Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

88.056 exploits

VulnCheck XDB

initial-access

CVE-2026-87902HIGHbajo ataque29 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-59310CRITICALbajo ataqueransomware29 sep 2026

vCenter directory-traversal vulnerability

90RIESGO

abrir ↗

GitHub PoC

CVE-2026-85520 PoC (PoCbit) — PrestaShop MyPresta gmfeed ≤2.3.9 unauthenticated arbitrary file write via feed.php (Save to file URL) → RCE. check + exploit + mass bulk (--list -j). https://pocbit.org/pocs/cve-2026-85520

CVE-2026-85520CRITICAL29 sep 2026

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

48RIESGO

abrir ↗

GitHub PoC

kiyingiericmark-wq/CVE-2020-24186

CVE-2020-24186CRITICAL29 sep 2026

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo

85RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-49869CRITICALbajo ataque29 sep 2026

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

78RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-63030CRITICALbajo ataque29 sep 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

abrir ↗

GitHub PoC★ 1

container escape POCs for CVE-2026-80521 and CVE-2026-52910

CVE-2026-80521HIGH29 sep 2026

af_unix: Unlink scc_entry in unix_del_edge().

41RIESGO

abrir ↗

GitHub PoC

Published SiYuan CVE · Reporter: dpfkdlemtp · Official record and advisory links

CVE-2026-100633HIGH29 sep 2026

SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations

41RIESGO

abrir ↗

GitHub PoC★ 5

XWP_RCE — CVE-2026-87902 Hacker Console

CVE-2026-87902HIGHbajo ataque29 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RIESGO

abrir ↗

GitHub PoC★ 1

Exploit for CVE-2025-32463(sudo LPE)

CVE-2025-32463CRITICALbajo ataque29 sep 2026

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

abrir ↗

GitHub PoC

Published Epson EH-TW5350 CVE · Web Control authentication bypass · B-BEAM-BOB team

CVE-2021-43718MEDIUM29 sep 2026

An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malici

33RIESGO

abrir ↗

GitHub PoC★ 1

Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.

CVE-2026-63030CRITICALbajo ataque29 sep 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-8065 PoC: Hitachi Energy RTU500 unauth firmware update bypass (CWE-306, CVSS 9.1). IoT/OT colored check + mass exploit — RTU500 fingerprint, firmware endpoint probe, lab-safe upload test. https://pocbit.org/pocs/cve-2026-8065

CVE-2026-8065CRITICAL29 sep 2026

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions all

48RIESGO

abrir ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96878.

CVE-2026-96878MEDIUM29 sep 2026

Cargo Exhibit field alias allows stored XSS

33RIESGO

abrir ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96875.

CVE-2026-96875MEDIUM29 sep 2026

Reflected XSS in Cargo Drilldown hierarchy filters

33RIESGO

abrir ↗

GitHub PoC

SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF

CVE-2026-69137HIGH28 sep 2026

SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure

56RIESGO

abrir ↗

GitHub PoC★ 178

🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.

CVE-2026-75604CRITICAL28 sep 2026

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

63RIESGO

abrir ↗

GitHub PoC

CVE-2026-82384 PoC: Apache Roller 6.1.5 unauthenticated XML-RPC ex:serializable Java deserialization (pre-auth RCE). Check, ysoserial exploit, mass bulk scanning, colored CLI. PoCbit — https://pocbit.org/pocs/cve-2026-82384

CVE-2026-82384CRITICAL28 sep 2026

Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-100721 PoC: vm2 <3.12.2 NodeVM external allowlist bypass → sandbox escape / host RCE. Local Node lab (evil-left-pad), remote sandbox API mass exploit, colorful CLI. PoCbit — https://pocbit.org/pocs/cve-2026-100721

CVE-2026-100721CRITICAL28 sep 2026

vm2 before 3.12.2 Authorization Bypass via Custom Resolver

48RIESGO

abrir ↗

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-88771CRITICALbajo ataque28 sep 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-88772 - Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS)

CVE-2026-88772CRITICALbajo ataque28 sep 2026

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-61500CRITICAL28 sep 2026

Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key

48RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-63030CRITICALbajo ataque28 sep 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

abrir ↗

GitHub PoC

Hands-on cybersecurity and CTF labs covering port reconnaissance, CMS stack discovery, VulnCMS, CVE-2026-58225, shell-to-root paths, Python, sudo, user switching, passwords, and post-exploitation.

CVE-2026-58225LOW28 sep 2026

SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

28RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-82901CRITICAL28 sep 2026

Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field

63RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-88771CRITICALbajo ataque28 sep 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-87902HIGHbajo ataque28 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-78159CRITICAL28 sep 2026

The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

48RIESGO

abrir ↗

GitHub PoC★ 1

craigsblackie/cve-2026-88771-netscaler

CVE-2026-88771CRITICALbajo ataque28 sep 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

100RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2021-43798HIGHbajo ataque28 sep 2026

Grafana path traversal

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.