Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.180exploits catalogados

31.691CVEs con explotación pública

0probados en laboratorio

Todos Exploit-DB 22.469Referência 19.841GitHub PoC 13.140VulnCheck XDB 8078Nuclei 4190Metasploit 3462✓ solo verificadosrecientes populares riesgo

13.134 exploits

GitHub PoC

Relatório de Análise Técnica: Exploração de Falha de Isolamento no Kernel Linux (CVE-2026-31431)

CVE-2026-31431HIGHbajo ataque11 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC

Proof of concept of CVE-2026-8161 (Multiparty)

CVE-2026-8161HIGH11 may 2026

multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception

21RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-31431 - Linux Kernel Page Cache Vulnerability

CVE-2026-31431HIGHbajo ataque11 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-41940 — cPanel/WHM Auth Bypass By Dr.Anach, CRLF injection in `cpsrvd` Basic auth handler → unauthenticated WHM API access → RCE as root. All cPanel since v11.40 affected.

CVE-2026-41940CRITICALbajo ataqueransomware11 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

GitHub PoC★ 3

Arbitrary command execution on Cockpit

CVE-2026-4802HIGH11 may 2026

Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui

21RIESGO

abrir ↗

GitHub PoC★ 68

EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization.

CVE-2026-34486HIGH11 may 2026

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

61RIESGO

abrir ↗

GitHub PoC

Dirtyfrag CVE-2026-43284 & CVE-2026-43500 Scanner

CVE-2026-43284HIGH11 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC

EspoCRM 9.3.3 - Stored HTML Injection in Email Notifications

CVE-2026-33657MEDIUM11 may 2026

EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field

13RIESGO

abrir ↗

GitHub PoC

Lab testing documentation for CVE-2026-31431 (Copy Fail) Linux kernel LPE

CVE-2026-31431HIGHbajo ataque11 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-42569

CVE-2026-42569CRITICAL11 may 2026

phpvms: /importer authorization bypass causing full database wipe

43RIESGO

abrir ↗

GitHub PoC

CVE-2026-40987 PoC

CVE-2026-40987HIGH11 may 2026

Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

41RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2026-8023: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2026-8023HIGH11 may 2026

Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read

41RIESGO

abrir ↗

GitHub PoC

Copy Fail (CVE-2026-31431)

CVE-2026-31431HIGHbajo ataque11 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-43284 & CVE-2026-43500 discovered by Hyunwoo Kim

CVE-2026-43284HIGH11 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC★ 29

Double-free in Apache httpd mod_http2 stream cleanup leading to pre-auth RCE.

CVE-2026-23918HIGH11 may 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

abrir ↗

GitHub PoC★ 14

CVE-2026-43284/CVE-2026-43500 'DirtyFrag' Benign patch & mitigation detection script

CVE-2026-43284HIGH11 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC★ 1

Exploit for CVE-2026-31431 (Copy Fail)

CVE-2026-31431HIGHbajo ataque11 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC

SSTI contact form to rce

CVE-2026-4257CRITICAL11 may 2026

Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality

75RIESGO

abrir ↗

GitHub PoC

Xmyronn/CVE-2026-10288-AUTH-BYPASS

CVE-2026-10288MEDIUM11 may 2026

code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication

33RIESGO

abrir ↗

GitHub PoC

Xmyronn/CVE-2026-10289-XSS

CVE-2026-10289MEDIUM11 may 2026

code-projects Hotel and Tourism Reservation System tour.php cross site scripting

33RIESGO

abrir ↗

GitHub PoC★ 1

This project is a cybersecurity research and analysis project focused on CVE-2023-38831, a critical WinRAR vulnerability that allows attackers to execute malicious code through specially crafted archive files. The project was conducted in a controlled lab environment for educational and defensive security purposes only.

CVE-2023-38831HIGHbajo ataqueransomware11 may 2026

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RIESGO

abrir ↗

GitHub PoC

Xmyronn/CVE-2026-10290-SQLI

CVE-2026-10290MEDIUM11 may 2026

code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection

33RIESGO

abrir ↗

GitHub PoC

CVE-2026-6274 - Redline WR3200 Broken Authentication

CVE-2026-6274CRITICAL11 may 2026

Authentication Bypass in DTS Electronics' Redline WR3200

28RIESGO

abrir ↗

GitHub PoC

CVE-2026-43284的rust版本实现

CVE-2026-43284HIGH11 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC

Educational Proof of Concept for CVE-2026-31431 / Copy Fail Linux local privilege escalation via AF_ALG algif_aead

CVE-2026-31431HIGHbajo ataque10 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC

A temporary mitigation against copy_fail variant (copyfail2_electric_boogaloo) - Unprivileged Linux LPE via xfrm ESP-in-UDP MSG_SPLICE_PAGES no-COW fast path. Page-cache write into any readable file. Overwrites a nologin line in /etc/passwd with sick::0:0:…:/:/bin/bash and sus into it. Same class as Copy Fail (CVE-2026-31431), different subsystem.

CVE-2026-31431HIGHbajo ataque10 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC

Technical analysis of the LangChain serialization injection vulnerability CVE-2025-68664.

CVE-2025-68664CRITICAL10 may 2026

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

53RIESGO

abrir ↗

GitHub PoC

CVE-2026-20131

CVE-2026-20131CRITICALbajo ataqueransomware10 may 2026

Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability

83RIESGO

abrir ↗

GitHub PoC

kaleth4/CVE-2026-7482

CVE-2026-7482HIGH10 may 2026

Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers

21RIESGO

abrir ↗

GitHub PoC★ 27

arm64/aarch64 port of V4bel/dirtyfrag (CVE-2026-43284). ESP-only - rxrpc path kernel-oopses on arm64 due to flush_dcache_page

CVE-2026-43284HIGH10 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.