Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.054exploits catalogados

40.803CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.349VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

88.054 exploits

VulnCheck XDB

info-leak

CVE-2026-21589CRITICALbajo ataque07 oct 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RIESGO

abrir ↗

GitHub PoC

Case study: Label Studio CVE-2022-36551 (task-import URL opened with urlopen). Demo only, not for use.

CVE-2022-36551—07 oct 2026

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.

23RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-10520CRITICALbajo ataque07 oct 2026

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote

100RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-21589CRITICALbajo ataque07 oct 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-23744CRITICAL07 oct 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

GitHub PoC

Atlassian Arbitrary File Read

CVE-2026-21589CRITICALbajo ataque07 oct 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2025-29927CRITICAL07 oct 2026

Authorization Bypass in Next.js Middleware

85RIESGO

abrir ↗

GitHub PoC★ 1

Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN

CVE-2026-85102CRITICALbajo ataque07 oct 2026

Improper Certificate Validation in Quantum Security Gateway

90RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-21589CRITICALbajo ataque06 oct 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-59265

CVE-2026-59265HIGH06 oct 2026

Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover

41RIESGO

abrir ↗

GitHub PoC

beyavuz/cve-2026-105080-poc

CVE-2026-105080CRITICAL06 oct 2026

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-conve

48RIESGO

abrir ↗

GitHub PoC★ 11

CVE-2026-21589 - Atlassian Data Center Unauth Arbitrary File Read (CVSS 9.3). Red/Blue Team suite with 2 tools: Full Exploit (path traversal, WEB-INF read, interactive shell, 8 products, mass scan, SOCKS5/Tor, stealth) and SafeChecker (non-intrusive version audit, WAF detection, IoC guidance, JSON/CSV/JSONL reports). Use Ethically, Stay Legal.

CVE-2026-21589CRITICALbajo ataque06 oct 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2026-67401 — cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE. Includes a self-contained vulnerable lab, SQLi detection, and full exploit chain.

CVE-2026-67401CRITICAL06 oct 2026

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr

48RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-21589CRITICALbajo ataque06 oct 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2025-55182

CVE-2025-55182CRITICALbajo ataqueransomware06 oct 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC★ 15

watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589

CVE-2026-21589CRITICALbajo ataque06 oct 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RIESGO

abrir ↗

GitHub PoC

Python 3 reverse-shell exploit for Zenphoto <= 1.4.1.4 / CVE-2011-4825 (EDB-18083)

CVE-2011-4825—06 oct 2026

Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinym

50RIESGO

abrir ↗

GitHub PoC

Penetration test for Metasploitable 2 — Samba 3.0.20 Username Map Script (CVE-2007-2447)

CVE-2007-2447—06 oct 2026

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-57967 PoC — Apache ActiveMQ Artemis unauthenticated session hijacking via SESSION_REATTACH (2.50.0–2.56.0)

CVE-2026-57967CRITICAL06 oct 2026

Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

48RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-96940

CVE-2026-96940HIGH06 oct 2026

Microsoft Exchange Server Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC★ 1

0xCyp1337/CVE-2026-10196

CVE-2026-10196CRITICAL06 oct 2026

Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields

48RIESGO

abrir ↗

GitHub PoC

CVE-2025-55182 "Ghost Action" — pre-auth RCE (React Flight deserialization, Next.js 15.5.6) CTF challenge. Problem only; solve/writeup excluded.

CVE-2025-55182CRITICALbajo ataqueransomware06 oct 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC★ 1

PHP Object Injection -> Arbitrary File Deletion in FacturaScripts <= 2026.66 (CWE-502). PoC + advisory.

CVE-2026-104905MEDIUM06 oct 2026

FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

33RIESGO

abrir ↗

GitHub PoC

One-day analysis + sanitizer PoC of CVE-2026-43805 (IOKit IODMACommand DriverKit RPC race, CWE-362)

CVE-2026-43805CRITICAL06 oct 2026

A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequ

48RIESGO

abrir ↗

GitHub PoC★ 6

Zammad Session Leak to Remote Code Execution

CVE-2026-102489HIGHbajo ataque06 oct 2026

Undisclosed RCE in Zammad v6.3 and higher

83RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-102489HIGHbajo ataque06 oct 2026

Undisclosed RCE in Zammad v6.3 and higher

83RIESGO

abrir ↗

GitHub PoC

Technical advisory and proof of concept for CVE-2026-97286 in the WordPress Strong Testimonials plugin

CVE-2026-97286MEDIUM06 oct 2026

WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability

33RIESGO

abrir ↗

GitHub PoC

CVE-2026-63277,

CVE-2026-63277HIGH06 oct 2026

RCE via calcext:data-mappings, sql provider and jdbc connector

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-105221 - gist RubyGem - High - MITM - GitHub OAuth token theft

CVE-2026-105221CRITICAL06 oct 2026

Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

48RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-42013CRITICALbajo ataqueransomware06 oct 2026

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.