Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.958exploits catalogados
36.206CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8.829Nuclei 4.357Metasploit 3.489✓ só verificadosrecentespopularesrisco
14.991 exploits
GitHub PoC★ 6
jaf0rk/CVE-2026-9973-exploit
CVE-2026-9973HIGH21 jul 2026
Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code i
41RISCO
abrir ↗
GitHub PoC★ 2
a shitty poc utilizing CVE-2026-0059.
CVE-2026-0059HIGH21 jul 2026
In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overfl
41RISCO
abrir ↗
GitHub PoC★ 3
Analysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030
CVE-2026-60137MEDIUMsob ataque21 jul 2026
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
100RISCO
abrir ↗
GitHub PoC★ 11
CVE-2026-52910 kernel crash PoC. screen goes off.
CVE-2026-52910HIGH21 jul 2026
bpf: Free reuseport cBPF prog after RCU grace period.
41RISCO
abrir ↗
GitHub PoC
CVE-2026-43499
CVE-2026-43499HIGH21 jul 2026
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗
GitHub PoC
WhatsWrongAndWhy/CVE-2021-3156
CVE-2021-3156HIGHsob ataque21 jul 2026
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISCO
abrir ↗
GitHub PoC
WhatsWrongAndWhy/CVE-2017-1000112
CVE-2017-1000112—21 jul 2026
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE
43RISCO
abrir ↗
GitHub PoC
PoC reproducer for CVE-2026-49365 (Apache Camel camel-netty-http / camel-undertow): muteException defaults to false, so an uncaught exception's full Java stack trace is returned to the HTTP client (CWE-209). Fixed in 4.14.8/4.18.3/4.21.0.
CVE-2026-49365MEDIUM21 jul 2026
Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients
33RISCO
abrir ↗
GitHub PoC
my exploit for GLPI
CVE-2022-35914CRITICALsob ataque21 jul 2026
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
100RISCO
abrir ↗
GitHub PoC
CVE-2026-13156 Vulnerability Advisory & PoC — Discovered by Huynh Kien Minh (MinhHK).
CVE-2026-13156MEDIUM21 jul 2026
MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF
33RISCO
abrir ↗
GitHub PoC
Drop-in fix for the unpatched MCP STDIO command-injection flaw (CVE-2026-30623 family)
CVE-2026-30623CRITICAL21 jul 2026
LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application
63RISCO
abrir ↗
GitHub PoC
WhatsWrongAndWhy/CVE-2018-18955
CVE-2018-18955—21 jul 2026
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat
38RISCO
abrir ↗
GitHub PoC★ 4
Exploit, POC for CVE-2025-32432, CraftCMS2Shell
CVE-2025-32432CRITICALsob ataque21 jul 2026
Craft CMS Allows Remote Code Execution
100RISCO
abrir ↗
GitHub PoC
WhatsWrongAndWhy/CVE-2021-22555
CVE-2021-22555HIGHsob ataque21 jul 2026
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
100RISCO
abrir ↗
GitHub PoC
WhatsWrongAndWhy/CVE-2018-5333
CVE-2018-5333—21 jul 2026
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning
38RISCO
abrir ↗
GitHub PoC
danielissaq/-PaperCut-CVE-2023-27350-
CVE-2023-27350CRITICALsob ataqueransomware21 jul 2026
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui
100RISCO
abrir ↗
GitHub PoC
6t2kydmp8k-jpg/CVE-2025-55182-Vulnerability-Proof-of-Concept-Group-Project-
CVE-2025-55182CRITICALsob ataqueransomware21 jul 2026
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗
GitHub PoC★ 1
PoC toolkit for exploiting Cisco IMC RCE CVE-2026-20200
CVE-2026-20200HIGH21 jul 2026
Cisco Integrated Management Controller Argument Injection and Remote Code Execution Vulnerability
41RISCO
abrir ↗
GitHub PoC
mass_cve-2021-41773
CVE-2021-41773HIGHsob ataqueransomware21 jul 2026
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
abrir ↗
GitHub PoC
0xdak/CVE-2026-53595_exploit
CVE-2026-53595CRITICAL21 jul 2026
FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL
48RISCO
abrir ↗
GitHub PoC★ 1
0xdak/CVE-2026-9198_exploit
CVE-2026-9198CRITICALsob ataque21 jul 2026
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
100RISCO
abrir ↗
GitHub PoC★ 1
PoC for CVE-2026-57588 - SQL injection in Nessus 10.12.0 XML import. Generates malicious .nessus files to enumerate databases, exfiltrate credentials, and test time-based blind injection. For authorized security research. Author: Sudeepa Wanigarathna. Patched in 10.12.1.
CVE-2026-57588LOW21 jul 2026
SQL Injection in Nessus via Malicious Scan Result File Import
28RISCO
abrir ↗
GitHub PoC
CVE-2026-13233 (Drupal OpenAI Provider, SA-CONTRIB-2026-053): response-URL SSRF / local file read. Untrusted upstream, not the prompt. Safe reproducer + detections. Fixed in 1.1.1/1.2.2.
CVE-2026-13233LOW21 jul 2026
OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053
28RISCO
abrir ↗
GitHub PoC
Mirrored from tegal1337/CVE-2022-0441
CVE-2022-0441—21 jul 2026
MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation
60RISCO
abrir ↗
GitHub PoC
Tracking the nginx CVE-2026-42533 map/regex capture-clobbering heap overflow
CVE-2026-42533CRITICAL21 jul 2026
NGINX Map directive and Regex matching vulnerability
48RISCO
abrir ↗
GitHub PoC★ 1
CVE-2026-6875
CVE-2026-6875CRITICAL21 jul 2026
Sandbox Escape in ServiceNow AI Platform
85RISCO
abrir ↗
GitHub PoC★ 1
PoC reproducer for CVE-2026-53913 (Apache Camel camel-keycloak): KeycloakSecurityPolicy fails open in the Basic Setup — with no required roles/permissions the token is never verified, so any forged/garbage bearer token bypasses authentication (unauthenticated RCE). Fixed in 4.18.3/4.21.0.
CVE-2026-53913CRITICAL21 jul 2026
Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted
48RISCO
abrir ↗
GitHub PoC★ 1
Hashes and shim versions for the UEFI Secure Boot shims affected by CVE-2026-8863
CVE-2026-8863HIGH21 jul 2026
CVE-2026-8863
41RISCO
abrir ↗
GitHub PoC
WhatsWrongAndWhy/CVE-2017-7308
CVE-2017-7308—21 jul 2026
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer
43RISCO
abrir ↗
GitHub PoC
PoC reproducer for CVE-2026-49099 (Apache Camel camel-salesforce): the non-Camel-prefixed sObjectQuery header escapes the HTTP header filter and overrides the producer's configured SOQL (SOQL injection / broken access control). Fixed in 4.14.8/4.18.3/4.21.0.
CVE-2026-49099MEDIUM21 jul 2026
Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour
33RISCO
abrir ↗
← anteriorpágina 32 / 500próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.