Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.958exploits catalogados

36.206CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8.829Nuclei 4.357Metasploit 3.489✓ só verificadosrecentes populares risco

14.991 exploits

GitHub PoC★ 4

CVE-2026-60004

CVE-2026-60004CRITICAL29 jul 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

85RISCO

abrir ↗

GitHub PoC★ 5

CVE-2026-61511 – vBulletin Pre-Auth RCE (CVSS 9.8). Vuln 5.x/6.x (unpatched). Multi-exploit via Endpoint Pool, AJAX, PHPFuck WAF bypass. Full toolkit: reverse shell, proxy, persistence, webshell, database operations, firewall control, log management, mass scanning. 2 versions: multi-exploit & safe-check. Python 3.8+ Use Ethically, Stay Legal. 🔒

CVE-2026-61511CRITICAL29 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

85RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-43499 exploit adapter for MT6985 MediaTek Dimensity 9300 (vivo PD2241)

CVE-2026-43499HIGH29 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

abrir ↗

GitHub PoC

manfredgabriel/cve-2021-41773-lab

CVE-2021-41773HIGHsob ataqueransomware29 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

abrir ↗

GitHub PoC

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code

CVE-2026-61511CRITICAL29 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

85RISCO

abrir ↗

GitHub PoC

Reproducible SOC lab for CVE-2024-4577 detection and response

CVE-2024-4577CRITICALsob ataqueransomware29 jul 2026

Argument Injection in PHP-CGI

100RISCO

abrir ↗

GitHub PoC

webshellseo8/CVE-2026-50522-Proof-of-Concept

CVE-2026-50522CRITICALsob ataque29 jul 2026

Microsoft SharePoint Remote Code Execution Vulnerability

100RISCO

abrir ↗

GitHub PoC

Pravin761/CVE-2026-54107

CVE-2026-54107HIGH29 jul 2026

Windows Win32k Elevation of Privilege Vulnerability

41RISCO

abrir ↗

GitHub PoC★ 5

CVE-2026-58025 — MediaWiki Deserialization RCE via Log Entry Import. LogEntryBase::extractParams() unserialize() user-controlled log_params. CVSS 9.8 | CWE-502 | MediaWiki < 1.43.9, < 1.44.6, < 1.45.4, < 1.46.0

CVE-2026-58025MEDIUM29 jul 2026

Remote Code Execution via Unsafe Deserialization in LogItem Import

33RISCO

abrir ↗

GitHub PoC★ 5

CVE-2026-49176 WalletService LPE — standalone PoC + Cobalt Strike BOF (SYSTEM command on interactive session)

CVE-2026-49176HIGH29 jul 2026

Windows WalletService Elevation of Privilege Vulnerability

41RISCO

abrir ↗

GitHub PoC

CamilleGR/CVE-2026-73292

CVE-2026-73292HIGH29 jul 2026

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

41RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-66066

CVE-2026-66066CRITICAL29 jul 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

68RISCO

abrir ↗

GitHub PoC

webshellseo8/CVE-2026-57811-Proof-of-Concept

CVE-2026-57811CRITICAL29 jul 2026

WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability

28RISCO

abrir ↗

GitHub PoC★ 23

PoC for CVE-2026-66066 in Ruby on Rails

CVE-2026-66066CRITICAL29 jul 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

68RISCO

abrir ↗

GitHub PoC★ 2

CVE-2026-45746, CVE-2026-45750, CVE-2026-53547 — three critical vulnerabilities in Termix: cross-tenant session hijacking, OS command injection, and account takeover

CVE-2026-45746CRITICAL29 jul 2026

Termix Vulnerable to Arbitrary Command Execution via Session Hijacking

48RISCO

abrir ↗

GitHub PoC

CVE-2026-2586 — Eclipse GlassFish EL injection to RCE

CVE-2026-2586CRITICAL29 jul 2026

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user

48RISCO

abrir ↗

GitHub PoC

webshellseo8/CVE-2026-61511-POC

CVE-2026-61511CRITICAL29 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

85RISCO

abrir ↗

GitHub PoC

Tracking OVSwrap (CVE-2026-64531), the Open vSwitch datapath netlink overflow

CVE-2026-64531HIGH29 jul 2026

net: openvswitch: reject oversized nested action attrs

41RISCO

abrir ↗

GitHub PoC★ 9

CVE-2026-43813: CloudAttestation enforceEnvironment bypass

CVE-2026-43813HIGH29 jul 2026

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macO

41RISCO

abrir ↗

GitHub PoC★ 1

Gitea Docker Image Authentication Bypass

CVE-2026-20896CRITICAL29 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RISCO

abrir ↗

GitHub PoC★ 15

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE. Split-controller upload bypass. CVSS 9.8 | CWE-434 | com_rsfiles < 1.17.12

CVE-2026-57827CRITICAL29 jul 2026

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

63RISCO

abrir ↗

GitHub PoC★ 3

CVE-2026-53264 - Draft or Todo

CVE-2026-53264HIGH28 jul 2026

net/sched: act_api: use RCU with deferred freeing for action lifecycle

41RISCO

abrir ↗

GitHub PoC★ 1

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

CVE-2026-54121HIGH28 jul 2026

Active Directory Certificate Services Elevation of Privilege Vulnerability

41RISCO

abrir ↗

GitHub PoC

Microsoft SharePoint CVE-2026-50522

CVE-2026-50522CRITICALsob ataque28 jul 2026

Microsoft SharePoint Remote Code Execution Vulnerability

100RISCO

abrir ↗

GitHub PoC★ 1

IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution [RCE]

CVE-2026-9198CRITICALsob ataque28 jul 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

100RISCO

abrir ↗

GitHub PoC

Isolated regression and security-control lab for CVE-2026-59891 in @sigstore/oci

CVE-2026-59891CRITICAL28 jul 2026

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

48RISCO

abrir ↗

GitHub PoC★ 6

Security research on Liferay CE 7.0.3 GA4: pre-auth RCE as root (CVE-2020-7961 class) reproduced end-to-end, plus 16 more findings — 8+ with no known CVE. Agentic loop-hunt: 25 generators, 22 judges, 9 live validators on Docker. Evidence trail + one-go checker included.

CVE-2020-7961CRITICALsob ataque28 jul 2026

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RISCO

abrir ↗

GitHub PoC★ 4

KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499

CVE-2026-43499HIGH28 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

abrir ↗

GitHub PoC

Clickbait. The CVE is AI slop.

CVE-2026-51302—28 jul 2026

23RISCO

abrir ↗

GitHub PoC

bha-vin/CVE-2026-64600-Exploit

CVE-2026-64600HIGH28 jul 2026

xfs: resample the data fork mapping after cycling ILOCK

41RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.