Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.836exploits catalogados

32.133CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8156Nuclei 4201Metasploit 3462✓ solo verificadosrecientes populares riesgo

71.836 exploits

VulnCheck XDB

denial-of-service

CVE-2026-42945CRITICAL12 may 2026

NGINX ngx_http_rewrite_module vulnerability

60RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-5718HIGH12 may 2026

Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass

56RIESGO

abrir ↗

GitHub PoC

sh4den/CVE-2026-31431-copyfail-aarch64

CVE-2026-31431HIGHbajo ataque12 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC

y0naldez/CVE-2024-28397-Js2Py-RCE

CVE-2024-28397MEDIUM12 may 2026

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a

48RIESGO

abrir ↗

GitHub PoC

Cybersecurity demo exploiting CVE-2026-35455 with automatic API key generation and exfiltration

CVE-2026-35455HIGH12 may 2026

immich has Stored XSS via OCR Text in 360° Panorama Viewer

41RIESGO

abrir ↗

GitHub PoC

Detects CVE-2026-45321 (TanStack supply chain compromise) and Mini Shai-Hulud worm artifacts. Scans node_modules, lockfiles, persistence hooks (Claude Code, VS Code, systemd, LaunchAgent), GitHub workflows, git history, C2 domains, and AI tool configs.

CVE-2026-45321CRITICALbajo ataqueransomware12 may 2026

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

78RIESGO

abrir ↗

GitHub PoC★ 6

🚀 CVE-2026-41940 cPanel/WHM Auth Bypass Exploit - Best Flow 💥 CRLF injection leads to auth bypass, session hijacking & account leak. ✅ Proxy, custom UA, keep-alive, retries, SSL verify, colored output, file save support. ⚡ Advanced PoC for pentesters.

CVE-2026-41940CRITICALbajo ataqueransomware12 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

GitHub PoC★ 2

Dead.Letter CVE-2026-45185 EXIM Vulnerability Detection Script

CVE-2026-45185CRITICAL12 may 2026

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing p

48RIESGO

abrir ↗

GitHub PoC

vutiendat323/CVE-2021-44228_Log4Shell

CVE-2021-44228CRITICALbajo ataqueransomware12 may 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

VulnCheck XDB

local

CVE-2026-31431HIGHbajo ataque12 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC★ 1

Detect CVE-2026-45321 Mini Shai-Hulud supply chain compromise — scans for 170 npm + 2 PyPI poisoned packages across TanStack, Mistral AI, UiPath, OpenSearch, Guardrails AI

CVE-2026-45321CRITICALbajo ataqueransomware12 may 2026

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

78RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2023-4220HIGH12 may 2026

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RIESGO

abrir ↗

VulnCheck XDB

client-side

CVE-2026-34621HIGHbajo ataque12 may 2026

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

71RIESGO

abrir ↗

GitHub PoC★ 20

azefzafyoussef/CVE-2026-34621

CVE-2026-34621HIGHbajo ataque12 may 2026

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

71RIESGO

abrir ↗

GitHub PoC

EspoCRM 9.3.3 - Stored HTML Injection in Email Notifications

CVE-2026-33657MEDIUM11 may 2026

EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field

13RIESGO

abrir ↗

GitHub PoC★ 3

Arbitrary command execution on Cockpit

CVE-2026-4802HIGH11 may 2026

Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui

21RIESGO

abrir ↗

GitHub PoC

CVE-2026-6274 - Redline WR3200 Broken Authentication

CVE-2026-6274CRITICAL11 may 2026

Authentication Bypass in DTS Electronics' Redline WR3200

28RIESGO

abrir ↗

GitHub PoC★ 68

EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization.

CVE-2026-34486HIGH11 may 2026

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

61RIESGO

abrir ↗

GitHub PoC

SSTI contact form to rce

CVE-2026-4257CRITICAL11 may 2026

Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality

75RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-31431 - Linux Kernel Page Cache Vulnerability

CVE-2026-31431HIGHbajo ataque11 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC

Relatório de Análise Técnica: Exploração de Falha de Isolamento no Kernel Linux (CVE-2026-31431)

CVE-2026-31431HIGHbajo ataque11 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC

Xmyronn/CVE-2026-10288-AUTH-BYPASS

CVE-2026-10288MEDIUM11 may 2026

code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication

33RIESGO

abrir ↗

GitHub PoC

Xmyronn/CVE-2026-10290-SQLI

CVE-2026-10290MEDIUM11 may 2026

code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection

33RIESGO

abrir ↗

GitHub PoC

Xmyronn/CVE-2026-10289-XSS

CVE-2026-10289MEDIUM11 may 2026

code-projects Hotel and Tourism Reservation System tour.php cross site scripting

33RIESGO

abrir ↗

GitHub PoC

CVE-2026-41940 — cPanel/WHM Auth Bypass By Dr.Anach, CRLF injection in `cpsrvd` Basic auth handler → unauthenticated WHM API access → RCE as root. All cPanel since v11.40 affected.

CVE-2026-41940CRITICALbajo ataqueransomware11 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-54068CRITICALbajo ataque11 may 2026

Livewire vulnerable to remote command execution during property update hydration

100RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2026-8023: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2026-8023HIGH11 may 2026

Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read

41RIESGO

abrir ↗

GitHub PoC

Copy Fail (CVE-2026-31431)

CVE-2026-31431HIGHbajo ataque11 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC★ 1

This project is a cybersecurity research and analysis project focused on CVE-2023-38831, a critical WinRAR vulnerability that allows attackers to execute malicious code through specially crafted archive files. The project was conducted in a controlled lab environment for educational and defensive security purposes only.

CVE-2023-38831HIGHbajo ataqueransomware11 may 2026

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RIESGO

abrir ↗

GitHub PoC★ 1

Exploit for CVE-2026-31431 (Copy Fail)

CVE-2026-31431HIGHbajo ataque11 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.