Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.180exploits catalogados

31.691CVEs con explotación pública

0probados en laboratorio

Todos Exploit-DB 22.469Referência 19.841GitHub PoC 13.140VulnCheck XDB 8078Nuclei 4190Metasploit 3462✓ solo verificadosrecientes populares riesgo

13.116 exploits

GitHub PoC

this little script blocks the new splice-ram-privlilleg ecalation fastly befor the contributers do it ( CVE-2026-31431) (CopyFail fix)

CVE-2026-31431HIGHbajo ataque13 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC

rootdirective-sec/CVE-2026-33626-Lab

CVE-2026-33626HIGH13 may 2026

LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

68RIESGO

abrir ↗

GitHub PoC

bogdanrotariu/cve-2026-29204-whmcs-clientarea-addonid

CVE-2026-29204CRITICAL13 may 2026

Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using anoth

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-44277

CVE-2026-44277CRITICAL13 may 2026

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticat

48RIESGO

abrir ↗

GitHub PoC★ 1

First CTF successfully completed! This repo documents my walkthrough of TryHackMe's Simple CTF. It covers network reconnaissance (Nmap), web exploitation (CVE-2019-9053), and credential cracking. As a dev, it was great to pivot from SQLi to a Root shell by leveraging Sudo misconfigurations. Educational purposes only.

CVE-2019-9053—13 may 2026

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RIESGO

abrir ↗

GitHub PoC★ 254

Full exploit code for CVE-2026-40369 - A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandbox

CVE-2026-40369HIGH13 may 2026

Windows Kernel Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC

SessionReaper-CVE-2025-54236

CVE-2025-54236CRITICALbajo ataque13 may 2026

Adobe Commerce | Improper Input Validation (CWE-20)

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-8196

CVE-2026-8196MEDIUM13 may 2026

JeecgBoot mLogin Endpoint LoginController.java authorization

33RIESGO

abrir ↗

GitHub PoC

A tiny explanation + PoC for CVE-2026-43284

CVE-2026-43284HIGH13 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC

CVE-2026-0001. Do with your own risk

CVE-2026-23760CRITICALbajo ataqueransomware13 may 2026

SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

100RIESGO

abrir ↗

GitHub PoC

pixelotes/lab-cve-2023-4863

CVE-2023-4863HIGHbajo ataque13 may 2026

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to

93RIESGO

abrir ↗

GitHub PoC

copy-fail-CVE-2026-31431

CVE-2026-31431HIGHbajo ataque13 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-41729 PoC

CVE-2026-41729HIGH13 may 2026

Spring Data REST SpEL Injection via Map Key in JSON Patch

41RIESGO

abrir ↗

GitHub PoC★ 3

masjadaan/CVE-2025-29338

CVE-2025-29338MEDIUM13 may 2026

NXP moal.ko Wi-Fi driver 5.1.7.10 FW version from v17.92.1.p149.43 To v17.92.1.p149.157 was discovered to contain a buff

33RIESGO

abrir ↗

GitHub PoC

Controlled reproduction of CVE-2017-0144 (EternalBlue) in an isolated AWS EC2 lab — exploit analysis, Wireshark traffic capture, and MITRE ATT&CK mapping

CVE-2017-0144HIGHbajo ataqueransomware13 may 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

abrir ↗

GitHub PoC

There is a path injection vulnerability in OpenPLC-v3, which arises from the program not performing any validity checks on the file path parameters passed in from the command line. Attackers can read any readable file by constructing malicious paths, posing a risk of information leakage.

CVE-2026-31156MEDIUM13 may 2026

A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program com

33RIESGO

abrir ↗

GitHub PoC

OOB verifier for GHSA-c4j6-fc7j-m34r / CVE-2026-44578 (Next.js WebSocket-upgrade SSRF)

CVE-2026-44578HIGH13 may 2026

Next.js: Server-side request forgery in applications using WebSocket upgrades

68RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-29000 – pac4j-jwt Authentication Bypass (🔥 CVSS 10.0). One-click admin forge via public key JWE wrapping. Leaks configs, users, secrets. Keep-alive, proxy, custom JWKS.⚙️ Educational PoC Exploit tool.

CVE-2026-29000CRITICAL12 may 2026

pac4j-jwt JwtAuthenticator Authentication Bypass

48RIESGO

abrir ↗

GitHub PoC

Semgrep rules that flag header-trust auth bypass patterns (CVE-2025-29927 class). Companion to bk-security.github.io.

CVE-2025-29927CRITICAL12 may 2026

Authorization Bypass in Next.js Middleware

85RIESGO

abrir ↗

GitHub PoC

Are you get Tanstack Supply chain attack attack of 5/11? CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx

CVE-2026-45321CRITICALbajo ataqueransomware12 may 2026

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

78RIESGO

abrir ↗

GitHub PoC

🛡️ One-command scanner for CVE-2026-45321 — TanStack npm supply-chain attack

CVE-2026-45321CRITICALbajo ataqueransomware12 may 2026

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

78RIESGO

abrir ↗

GitHub PoC

y0naldez/CVE-2024-28397-Js2Py-RCE

CVE-2024-28397MEDIUM12 may 2026

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a

48RIESGO

abrir ↗

GitHub PoC

vutiendat323/CVE-2021-44228_Log4Shell

CVE-2021-44228CRITICALbajo ataqueransomware12 may 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

lamaper/CVE-2026-52200

CVE-2026-52200CRITICAL12 may 2026

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax

28RIESGO

abrir ↗

GitHub PoC★ 6

🚀 CVE-2026-41940 cPanel/WHM Auth Bypass Exploit - Best Flow 💥 CRLF injection leads to auth bypass, session hijacking & account leak. ✅ Proxy, custom UA, keep-alive, retries, SSL verify, colored output, file save support. ⚡ Advanced PoC for pentesters.

CVE-2026-41940CRITICALbajo ataqueransomware12 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

GitHub PoC

CVE-2023-4220 — Unauthenticated file upload RCE in Chamilo LMS ≤ 1.11.24. OSCP-style and auto exploit.

CVE-2023-4220HIGH12 may 2026

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RIESGO

abrir ↗

GitHub PoC

cve-2024-21413

CVE-2024-21413CRITICALbajo ataque12 may 2026

Microsoft Outlook Remote Code Execution Vulnerability

100RIESGO

abrir ↗

GitHub PoC★ 1

Claude Code skill to scan machines for Mini Shai-Hulud (CVE-2026-45321) supply chain worm IOCs

CVE-2026-45321CRITICALbajo ataqueransomware12 may 2026

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

78RIESGO

abrir ↗

GitHub PoC

SystemVll/CVE-2026-31431-copyfail-aarch64

CVE-2026-31431HIGHbajo ataque12 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC★ 29

PoC for CVE-2026-3609 - XIGNCODE3 xhunter1.sys handle leak enabling PPL bypass and LSASS dumping

CVE-2026-3609MEDIUM12 may 2026

XIGNCODE3 xhunter1.sys kernel driver contains a Privilege Escalation Vulnerability

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.