Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados
39.531CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientespopularesriesgo
4478 exploits
Nucleicritical
Cisco Secure Firewall Management Center - Authentication Bypass
CVE-2026-20079CRITICALbajo ataque
Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
100RIESGO
abrir ↗
Nucleihigh
Mail Mint < 1.19.5 - Unauthenticated Email Disclosure
CVE-2026-2025HIGH
Mail Mint < 1.19.5 - Unauthenticated Emails Disclosure
36RIESGO
abrir ↗
Nucleicritical
Splunk Enterprise & Cloud Platform - Unrestricted File Upload
CVE-2026-20253CRITICALbajo ataque
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
100RIESGO
abrir ↗
Nucleicritical
Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass
CVE-2026-20896CRITICAL
Gitea Docker image trusts spoofable reverse-proxy headers by default
63RIESGO
abrir ↗
Nucleicritical
tpadmin <= 1.3.12 - Remote Code Execution
CVE-2026-2113MEDIUM
yuan1994 tpadmin WebUploader preview.php deserialization
28RIESGO
abrir ↗
Nucleicritical
Langflow - Broken Access Control
CVE-2026-21445HIGH
Langflow Missing Authentication on Critical API Endpoints
48RIESGO
abrir ↗
Nucleimedium
AnythingLLM - Username Enumeration via Password Recovery
CVE-2026-21484MEDIUM
AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery
28RIESGO
abrir ↗
Nucleicritical
Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read
CVE-2026-21589CRITICALbajo ataque
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
98RIESGO
abrir ↗
Nucleicritical
Fortinet FortiClientEMS 7.4.4 - SQL Injection
CVE-2026-21643CRITICALbajo ataque
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiC
100RIESGO
abrir ↗
Nucleicritical
n8n Webhooks - Remote Code Execution
CVE-2026-21858CRITICAL
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
85RIESGO
abrir ↗
Nucleihigh
Mailpit < 1.28.3 - Server-Side Request Forgery
CVE-2026-21859MEDIUM
Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)
28RIESGO
abrir ↗
Nucleicritical
ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection
CVE-2026-21875CRITICAL
ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments
43RIESGO
abrir ↗
Nucleicritical
n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution
CVE-2026-21877CRITICAL
n8n is vulnerable to Remote Code Execution via Arbitrary File Write
43RIESGO
abrir ↗
Nucleicritical
ZimaOS - Authentication Bypass
CVE-2026-21891CRITICAL
ZimaOS has Authentication Bypass via System-Level Username
43RIESGO
abrir ↗
Nucleihigh
osTicket - Arbitrary File Read
CVE-2026-22200HIGH
osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read
58RIESGO
abrir ↗
Nucleicritical
UniFi Network Application - Path Traversal
CVE-2026-22557CRITICAL
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network App
68RIESGO
abrir ↗
Nucleihigh
Easy Appointments <= 3.12.21 - Information Disclosure
CVE-2026-2262HIGH
Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API
36RIESGO
abrir ↗
Nucleihigh
Windmill < 1.603.3 - Operator Authorization Bypass
CVE-2026-22683HIGH
Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
56RIESGO
abrir ↗
Nucleihigh
Spring Cloud Config Server - Path Traversal
CVE-2026-22739HIGH
Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
36RIESGO
abrir ↗
Nucleicritical
vLLM 0.8.3 - 0.14.0 - Information Disclosure
CVE-2026-22778CRITICAL
vLLM leaks a heap address when PIL throws an error
48RIESGO
abrir ↗
Nucleihigh
OpenCode < 1.0.216 - Unauthenticated Remote Code Execution
CVE-2026-22812HIGH
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
41RIESGO
abrir ↗
Nucleihigh
Blinko < 1.8.4 - Path Traversal
CVE-2026-23482HIGH
Blinko: Unauthorized Arbitrary File Read - /api/file/temp
36RIESGO
abrir ↗
Nucleimedium
Blinko <= 1.8.3 - Path Traversal via /plugins
CVE-2026-23483MEDIUM
Blinko: Unauthorized Arbitrary File Read - /plugins
28RIESGO
abrir ↗
Nucleilow
Blinko <= 1.8.3 - User Information Leak
CVE-2026-23486MEDIUM
Blinko: Unauthorized User Information Leak
28RIESGO
abrir ↗
Nucleihigh
InvoicePlane <= 1.6.3 - Arbitrary File Read
CVE-2026-23491CRITICAL
InvoicePlane has Unauthenticated Path Traversal in Guest Controller
43RIESGO
abrir ↗
Nucleihigh
Feast Feature Server <=0.58.0 - Arbitrary File Read
CVE-2026-23536HIGH
Feast: unauthenticated arbitrary file read
36RIESGO
abrir ↗
Nucleihigh
Modular DS - Broken Access Control
CVE-2026-23550CRITICAL
WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability
68RIESGO
abrir ↗
Nucleihigh
ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy
CVE-2026-23693CRITICAL
ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint
43RIESGO
abrir ↗
Nucleicritical
Windmill < 1.603.3 - SQL Injection
CVE-2026-23696CRITICAL
Windmill < 1.603.3 File Ownership Handling SQLi RCE
68RIESGO
abrir ↗
Nucleicritical
MCPJam Inspector - Remote Code Execution
CVE-2026-23744CRITICAL
REC in MCPJam inspector due to HTTP Endpoint exposes
75RIESGO
abrir ↗
← anteriorpágina 102 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.