalation in LiteSpeed Cache (WordPress plugin, <=6.3.0.1). Spins up a vulnerable environment with Docker and includes a Go-based brute-forcer that cracks the weak mt_rand hash to create an administrator account.

CVE-2024-28000CRITICAL30 jul 2026

WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

75RISCO

GitHub PoC★ 2

Security research tool for FortiWeb CVE-2025-64446 vulnerability. Automated exploitation framework with advanced logging, real-time metrics, proxy debugging, and professional reporting. Includes retry logic, multi-threading, and configurable settings. For authorized security testing only. CVSS 9.8 Critical.

CVE-2025-64446CRITICALsob ataque30 jul 2026

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RISCO

GitHub PoC

Aimy Captcha-Less Form Guard Joomla Component PHP Object Injection RCE. clfgd XOR keystream recovery + unserialize(). CVSS 10.0 | CWE-502 | aimy_captcha-less_form_guard < 20.1

CVE-2026-65883CRITICAL30 jul 2026

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

48RISCO

GitHub PoC★ 1

CVE-2026-66066

CVE-2026-66066CRITICAL29 jul 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

68RISCO

GitHub PoC

Public technical advisory and reproduction evidence for CVE-2026-52134 affecting GOOSE replay handling in libiec61850 v1.6.

CVE-2026-52134CRITICAL29 jul 2026

An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass au

48RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.