Biblioteca de testes
Todas as verificações do SafeVibe
Esta tabela é gerada a partir das regras do próprio scanner, então mostra exatamente o que é executado. Verificações passivas rodam em toda varredura; profundas só em sites com propriedade comprovada; de repositório em repositórios do GitHub. O catálogo cresce sozinho a cada hora. Veja como ele aprende. Última sincronização do catálogo: 2026-11-13.
1.304
verificações no total
965
no catálogo que cresce sozinho
83
verificações passivas de sites
181
verificações de repositórios
75
CVEs nomeadas
2
exploradas ativamente (KEV)
1304 de 1304 verificações
| Gravidade | Verificação | Escopo | Categoria | Tecnologia | CVE | Fonte |
|---|---|---|---|---|---|---|
| Alta | Grafana Snapshot - Authentication Bypass GET /api/snapshots/:key, /dashboard/snapshot/:key | Site · profundo | Known CVEs & vulns | grafana | CVE-2021-39226KEV | nuclei-templates |
| Média | Joomla! Webservice - Password Disclosure GET /api/index.php/v1/config/application?public=true, /api/v1/config/application?public=t… | Site · profundo | Known CVEs & vulns | joomla | CVE-2023-23752KEV | nuclei-templates |
| Crítica | Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass GET /?_wplogin=35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900 | Site · profundo | Known CVEs & vulns | wordpress | CVE-2026-18072 | nuclei-templates |
| Crítica | Apache APISIX Dashboard <2.10.1 - API Unauthorized Access GET /apisix/admin/migrate/export | Site · profundo | Known CVEs & vulns | apache | CVE-2021-45232 | nuclei-templates |
| Crítica | Apache ShenYu Admin Unauth Access GET /plugin | Site · profundo | Known CVEs & vulns | apache | CVE-2022-23944 | nuclei-templates |
| Crítica | baserCMS Installation - Exposure GET / | Site · profundo | Misconfig & panels | generic | — | nuclei-templates |
| Crítica | BlueImp jQuery-File-Upload - Arbitrary File Upload GET /jquery-file-upload/server/php/ | Site · profundo | Misconfig & panels | generic | — | nuclei-templates |
| Crítica | CirCarLife - Installer GET /html/setup.html | Site · profundo | Misconfig & panels | generic | — | nuclei-templates |
| Crítica | CISA Known Exploited Vulnerabilities Actively exploited CVEs escalated to critical | Inteligência ao vivo | Live feeds | generic | — | Live feed |
| Crítica | Committed .env file A .env file is committed to the repository. These hold production secrets and must never … | Repositório do GitHub | Sensitive files | generic | — | Built-in |
| Crítica | Committed credential store A git-credentials or kubeconfig file is committed. These hold plaintext tokens for your g… | Repositório do GitHub | Sensitive files | generic | — | Built-in |
| Crítica | Committed credentials JSON A credentials / service-account JSON file is committed. These usually grant broad cloud a… | Repositório do GitHub | Sensitive files | generic | — | Built-in |
| Crítica | Committed private SSH key A private SSH key is committed. Anyone with repo access can use it to impersonate you. | Repositório do GitHub | Sensitive files | generic | — | Built-in |
| Crítica | Compromised release: @ctrl/tinycolor@4.1.1, 4.1.2 Shai-Hulud npm worm (Sept 2025) — steals npm/GitHub/cloud tokens and republishes itself | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: @solana/web3.js@1.95.6, 1.95.7 Dec 2024 compromise — private-key exfiltration | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: ansi-regex@6.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: ansi-styles@6.2.2 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: backslash@0.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: chalk-template@1.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: chalk@5.6.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: coa@2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, 3.1.3 Nov 2021 compromise — password stealer | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: color-convert@3.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: color-name@2.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: color-string@2.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: debug@4.4.2 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: error-ex@1.3.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: eslint-config-prettier@8.10.1, 9.1.1, 10.1.6, 10.1.7 July 2025 maintainer phishing (CVE-2025-54313) — Windows malware loader | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: event-stream@3.3.6 2018 flatmap-stream backdoor | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: has-ansi@6.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: is-arrayish@0.3.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: node-ipc@10.1.1, 10.1.2 Mar 2022 protestware — overwrites files | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: nx@20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0 s1ngularity / Nx compromise (Aug 2025) — exfiltrated secrets via AI CLIs | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: rc@1.2.9, 1.3.9, 2.3.9 Nov 2021 compromise — password stealer | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: simple-swizzle@0.2.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: slice-ansi@7.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: strip-ansi@7.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: supports-color@10.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: supports-hyperlinks@4.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: ua-parser-js@0.7.29, 0.8.0, 1.0.0 Oct 2021 compromise — cryptominer & password stealer | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Compromised release: wrap-ansi@9.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | Repositório do GitHub | Supply chain | npm | — | Curated advisories |
| Crítica | Database error from crafted input (SQLi precondition) Single quote in a query parameter | Site · profundo | Injection | generic | — | Built-in |
| Crítica | DigitalOcean Key Exposure via Axiom GET /.axiom/accounts/do.json | Site · profundo | Exposed files | generic | — | nuclei-templates |
| Crítica | Docker Container - Misconfiguration Exposure GET /images/json | Site · profundo | Misconfig & panels | generic | — | nuclei-templates |
| Crítica | Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass GET /my-account/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0=, /?alg_wc_ev_verify_emai… | Site · profundo | Known CVEs & vulns | wordpress | — | nuclei-templates |
| Crítica | Exposed admin / tool: Actuator /env (full config leak) GET /actuator/env | Site · profundo | Admin panels | generic | — | Built-in |
| Crítica | Exposed admin / tool: Actuator heap dump GET /actuator/heapdump | Site · profundo | Admin panels | generic | — | Built-in |
| Crítica | Exposed secret: Anthropic API key Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: AWS Access Key ID Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: AWS Secret Access Key Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: Azure Storage connection string Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: Database URL with embedded password Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: DigitalOcean token Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: GitHub token Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: GitLab personal access token Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: Google Cloud service-account key Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: Groq API key Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: HashiCorp Vault token Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: npm access token Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: npm auth token in .npmrc Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: OpenAI API key Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: OpenRouter API key Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: Perplexity API key Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: PlanetScale credential Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: Private Key Block Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: PyPI upload token Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: Replicate API token Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: Shopify access token Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: Stripe (or Clerk) live secret key Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: Supabase personal access token Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: Supabase secret key (sb_secret_) Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed secret: xAI (Grok) API key Regex on page + every JS bundle | Site · passivo | Secrets | generic | — | Built-in |
| Crítica | Exposed: AWS credentials file GET /.aws/credentials | Site · profundo | Exposed files | generic | — | Built-in |
| Crítica | Exposed: Database backup dump GET /backup.sql | Site · profundo | Exposed files | generic | — | Built-in |
| Crítica | Exposed: Database dump GET /dump.sql | Site · profundo | Exposed files | generic | — | Built-in |
| Crítica | Exposed: Development environment file GET /.env.development | Site · profundo | Exposed files | generic | — | Built-in |
| Crítica | Exposed: Environment file (.env) GET /.env | Site · profundo | Exposed files | generic | — | Built-in |
| Crítica | Exposed: Environment file backup GET /.env.backup | Site · profundo | Exposed files | generic | — | Built-in |
| Crítica | Exposed: Git credential store GET /.git-credentials | Site · profundo | Exposed files | generic | — | Built-in |
| Crítica | Exposed: Local environment file GET /.env.local | Site · profundo | Exposed files | generic | — | Built-in |
| Crítica | Exposed: Production environment file GET /.env.production | Site · profundo | Exposed files | generic | — | Built-in |
| Crítica | Exposed: SSH private key GET /id_rsa | Site · profundo | Exposed files | generic | — | Built-in |
| Crítica | Exposed: Terraform state GET /terraform.tfstate | Site · profundo | Exposed files | generic | — | Built-in |
| Crítica | Exposed: WordPress config backup GET /wp-config.php.bak | Site · profundo | Exposed files | generic | — | Built-in |
| Crítica | Firebase Realtime Database world-readable GET /.json?shallow=true | Site · profundo | Backend rules | firebase | — | Built-in |
| Crítica | Firebase rules allow public access allow … if true; / .read: true | Repositório do GitHub | Backend rules | firebase | — | Built-in |
| Crítica | Firestore collections readable without auth users, profiles, posts, messages, orders, chats | Site · profundo | Backend rules | firebase | — | Built-in |
| Crítica | Fork CMS - Installer GET /install/2 | Site · profundo | Misconfig & panels | generic | — | nuclei-templates |
| Crítica | form-data < 2.5.4 / 3.0.4 / 4.0.4 Predictable multipart boundary allows parameter injection (CVE-2025-7783). | Repositório do GitHub | Dependencies | npm | — | Curated advisories |
| Crítica | GetSimple CMS - Installer GET /admin/install.php | Site · profundo | Misconfig & panels | generic | — | nuclei-templates |
| Crítica | GitHub Actions script injection Untrusted ${{ github.event.* }} in run/script | Repositório do GitHub | CI/CD | github-actions | — | Built-in |
| Crítica | GitLab CE/EE - Hard-Coded Credentials GET /users/sign_in | Site · profundo | Known CVEs & vulns | gitlab | CVE-2022-1162 | nuclei-templates |
| Crítica | GitLab CE/EE - Information Disclosure GET /users/sign_in | Site · profundo | Known CVEs & vulns | gitlab | CVE-2022-0735 | nuclei-templates |
| Crítica | Gogs (Go Git Service) - Installer GET /install | Site · profundo | Misconfig & panels | generic | — | nuclei-templates |
| Crítica | Hardcoded secret: Anthropic API key Regex on every text file (and git history) | Repositório do GitHub | Secrets | generic | — | Built-in |
| Crítica | Hardcoded secret: AWS Access Key ID Regex on every text file (and git history) | Repositório do GitHub | Secrets | generic | — | Built-in |
| Crítica | Hardcoded secret: AWS Secret Access Key Regex on every text file (and git history) | Repositório do GitHub | Secrets | generic | — | Built-in |
| Crítica | Hardcoded secret: Azure Storage connection string Regex on every text file (and git history) | Repositório do GitHub | Secrets | generic | — | Built-in |
| Crítica | Hardcoded secret: Database URL with embedded password Regex on every text file (and git history) | Repositório do GitHub | Secrets | generic | — | Built-in |
| Crítica | Hardcoded secret: DigitalOcean token Regex on every text file (and git history) | Repositório do GitHub | Secrets | generic | — | Built-in |
| Crítica | Hardcoded secret: GitHub token Regex on every text file (and git history) | Repositório do GitHub | Secrets | generic | — | Built-in |
Somente leitura por design
Cada verificação é uma única requisição GET/HEAD ou uma busca de padrão. Modelos que exploram, fazem fuzzing, força bruta ou enviam cargas são rejeitados na construção do catálogo.
Gerados uma vez, sempre atualizados
Cada modelo de origem é convertido uma única vez e registrado. As sincronizações de hora em hora só processam o que é novo ou mudou e atualizam as marcas de exploração ativa.
Fontes
ProjectDiscovery nuclei-templates (MIT), CISA KEV, OSV.dev, FIRST EPSS, pacotes maliciosos da OpenSSF, avisos selecionados e o pesquisador de IA do SafeVibe para as CVEs mais recentes.