Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.062exploits catalogados

31.617CVEs con explotación pública

0probados en laboratorio

Todos Exploit-DB 22.467Referência 19.791GitHub PoC 13.086VulnCheck XDB 8069Nuclei 4187Metasploit 3462✓ solo verificadosrecientes populares riesgo

71.062 exploits

GitHub PoC

Gorse < 0.5.10 contains an authentication bypass caused by empty admin_api_key in /api/dump and /api/restore endpoints, letting unauthenticated remote attackers access and modify protected data, exploit requires default empty admin_api_key configuration.

CVE-2026-56782CRITICAL02 jul 2026

Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints

63RIESGO

GitHub PoC

Gogs has Path Traversal in organization name that results in RCE through Git hooks

CVE-2026-52813CRITICAL02 jul 2026

Gogs: Path Traversal in organization name results in RCE through Git hooks

48RIESGO

VulnCheck XDB

initial-access

CVE-2021-27877HIGHbajo ataqueransomware02 jul 2026

An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authenticat

98RIESGO

GitHub PoC

DESIGN AND IMPLEMENTATION OF A VULNERABILITY SCANNER FOR CVE-2026-45498 IN MICROSOFT DEFENDER

CVE-2026-45498MEDIUMbajo ataque02 jul 2026

Microsoft Defender Denial of Service Vulnerability

75RIESGO

GitHub PoC

This repository contains a proof-of-concept (PoC) exploit for CVE-2026-38751, affecting OpenSTAManager ≤ 2.10. The vulnerability allows an authenticated attacker to upload a malicious module via the module update functionality, leading to arbitrary file upload and remote code execution (RCE).

CVE-2026-38751HIGH02 jul 2026

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionali

41RIESGO

VulnCheck XDB

initial-access

CVE-2026-48558CRITICAL02 jul 2026

SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

48RIESGO

GitHub PoC

BastianXploited/CVE-2026-0740-mass

CVE-2026-0740CRITICAL02 jul 2026

Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

75RIESGO

VulnCheck XDB

remote-with-credentials

CVE-2026-52813CRITICAL02 jul 2026

Gogs: Path Traversal in organization name results in RCE through Git hooks

48RIESGO

GitHub PoC★ 6

SimpleHelp OIDC Authentication Bypass PoC

CVE-2026-48558CRITICAL02 jul 2026

SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

48RIESGO

VulnCheck XDB

initial-access

CVE-2025-57819CRITICALbajo ataque02 jul 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RIESGO

GitHub PoC★ 1

Proof of concept for CVE-2026-36027 and CVE-2026-36028

CVE-2026-36027MEDIUM02 jul 2026

An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via

33RIESGO

GitHub PoC

do4choo/CVE-2026-53694-NoMachine-LPE

CVE-2026-53694HIGH01 jul 2026

Potential local privileges escalation through argument injection in the nxchmod.sh script

41RIESGO

GitHub PoC

Pivotal CRM's patch for an initial deserialization vulnerability was incomplete. The fix switched from BinaryFormatter to JSON.NET but left TypeNameHandling set to 4 without implementing SerializationBinder, allowing attackers to execute arbitrary code through malicious $type payloads. Fixed in 6.6.5.10 and Patch_CWE502_20260316.zip

CVE-2026-51947CRITICAL01 jul 2026

An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 a

48RIESGO

GitHub PoC

rootdirective-sec/CVE-2026-56011-Lab

CVE-2026-56011HIGH01 jul 2026

WordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerability

41RIESGO

GitHub PoC

motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read

CVE-2026-55488HIGH01 jul 2026

motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read

41RIESGO

GitHub PoC

CVE-2026-48907 PoC

CVE-2026-48907CRITICALbajo ataque01 jul 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-10520CRITICAL01 jul 2026

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote

85RIESGO

GitHub PoC

OpenSTAManager RCE Exploit (CVE-2026-38751)

CVE-2026-38751HIGH01 jul 2026

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionali

41RIESGO

VulnCheck XDB

initial-access

CVE-2025-57819CRITICALbajo ataque01 jul 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RIESGO

GitHub PoC★ 48

Google Chrome CVE-2026-6307 PoC

CVE-2026-6307HIGH01 jul 2026

Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code

41RIESGO

GitHub PoC★ 8

CVE-2026-6307 PoC: Longinus - 2 Boundaries in One Bug https://nebusec.ai/research/v8-cve-2026-6307-writeup/)

CVE-2026-6307HIGH01 jul 2026

Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code

41RIESGO

GitHub PoC

pedit COW

CVE-2026-46331HIGH01 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

GitHub PoC

emilliewatson96/spryCVE-2026-10520

CVE-2026-10520CRITICAL01 jul 2026

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote

85RIESGO

VulnCheck XDB

denial-of-service

CVE-2026-42945CRITICAL01 jul 2026

NGINX ngx_http_rewrite_module vulnerability

60RIESGO

VulnCheck XDB

client-side

CVE-2026-56011HIGH01 jul 2026

WordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerability

41RIESGO

GitHub PoC

Safari 跨域信息读取

CVE-2026-43735HIGH01 jul 2026

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS

41RIESGO

GitHub PoC

A flaw was found in NGINX, specifically within the ngx_http_rewrite_module. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests under specific rewrite configurations. This can lead to a heap buffer overflow in the NGINX worker process, which may result in arbitrary code execution

CVE-2026-42945CRITICAL01 jul 2026

NGINX ngx_http_rewrite_module vulnerability

60RIESGO

VulnCheck XDB

initial-access

CVE-2020-5902CRITICALbajo ataqueransomware01 jul 2026

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RIESGO

VulnCheck XDB

local

CVE-2019-2215HIGHbajo ataque30 jun 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RIESGO

VulnCheck XDB

initial-access

CVE-2012-1823CRITICALbajo ataque30 jun 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.