Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

79.305exploits catalogados
36.465CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.466Referência 23.051GitHub PoC 15.051VulnCheck XDB 8883Nuclei 4361Metasploit 3493✓ solo verificadosrecientespopularesriesgo
77.866 exploits
VulnCheck XDB
info-leak
CVE-2026-63030CRITICALbajo ataque20 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
GitHub PoC★ 2
noLKM,5.10 use CVE-2026-52910.
CVE-2026-52910HIGH20 jul 2026
bpf: Free reuseport cBPF prog after RCU grace period.
41RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2021-42013CRITICALbajo ataqueransomware20 jul 2026
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RIESGO
abrir ↗
VulnCheck XDB
info-leak
CVE-2026-63030CRITICALbajo ataque20 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
VulnCheck XDB
info-leak
CVE-2024-23897CRITICALbajo ataqueransomware20 jul 2026
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RIESGO
abrir ↗
VulnCheck XDB
info-leak
CVE-2026-63030CRITICALbajo ataque20 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
GitHub PoC
CVE-2026-4858 research
CVE-2026-4858HIGH20 jul 2026
Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.
21RIESGO
abrir ↗
GitHub PoC★ 1
Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress (versions 6.9.0 through 7.0.1).
CVE-2026-63030CRITICALbajo ataque20 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
GitHub PoC★ 1
WordPress Core Unauthenticated RCE (CVE-2026-63030, CVE-2026-60137)
CVE-2026-63030CRITICALbajo ataque20 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
GitHub PoC
unauthenticated RCE in WordPress core (CVE-2026-63030 + CVE-2026-60137)
CVE-2026-63030CRITICALbajo ataque20 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
VulnCheck XDB
info-leak
CVE-2026-60137MEDIUMbajo ataque20 jul 2026
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
100RIESGO
abrir ↗
GitHub PoC★ 1
PoC tool for CVE-2026-44680 affecting MikroORM ≤7.0.13. Exploits JSON path injection to extract database contents via UNION-based attacks. Features vulnerability detection, automated data extraction, table enumeration, and blind injection support. Includes proxy integration for Burp Suite and WAF evasion techniques.
CVE-2026-44680HIGH20 jul 2026
MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys
41RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-63030CRITICALbajo ataque20 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
GitHub PoC
wp2shell PoC with Cloudflare WAF bypass via body padding (CVE-2026-63030)
CVE-2026-63030CRITICALbajo ataque20 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
GitHub PoC
PoC reproducer for CVE-2026-49097 (Apache Camel camel-irc): the non-Camel-prefixed irc.sendTo header escapes the HTTP header filter and overrides the producer's configured channel, redirecting an IRC message to an attacker-chosen destination. Fixed in 4.14.8/4.18.3/4.21.0.
CVE-2026-49097MEDIUM20 jul 2026
Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC messages to arbitrary channels or users
33RIESGO
abrir ↗
GitHub PoC
unauthenticated RCE in WordPress core (CVE-2026-63030 + CVE-2026-60137)
CVE-2026-63030CRITICALbajo ataque20 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
GitHub PoC★ 16
YellowKey BitLocker CVE-2026-45585 is an open-source utility to extract, backup, and organize BitLocker recovery keys on Windows encrypted drives. Automate volume decryption, manage drive encryption states via command-line tools, export secure configuration files, and track recovery key logs. Download direct repository setup files.
CVE-2026-45585MEDIUM20 jul 2026
Windows BitLocker Security Feature Bypass Vulnerability
33RIESGO
abrir ↗
GitHub PoC
Defensive NGINX CVE-2026-42533 map regex risk audit with config scanner, Splunk/Defender notes, and lab evidence.
CVE-2026-42533CRITICAL20 jul 2026
NGINX Map directive and Regex matching vulnerability
48RIESGO
abrir ↗
GitHub PoC
0x00phantom-hat/CVE-2026-5029-Exploit
CVE-2026-5029HIGH20 jul 2026
RCE in Code Runner MCP Server
41RIESGO
abrir ↗
GitHub PoC
Security vulnerability research writeups. CVE-2026-50402: Windows NTFS Elevation of Privilege (CVSS 7.8)
CVE-2026-50402HIGH19 jul 2026
NTFS Elevation of Privilege Vulnerability
41RIESGO
abrir ↗
GitHub PoC★ 1
Unauthenticated Remote Code Execution (RCE) vulnerability in the JCE (Joomla Content Editor) extension for Joomla
CVE-2026-48907CRITICALbajo ataque19 jul 2026
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗
GitHub PoC★ 2
CVE-2026-63030 / wp2shell
CVE-2026-63030CRITICALbajo ataque19 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-60137MEDIUMbajo ataque19 jul 2026
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
100RIESGO
abrir ↗
VulnCheck XDB
info-leak
CVE-2026-63030CRITICALbajo ataque19 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-60137MEDIUMbajo ataque19 jul 2026
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-63030CRITICALbajo ataque19 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
GitHub PoC★ 10
wp2shell — WordPress Core Pre-Auth RCE (CVE-2026-63030 + CVE-2026-60137). Exploit toolkit + remediation.
CVE-2026-63030CRITICALbajo ataque19 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
VulnCheck XDB
local
CVE-2019-2215HIGHbajo ataque19 jul 2026
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
98RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-63030CRITICALbajo ataque19 jul 2026
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-60137MEDIUMbajo ataque19 jul 2026
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
100RIESGO
abrir ↗
← anteriorpágina 34 / 2596siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.