Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.150exploits catalogados
39.601CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9680Nuclei 4488Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4488 exploits
Nucleihigh
Easy Appointments <= 3.12.21 - Information Disclosure
CVE-2026-2262HIGH
Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API
36RIESGO
abrir ↗
Nucleihigh
Windmill < 1.603.3 - Operator Authorization Bypass
CVE-2026-22683HIGH
Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
56RIESGO
abrir ↗
Nucleihigh
Spring Cloud Config Server - Path Traversal
CVE-2026-22739HIGH
Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
36RIESGO
abrir ↗
Nucleicritical
vLLM 0.8.3 - 0.14.0 - Information Disclosure
CVE-2026-22778CRITICAL
vLLM leaks a heap address when PIL throws an error
48RIESGO
abrir ↗
Nucleihigh
OpenCode < 1.0.216 - Unauthenticated Remote Code Execution
CVE-2026-22812HIGH
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
41RIESGO
abrir ↗
Nucleihigh
Blinko < 1.8.4 - Path Traversal
CVE-2026-23482HIGH
Blinko: Unauthorized Arbitrary File Read - /api/file/temp
36RIESGO
abrir ↗
Nucleimedium
Blinko <= 1.8.3 - Path Traversal via /plugins
CVE-2026-23483MEDIUM
Blinko: Unauthorized Arbitrary File Read - /plugins
28RIESGO
abrir ↗
Nucleilow
Blinko <= 1.8.3 - User Information Leak
CVE-2026-23486MEDIUM
Blinko: Unauthorized User Information Leak
28RIESGO
abrir ↗
Nucleihigh
InvoicePlane <= 1.6.3 - Arbitrary File Read
CVE-2026-23491CRITICAL
InvoicePlane has Unauthenticated Path Traversal in Guest Controller
43RIESGO
abrir ↗
Nucleihigh
Feast Feature Server <=0.58.0 - Arbitrary File Read
CVE-2026-23536HIGH
Feast: unauthenticated arbitrary file read
36RIESGO
abrir ↗
Nucleihigh
Modular DS - Broken Access Control
CVE-2026-23550CRITICAL
WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability
68RIESGO
abrir ↗
Nucleihigh
ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy
CVE-2026-23693CRITICAL
ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint
43RIESGO
abrir ↗
Nucleicritical
Windmill < 1.603.3 - SQL Injection
CVE-2026-23696CRITICAL
Windmill < 1.603.3 File Ownership Handling SQLi RCE
68RIESGO
abrir ↗
Nucleicritical
MCPJam Inspector - Remote Code Execution
CVE-2026-23744CRITICAL
REC in MCPJam inspector due to HTTP Endpoint exposes
75RIESGO
abrir ↗
Nucleicritical
SmarterTools SmarterMail - Admin Password Reset
CVE-2026-23760CRITICALbajo ataqueransomware
SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
100RIESGO
abrir ↗
Nucleimedium
XWiki Platform Distribution Flavor Main - Cross-Site Scripting
CVE-2026-24128MEDIUM
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
28RIESGO
abrir ↗
Nucleihigh
Ally – Web Accessibility & Usability <= 4.0.3 - SQL Injection
CVE-2026-2413HIGH
Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path
36RIESGO
abrir ↗
Nucleihigh
Geo Mashup <= 1.13.17 - SQL Injection
CVE-2026-2416HIGH
Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter
36RIESGO
abrir ↗
Nucleicritical
NVIDIA Triton Inference Server <= 26.02 - Authentication Bypass
CVE-2026-24207CRITICAL
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A succes
63RIESGO
abrir ↗
Nucleicritical
SmarterMail - Remote Code Execution
CVE-2026-24423CRITICALbajo ataqueransomware
SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
100RIESGO
abrir ↗
Nucleihigh
AnythingLLM - Information Disclosure
CVE-2026-24477HIGH
AnythingLLM has key leak in `systemSettings.js`
36RIESGO
abrir ↗
Nucleihigh
Gravity SMTP WordPress Plugin - Sensitive Information Exposure
CVE-2026-4020HIGH
Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
56RIESGO
abrir ↗
Nucleihigh
LiteLLM < 1.25.0 - Remote Code Execution
CVE-2026-40217HIGH
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/t
56RIESGO
abrir ↗
Nucleihigh
Arcane <= 1.17.2 - Server-Side Request Forgery
CVE-2026-40242HIGH
Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
36RIESGO
abrir ↗
Nucleicritical
Gotenberg <= 8.30.1 - Server Side Request Forgery
CVE-2026-40280HIGH
Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists
36RIESGO
abrir ↗
Nucleicritical
Gotenberg <= 8.30.1 - Remote Code Execution
CVE-2026-40281CRITICAL
Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
43RIESGO
abrir ↗
Nucleihigh
My Calendar WordPress Plugin - Information Disclosure
CVE-2026-40308HIGH
My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog
36RIESGO
abrir ↗
Nucleihigh
Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass
CVE-2026-40466HIGH
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI
36RIESGO
abrir ↗
Nucleihigh
Geo Mashup <= 1.13.18 - SQL Injection
CVE-2026-4060HIGH
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter
56RIESGO
abrir ↗
Nucleilow
Mailcow < 2026-03b - Href Link Injection
CVE-2026-40878LOW
mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping
23RIESGO
abrir ↗
← anteriorpágina 117 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.