Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
78.329exploits catalogados
36.057CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.721GitHub PoC 14.482VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientespopularesriesgo
14.482 exploits
GitHub PoC★ 2
Learn how I found my first two CVEs by pure accident.
Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service
33RIESGO
abrir ↗GitHub PoC
joaovicdev/EXPLOIT-CVE-2026-9198
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
100RIESGO
abrir ↗GitHub PoC
Static XML fixtures for authorized bug bounty testing of XML parser behaviour (CVE-2026-45071).
Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
41RIESGO
abrir ↗GitHub PoC
FranklinF25/cve-2026-42533
NGINX Map directive and Regex matching vulnerability
48RIESGO
abrir ↗GitHub PoC
CVE-2026-66384 - Draft or TODO
Authenticated users may write data outside the intended Docker cache path
33RIESGO
abrir ↗GitHub PoC
Wazuh Rules for Detection Zimbra (CVE-2026-73570).
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
91RIESGO
abrir ↗GitHub PoC
A specialized Python framework that executes unauthenticated remote code execution via the 9Router Model Context Protocol (MCP) bridge by deploying a 33-layer temporal phase cascade, Riemann-Hadamard dispersion, and an 11 ns wedge filter to bypass traditional proxy and process-monitoring defenses.
9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
63RIESGO
abrir ↗GitHub PoC
Testing CVE-2026-70463 by Fyyre
rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing
41RIESGO
abrir ↗GitHub PoC
Hari-v542/CVE-2026-52923
ipc: limit next_id allocation to the valid ID range
41RIESGO
abrir ↗GitHub PoC
IKEv1 VPN scanners, attempts a Check Point authentication-bypass exploit, and includes internal network scanning and reverse-shell features.
User Authentication Bypass in VPN Remote Access and Mobile Access
100RIESGO
abrir ↗GitHub PoC★ 3
GitLab Code injection
Improper Control of Generation of Code ('Code Injection') in GitLab
63RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detector
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RIESGO
abrir ↗GitHub PoC
sahmsec/CVE-2026-32475
WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
63RIESGO
abrir ↗GitHub PoC
Hunt-Benito/the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass
phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache
48RIESGO
abrir ↗GitHub PoC
CVE-2026-55040
Microsoft SharePoint Server Security Feature Bypass Vulnerability
100RIESGO
abrir ↗GitHub PoC
SneakyNachos/CVE-2026-74936-gc-potato
Use-after-free in the JavaScript: WebAssembly component
48RIESGO
abrir ↗GitHub PoC
A scanner for CVE-2026-55040 and CVE-2026-63520, designed to determine whether the server is affected by these two CVEs.
Microsoft SharePoint Server Security Feature Bypass Vulnerability
100RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-18431 - Draft or TODO
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
48RIESGO
abrir ↗GitHub PoC
CVE-2026-20303, CVE-2026-20304, CVE-2026-20310, CVE-2026-20312, CVE-2026-20313
Cisco Catalyst SD-WAN Security Hardening Release - Input Validation Vulnerabilities
48RIESGO
abrir ↗GitHub PoC
Minimal reproduction for Spring AI ParagraphManager sibling self-loop OOM (incomplete fix of CVE-2026-47851)
Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
41RIESGO
abrir ↗GitHub PoC
CVE-2026-77542, CVE-2026-77543, CVE-2026-77545, CVE-2026-77550, CVE-2026-77551, CVE-2026-77552, CVE-2026-77553, CVE-2026-77554, CVE-2026-77557 - Draft or TODO
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit
48RIESGO
abrir ↗GitHub PoC
PostGIS SQL Injection GeoTools
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
63RIESGO
abrir ↗GitHub PoC★ 4
Zimbra SNMP Notification OS Command Injection — Unauthenticated RCE via SMTP exploit (Poc)
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
91RIESGO
abrir ↗GitHub PoC
Poc CVE-2026-18080
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment
48RIESGO
abrir ↗GitHub PoC
sergiofigueras/cve-2026-46858
Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager (component: JADM, JVM
48RIESGO
abrir ↗GitHub PoC
zenzue/CVE-2026-55040
Microsoft SharePoint Server Security Feature Bypass Vulnerability
100RIESGO
abrir ↗GitHub PoC
Check for CVE-2026-79266. A use-after-free in the DevTools component allows arbitrary code execution inside the sandbox via a malicious Chrome extension leveraging social engineering.
Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeri
41RIESGO
abrir ↗página 1 / 483siguiente →
Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.