Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.402exploits catalogados

39.049CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.184Exploit-DB 24.485GitHub PoC 16.124VulnCheck XDB 9617Nuclei 4473Metasploit 3519✓ solo verificadosrecientes populares riesgo

16.124 exploits

GitHub PoC

For WordPress

CVE-2026-85097CRITICAL14 oct 2026

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-110025: bilingual analysis and safe local PoC for phpwcms unrestricted upload to RCE

CVE-2026-110025MEDIUM13 oct 2026

slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload

30RIESGO

abrir ↗

GitHub PoC

CVE-85884 POC

CVE-2026-85884HIGH13 oct 2026

Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability

38RIESGO

abrir ↗

GitHub PoC

POC EXPLOIT CVE-2026-104711

CVE-2026-104711CRITICAL13 oct 2026

Apache Struts: OGNL injection in the legacy RESTful action mapper

48RIESGO

abrir ↗

GitHub PoC

POC for CVE-2026-104711-Advanced-Variant

CVE-2026-104711CRITICAL13 oct 2026

Apache Struts: OGNL injection in the legacy RESTful action mapper

48RIESGO

abrir ↗

GitHub PoC★ 8

GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image

CVE-2026-97229CRITICAL13 oct 2026

Integer Overflow or Wraparound in GitLab

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE

CVE-2026-97229CRITICAL13 oct 2026

Integer Overflow or Wraparound in GitLab

48RIESGO

abrir ↗

GitHub PoC★ 1

Write-up for CVE-2026-109721

CVE-2026-109721—13 oct 2026

Incorrect boundary conditions in the JavaScript Engine: JIT component

20RIESGO

abrir ↗

GitHub PoC

Unauthenticated remote code execution in Ivanti Connect Secure (CWE-290, CVSS 8.6)

CVE-2026-104935HIGHbajo ataque13 oct 2026

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb

83RIESGO

abrir ↗

GitHub PoC

CVE-2026-108924: didactic PoC for Kirby dynamic option authorization bypass

CVE-2026-108924MEDIUM13 oct 2026

getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization

33RIESGO

abrir ↗

GitHub PoC

Bilingual PoC and technical analysis for CVE-2026-105950 — Formwork formaction URI sanitizer bypass

CVE-2026-105950MEDIUM13 oct 2026

getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

33RIESGO

abrir ↗

GitHub PoC★ 1

POC for CVE-2026-104711 - New

CVE-2026-104711CRITICAL13 oct 2026

Apache Struts: OGNL injection in the legacy RESTful action mapper

48RIESGO

abrir ↗

GitHub PoC

anaskalt/CVE-2026-104944

CVE-2026-104944HIGH13 oct 2026

Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500

41RIESGO

abrir ↗

GitHub PoC

anaskalt/CVE-2026-104945

CVE-2026-104945MEDIUM13 oct 2026

Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500

33RIESGO

abrir ↗

GitHub PoC★ 1

Command execution and patch bypass of CVE-2026-28291 in git-js.

CVE-2026-102827HIGH13 oct 2026

simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

41RIESGO

abrir ↗

GitHub PoC

MiniUPnPd <= 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header

CVE-2026-107159HIGH13 oct 2026

MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header

41RIESGO

abrir ↗

GitHub PoC★ 1

Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length.

CVE-2026-102718HIGH13 oct 2026

hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length agains

41RIESGO

abrir ↗

GitHub PoC

Exploits CVE-2026-58222 to recover Samba KDS root keys and derive gMSA credentials from a low-privilege domain account.

CVE-2026-58222HIGH13 oct 2026

Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes

41RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2026-68582 / GHSA-rj9j-8772-4h6c — Vikunja link-share BOLA

CVE-2026-68582CRITICAL13 oct 2026

Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

48RIESGO

abrir ↗

GitHub PoC★ 1

POC CVE-2026-85097

CVE-2026-85097CRITICAL13 oct 2026

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-72898 Metabase Security Tools

CVE-2026-72898CRITICALbajo ataque13 oct 2026

Metabase SQL injection via password reset endpoint

98RIESGO

abrir ↗

GitHub PoC

SSRF in Hyperledger FireFly Webhook Subscriptions (CVE-2026-82957)

CVE-2026-82957MEDIUM13 oct 2026

hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery

33RIESGO

abrir ↗

GitHub PoC

CVE-2026-107181 Proof Of Concept for telegram Desktop account take over in windows

CVE-2026-107181HIGH13 oct 2026

Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

41RIESGO

abrir ↗

GitHub PoC

POC for the CVE-2026-104711

CVE-2026-104711CRITICAL13 oct 2026

Apache Struts: OGNL injection in the legacy RESTful action mapper

48RIESGO

abrir ↗

GitHub PoC

MikroTikDojo/CVE-2026-84411

CVE-2026-84411CRITICAL13 oct 2026

MikroTik RouterOS Integer Underflow

48RIESGO

abrir ↗

GitHub PoC

PoCs for CVE-2026-102262 & CVE-2026-101893 — code execution and XXE in DYMO ID (reported & fixed)

CVE-2026-102262HIGH13 oct 2026

Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-76268 PoC: Splunk Enterprise SHC Patroni REST unauth RCE — PATCH /config archive_command + POST /restart. Check + mass exploit, OOB POCBIT-76268-OK, CVSS 9.8. https://pocbit.org/pocs/cve-2026-76268

CVE-2026-76268CRITICAL13 oct 2026

Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise

48RIESGO

abrir ↗

GitHub PoC★ 6

CVE-2026-85097 – Bricksforge WordPress Plugin Unauth File Upload to RCE Toolkit (CVSS 10.0) | Red/Blue Team suite for Bricksforge Pro Forms < 3.1.8.9. 2 tools: Full Exploit (polyglot upload, web shell, mass scan, OPSEC, SQLite/JSON output) + SafeChecker (version detect, non-intrusive audit). Ethical & educational use only.

CVE-2026-85097CRITICAL12 oct 2026

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-91136 Divi Plus <= 2.4.0 unauthenticated arbitrary file read (mass scanner + exploit)

CVE-2026-91136HIGH12 oct 2026

Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter

56RIESGO

abrir ↗

GitHub PoC

0xCyp1337/CVE-2026-63030-CVE-2026-60137-WP2SHELL

CVE-2026-63030CRITICALbajo ataque12 oct 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.