Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.464 exploits
VulnCheck XDB
initial-access
openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter
63RIESGO
abrir ↗VulnCheck XDB
client-side
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RIESGO
abrir ↗VulnCheck XDB
local
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RIESGO
abrir ↗VulnCheck XDB
local
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RIESGO
abrir ↗VulnCheck XDB
initial-access
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by
100RIESGO
abrir ↗VulnCheck XDB
info-leak
trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter
50RIESGO
abrir ↗GitHub PoC
Unofficial demo built with Devin - synthetic data: CVE-2026-117561 command-injection remediation walkthrough
sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values
41RIESGO
abrir ↗VulnCheck XDB
initial-access
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
100RIESGO
abrir ↗GitHub PoC
paktiko1986/CVE-2026-82474
Sudo through 1.9.17p2 Intercept Policy Bypass via execveat
41RIESGO
abrir ↗VulnCheck XDB
initial-access
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with
60RIESGO
abrir ↗VulnCheck XDB
initial-access
Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp
48RIESGO
abrir ↗VulnCheck XDB
denial-of-service
Remote Procedure Call Runtime Remote Code Execution Vulnerability
70RIESGO
abrir ↗VulnCheck XDB
initial-access
D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand. After the user passes in
23RIESGO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
Safe kernel upgrade for CVE-2026-98432 on Ubuntu 24.04 with NVIDIA, and an analysis of the bug
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution
78RIESGO
abrir ↗GitHub PoC
CVE-2026-110447 — Collabora Online "Built-in CODE Server"
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution
100RIESGO
abrir ↗GitHub PoC★ 1
OS Command Injection PoC & Write-up - CVE-2026-115904
Topluyo Desktop for Linux has an OS Command Injection issue
48RIESGO
abrir ↗GitHub PoC★ 3
Local WordPress pingback/Brotli RCE reproduction with a one-use Podman lab
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC
Analysis of buffer overflow in Google Brotli decoder (CVE-2026-111497)
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC★ 1
Read-only Node2Shell detection for CVE-2026-111497 using verified Node.js artifact identities.
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC
CVE-2026-105192 (LMCache): pre-auth pickle deserialization RCE over the unauth ZMQ transport (single frame) — b63 showcase, lab-verified with patched-build negative + reliability/matrix evidence
LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization
48RIESGO
abrir ↗GitHub PoC★ 5
Exploit for CVE-2026-116512 - weDevs Project Manager <= 4.1.1 Unauthenticated RCE. For educational and authorized security testing only.
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
48RIESGO
abrir ↗GitHub PoC
Detection-only local triage scanner for Progress WS_FTP Server October 2026 patch batch: CVE-2026-84295 (CVSS 10.0) and 14 more, graded per group against the split 2024.0.6/2025.0.3 vs 2024.0.7/2025.0.4 fix table. No payloads, no remote probing.
Improper Authentication in Progress WS_FTP Server
48RIESGO
abrir ↗GitHub PoC★ 5
Exploit for CVE-2026-116512 - weDevs Project Manager <= 4.1.1 Unauthenticated RCE. For educational and authorized security testing only.
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
48RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.