Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.958exploits catalogados

36.206CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8.829Nuclei 4.357Metasploit 3.489✓ só verificadosrecentes populares risco

14.991 exploits

GitHub PoC★ 1

WordPress KeepInMind CVE-2026-9271 Exploit - Tool detecting stored XSS in KeepInMind plugin v0.8.4.2 and below. Built by Sudeepa Wanigarathna, it simulates CSS injection to hijack admin accounts. Features safe testing, attack simulation, credential capture, bulk scanning, reporting. Essential for security researchers.

CVE-2026-9271MEDIUM17 jul 2026

KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS

33RISCO

GitHub PoC★ 7

CVE-2026-63030

CVE-2026-63030CRITICALsob ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

GitHub PoC★ 1

Reproducer for CVE-2026-48205: Apache Camel camel-dns dns.* header injection redirecting DNS queries to an attacker-controlled resolver (SSRF via DNS) and enabling internal-hostname reconnaissance (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-48205CRITICAL17 jul 2026

Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour

48RISCO

GitHub PoC★ 45

CVE-2026-50416: Windows 11 KASLR bypass

CVE-2026-50416LOW17 jul 2026

Win32k Information Disclosure Vulnerability

28RISCO

GitHub PoC

Reproducer for CVE-2026-48204: Apache Camel camel-mongodb-gridfs gridfs.* header injection overriding the GridFS operation (enumerate/read/delete files) from an unauthenticated HTTP request (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-48204CRITICAL17 jul 2026

Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration

48RISCO

GitHub PoC

Academic proof-of-concept demonstrating CVE-2026-15583 for authorized security research.

CVE-2026-15583HIGH17 jul 2026

SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

41RISCO

GitHub PoC★ 4

HIKRAVEN - Advanced Hikvision Security Assessment Platform for professional penetration testing. Detects 12+ CVEs including CVE-2021-36260 (CRITICAL), tests default credentials, performs network discovery, and generates professional security reports. For authorized security testing only! 🛡️🔒

CVE-2021-36260CRITICALsob ataque17 jul 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RISCO

GitHub PoC

CVE-2026-38526 Exploit | by infrar3d

CVE-2026-38526CRITICAL17 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RISCO

GitHub PoC★ 759

wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain

CVE-2026-63030CRITICALsob ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

GitHub PoC

Pentest completo sobre Metasploitable: recon con nmap, explotación con Metasploit (CVE-2007-2447), extracción y cracking de credenciales, persistencia SSH

CVE-2007-2447—17 jul 2026

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RISCO

GitHub PoC

Academic proof-of-concept demonstrating CVE-2026-46442 for authorized security research.

CVE-2026-46442CRITICAL17 jul 2026

Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

75RISCO

GitHub PoC

Unofficial Bash IoC checker for SonicWall SMA1000 appliances affected by actively exploited CVE-2026-15409 and CVE-2026-15410.

CVE-2026-15409CRITICALsob ataqueransomware16 jul 2026

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

100RISCO

GitHub PoC★ 2

PoC tools for CVE-2026-58457: Unauthenticated OS Command Injection leading to remote root on Shenzhen Aitemi M300 Wi-Fi Repeater (MT02). Includes exploit, validator, payload generator, and Metasploit module. For educational and authorized pentesting only.

CVE-2026-58457CRITICAL16 jul 2026

Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp

48RISCO

GitHub PoC

Reproducer for CVE-2026-46726: Apache Camel camel-vertx-websocket unfiltered inbound header injection enabling SSRF and secret disclosure via property-placeholder resolution (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-46726HIGH16 jul 2026

Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers

41RISCO

GitHub PoC

CVE-2026-43499 exploit with OnePlus Ace3 support

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC★ 2

syxlox/CVE-2026-50369

CVE-2026-50369HIGH16 jul 2026

Windows Remote Desktop Services Elevation of Privilege Vulnerability

41RISCO

GitHub PoC

CVE-2026-43499 exploit reproduction on jinghu (Xiaomi Pad 7 Ultra)

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC★ 40

Standalone CVE-2026-43499 PoC for Galaxy S25 Ultra SM-S938N S938NKSUACZF1

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC★ 6

CVE-2026-43499 GhostLock exploit for Redmi K70 Ultra (rothko) - data-only physmap overwrite

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC★ 6

Proof of concept for CVE-2026-54992, an MSMQ remote-read integer overflow

CVE-2026-54992HIGH16 jul 2026

Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability

41RISCO

GitHub PoC

bibotai/secveri-cve-2026-50011-negative

CVE-2026-50011HIGH16 jul 2026

Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

41RISCO

GitHub PoC★ 6

this is a modified POC of rz1027 for CVE-2026-20896

CVE-2026-20896CRITICAL16 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RISCO

GitHub PoC

KVM KernelCare + Januscape (CVE-2026-53359) verification & mitigation scripts

CVE-2026-53359HIGH16 jul 2026

KVM: x86: Fix shadow paging use-after-free due to unexpected role

41RISCO

GitHub PoC

bibotai/secveri-cve-2026-50011-positive

CVE-2026-50011HIGH16 jul 2026

Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

41RISCO

GitHub PoC★ 1

CVE-2024-25600 - Unauthenticated RCE exploit for WordPress Bricks Builder Theme. Advanced exploitation framework with interactive shell, reverse shells, file upload/download, async scanning, stealth mode, proxy support, and multi-threaded vulnerability scanning. For authorized security testing only.

CVE-2024-25600CRITICAL16 jul 2026

WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

85RISCO

GitHub PoC★ 1

Super Forms Unauthenticated File Upload RCE | CVSS 9.8

CVE-2026-14894CRITICAL16 jul 2026

Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)

63RISCO

GitHub PoC

CVE-2026-43499 exploit reproduction on jinghu (Xiaomi Pad 7 Ultra)

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC

sadb98523-eng/CVE-2026-13001

CVE-2026-13001CRITICAL16 jul 2026

Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

63RISCO

GitHub PoC

Sana-404/CVE-2026-8388-Mitigation-and-Detection

CVE-2026-8388MEDIUM16 jul 2026

Incorrect boundary conditions in the JavaScript Engine: JIT component

33RISCO

GitHub PoC

CVE-2026-43499 exploit with OnePlus Ace3 support

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.