Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.062exploits catalogados

31.617CVEs con explotación pública

0probados en laboratorio

Todos Exploit-DB 22.467Referência 19.791GitHub PoC 13.086VulnCheck XDB 8069Nuclei 4187Metasploit 3462✓ solo verificadosrecientes populares riesgo

71.062 exploits

GitHub PoC★ 2

IOCs and a read-only triage checklist from a real Linux root compromise: RedTail miner, XorDDoS persistence, MoneroOcean miner, DirtyFrag LPE (CVE-2026-43284/43500). CC0.

CVE-2026-43284HIGH07 jul 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

GitHub PoC

Bypass Authentication

CVE-2026-48611CRITICAL07 jul 2026

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or

63RIESGO

GitHub PoC

PoC for CVE-2026-54350 — Budibase unauthenticated NoSQL operator injection (CVSS 10.0). Read/mass-write any document collection via a PUBLIC query.

CVE-2026-54350CRITICAL07 jul 2026

Budibase: Anonymous NoSQL operator injection via published-app query templates

48RIESGO

GitHub PoC

CVE-2026-14191 - Draft

CVE-2026-14191HIGH07 jul 2026

WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader

41RIESGO

GitHub PoC

🐳 docker-compose 를 활용한 취약한 환경 구성 및 검증 (vulhub 한글판)

CVE-2026-40519HIGH07 jul 2026

Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()

21RIESGO

GitHub PoC★ 2

CVE-2026-48908 — PoC exploit for unauthenticated RCE in SP Page Builder (Joomla) via arbitrary file upload. Multi‑threaded, case‑bypass, shell verification. For authorized security testing only.

CVE-2026-48908CRITICAL07 jul 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

48RIESGO

GitHub PoC

Reproducer for CVE-2026-27172: Apache Camel camel-consul ConsulRegistry Java deserialization (RCE)

CVE-2026-27172HIGH06 jul 2026

Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

41RIESGO

GitHub PoC

Reproducer for CVE-2026-33453: Apache Camel camel-coap header injection to RCE via camel-exec

CVE-2026-33453CRITICAL06 jul 2026

Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution

63RIESGO

GitHub PoC★ 1

Reproducer for CVE-2026-33454: Apache Camel camel-mail header injection to RCE via camel-exec

CVE-2026-33454CRITICAL06 jul 2026

Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)

48RIESGO

GitHub PoC

Exploitability PoC for CVE-2026-49352 (9router Hardcoded JWT Secret Authentication Bypass)

CVE-2026-49352CRITICAL06 jul 2026

9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

45RIESGO

Exploit-DB

Joomla Extension 4.1.4 - PHP Object injection

CVE-2026-48909CRITICALwebappsphp06 jul 2026

Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4

48RIESGO

Exploit-DB

MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation

CVE-2026-36213HIGHlocalwindows06 jul 2026

An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.e

41RIESGO

Exploit-DB

KeepInMind 0.8.4.2 - Stored XSS

CVE-2026-9271MEDIUMwebappsmultiple06 jul 2026

KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS

33RIESGO

Exploit-DB

WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)

CVE-2026-49069HIGHwebappsmultiple06 jul 2026

WordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerability

41RIESGO

GitHub PoC

Exploit for Authenticated Remote Code Execution (RCE) in Krayin CRM v2.2.x (CVE-2026-38526)

CVE-2026-38526CRITICAL06 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

GitHub PoC

HTB_Nexus Penetration Test Report – Comprehensive security assessment documenting credential leakage from Gitea, CVE-2026-38526 exploitation in Krayin CRM, and privilege escalation via Gitea template sync directory traversal. Mapped to MITRE ATT&CK and NSA D3FEND frameworks with actionable remediation roadmap and full evidence appendix.

CVE-2026-38526CRITICAL06 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

GitHub PoC

OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value.

CVE-2026-25555CRITICAL06 jul 2026

OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header

63RIESGO

GitHub PoC

Rust-based DLL hijacking loader for MobaXterm (CVE-2026-6421) with persistence

CVE-2026-6421HIGH06 jul 2026

Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path

41RIESGO

GitHub PoC

AF_ALG/splice 기반 Linux Page Cache 변조 취약점 분석 및 대응 실습

CVE-2026-31431HIGHbajo ataque06 jul 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

GitHub PoC★ 20

imbas007/CVE-2026-48282

CVE-2026-48282CRITICAL06 jul 2026

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

68RIESGO

GitHub PoC

HTB "Abducted" write-up. Exploit CVE-2026-4480 (Samba RCE) → SMB wide links → systemd → root. Full methodology and flags.

CVE-2026-4480CRITICAL06 jul 2026

Samba: samba: remote code execution in printing subsystem via unescaped job description

68RIESGO

Exploit-DB

Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass

CVE-2026-44225CRITICALwebappsmultiple06 jul 2026

Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files

48RIESGO

VulnCheck XDB

initial-access

CVE-2026-0920CRITICAL06 jul 2026

LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter

48RIESGO

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALbajo ataqueransomware06 jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

Reproducer for CVE-2026-40022: Apache Camel camel-platform-http-main authentication bypass on non-root context paths

CVE-2026-40022HIGH06 jul 2026

Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime

41RIESGO

GitHub PoC★ 6

jaf0rk/CVE-2026-14382

CVE-2026-14382CRITICAL06 jul 2026

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to

48RIESGO

VulnCheck XDB

initial-access

CVE-2025-54236CRITICALbajo ataque06 jul 2026

Adobe Commerce | Improper Input Validation (CWE-20)

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALbajo ataque06 jul 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC★ 1

QNAP password reset URL injection writeup + PoC.

CVE-2025-59382LOW05 jul 2026

QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)

28RIESGO

GitHub PoC★ 2

Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated Stored Cross-Site Scripting Proof of Concept

CVE-2026-10104MEDIUM05 jul 2026

Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter

33RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.