Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.168 exploits
GitHub PoC
krevetkqqq/CVE-2026-82384
Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
48RIESGO
abrir ↗GitHub PoC
CVE-2026-103056 (CVSS 4.0 9.4 Critical) — AiSOC < 12.0.0 OS command injection into CrowdStrike RTR command strings. Verified standalone PoC.
AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR
48RIESGO
abrir ↗GitHub PoC★ 14
You should patch, but not worry about CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
krevetkqqq/CVE-2014-8361
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClien
100RIESGO
abrir ↗GitHub PoC★ 1
CVE 2026 98260 vivo s60 poc
exec: Cleanup POSIX timers right after de_thread()
41RIESGO
abrir ↗GitHub PoC
Authenticated Stored XSS via SafeUrlValidator bypass on the rich-text render path in Spina CMS (<= 2.21.0). Payload executes on the public site. CVE-2026-117182.
An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 all
23RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-103688: Checkout Files Upload for WooCommerce < 2.4.0 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).
Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
48RIESGO
abrir ↗GitHub PoC
Offline Python inventory detector for Oracle Java and GraalVM builds affected by CVE-2026-114820.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE
48RIESGO
abrir ↗GitHub PoC
Offline Python detector for CVE-2026-116165 using Parse Server versions and database backend inventory.
Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
21RIESGO
abrir ↗GitHub PoC
Responsible exposure assessment and version fingerprinting for PHP core vulnerabilities CVE-2026-109618 & CVE-2026-109619 (PHP2Shell) - detection-only, no RCE payload.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Advisory for node-forge ⌯⌲ 53 mill weekly downloads
Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
28RIESGO
abrir ↗GitHub PoC★ 2
Local kernel version checker, remote MPTCP capability probe, and interactive scan-and-probe CLI for assessing exposure to the Linux kernel IPv4 TCP use-after-free (CVSS 9.8).
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
Analisis dan panduan remediasi CVE-2026-98432 untuk Ubuntu 22.04 LTS
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
Source-validated Ubuntu 6.8 backport candidate for Eric Dumazet’s upstream CVE-2026-98432 fix, with provenance and CI. Not yet compiled or boot-tested.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
Trace untrusted OAuth endpoint URLs from source to shell sink — the CVE-2026-119025 attack class, checked in your code, lockfile and MCP configs.
open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows
41RIESGO
abrir ↗GitHub PoC
Un fichier PHP, zéro dépendance : dit si laravel/framework est encore sous le correctif TokenGuard (CVE-2026-114509). Aucun exploit, aucun réseau.
Laravel TokenGuard authentication bypass through non-string API credentials
63RIESGO
abrir ↗GitHub PoC★ 17
Race trigger, heap-reuse oracle, pcap analysis, detection and mitigation tooling for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free).
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC★ 4
CVE-2026-98432 (Linux IPv4 TCP use-after-free): how to check your server, apply a stopgap, and clean up after the fix
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
Read-only, agentless Linux kernel security configuration auditor (local & SSH). Initial focus: TCP migration / MPTCP checks for CVE-2026-98432.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
Check a Linux server for CVE-2026-98432 (IPv4 TCP use-after-free, CVSS 9.8): root cause explained, read-only check script and mitigations.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
Drop incoming IPv4 TCP packets whose IP header contains options.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
Build-time RCE via FeaturedImage path traversal in astro-notion-blog 0.13.0. Allows attackers with Notion edit access to overwrite files and execute commands on the build host. CVE-2026-117183.
A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the
41RIESGO
abrir ↗GitHub PoC★ 51
PoC & panic evidence for CVE-2026-112705: AppleAVE2 kernel OOB write on iOS 27.0.1 (fixed in 27.2) via VideoToolbox NumberOfTemporalLayers. Independent reproduction; original discovery by Calif / Chollima team.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 2
33RIESGO
abrir ↗GitHub PoC
CVE-2026-111497 two-stage Brotli harness: local trigger/error-semantics verification, no exploitation
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗VulnCheck XDB
local
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
76RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.