Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
79.305exploits catalogados
36.465CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.466Referência 23.051GitHub PoC 15.051VulnCheck XDB 8883Nuclei 4361Metasploit 3493✓ solo verificadosrecientespopularesriesgo
77.866 exploits
GitHub PoC
Tracking OVSwrap (CVE-2026-64531), the Open vSwitch datapath netlink overflow
net: openvswitch: reject oversized nested action attrs
41RIESGO
abrir ↗GitHub PoC
Pravin761/CVE-2026-54107
Windows Win32k Elevation of Privilege Vulnerability
41RIESGO
abrir ↗VulnCheck XDB
info-leak
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗GitHub PoC★ 15
CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE. Split-controller upload bypass. CVSS 9.8 | CWE-434 | com_rsfiles < 1.17.12
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12
63RIESGO
abrir ↗GitHub PoC
manfredgabriel/cve-2021-41773-lab
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗GitHub PoC★ 5
CVE-2026-58025 — MediaWiki Deserialization RCE via Log Entry Import. LogEntryBase::extractParams() unserialize() user-controlled log_params. CVSS 9.8 | CWE-502 | MediaWiki < 1.43.9, < 1.44.6, < 1.45.4, < 1.46.0
Remote Code Execution via Unsafe Deserialization in LogItem Import
33RIESGO
abrir ↗GitHub PoC
webshellseo8/CVE-2026-57811-Proof-of-Concept
WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability
28RIESGO
abrir ↗GitHub PoC★ 23
PoC for CVE-2026-66066 in Ruby on Rails
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
48RIESGO
abrir ↗GitHub PoC
webshellseo8/CVE-2026-61511-POC
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
48RIESGO
abrir ↗GitHub PoC
webshellseo8/CVE-2026-50522-Proof-of-Concept
Microsoft SharePoint Remote Code Execution Vulnerability
100RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-45746, CVE-2026-45750, CVE-2026-53547 — three critical vulnerabilities in Termix: cross-tenant session hijacking, OS command injection, and account takeover
Termix Vulnerable to Arbitrary Command Execution via Session Hijacking
48RIESGO
abrir ↗GitHub PoC★ 5
CVE-2026-49176 WalletService LPE — standalone PoC + Cobalt Strike BOF (SYSTEM command on interactive session)
Windows WalletService Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC
CVE-2026-2586 — Eclipse GlassFish EL injection to RCE
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user
48RIESGO
abrir ↗GitHub PoC
Agent skill that audits a Rails codebase for CVE-2026-66066 (KindaRails2Shell) — Active Storage + libvips arbitrary file read / RCE, checking Rails and libvips versions and block-untrusted mitigations
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
48RIESGO
abrir ↗GitHub PoC
Public technical advisory and reproduction evidence for CVE-2026-52134 affecting GOOSE replay handling in libiec61850 v1.6.
An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass au
48RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-43499 exploit adapter for MT6985 MediaTek Dimensity 9300 (vivo PD2241)
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-66066
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
48RIESGO
abrir ↗GitHub PoC
CamilleGR/CVE-2026-73292
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
41RIESGO
abrir ↗VulnCheck XDB
initial-access
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RIESGO
abrir ↗GitHub PoC★ 1
Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
Active Directory Certificate Services Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC
Isolated regression and security-control lab for CVE-2026-59891 in @sigstore/oci
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
48RIESGO
abrir ↗GitHub PoC★ 1
IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution [RCE]
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RIESGO
abrir ↗VulnCheck XDB
initial-access
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
48RIESGO
abrir ↗GitHub PoC★ 4
KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
CVE-2026-14856 TastyIgniter v4.3.0
Stored Cross-Site Scripting (XSS) in TastyIgniter Media Manager
33RIESGO
abrir ↗GitHub PoC★ 1
A PoC for CVE-2026-64725
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS
41RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.