Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.464exploits catalogados

40.695CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientes populares riesgo

87.464 exploits

GitHub PoC★ 4

XDP program to mitigate CVE-2026-98432

CVE-2026-98432CRITICAL01 nov 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-115965

CVE-2026-115965HIGH01 nov 2026

WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-105192 (LMCache): pre-auth pickle deserialization RCE over the unauth ZMQ transport (single frame) — b63 showcase, lab-verified with patched-build negative + reliability/matrix evidence

CVE-2026-105192CRITICAL01 nov 2026

LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization

48RIESGO

abrir ↗

GitHub PoC★ 1

Gitea archived repository write-protection bypass — milestones, releases and labels unprotected (CVE-2026-116296)

CVE-2026-116296MEDIUM01 nov 2026

Gitea archived repository release, milestone and label modification

33RIESGO

abrir ↗

GitHub PoC

RPM package that applies an nftables mitigation for CVE-2026-98432 (RHSB-2026-016) on EL 8/9/10

CVE-2026-98432CRITICAL01 nov 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

abrir ↗

GitHub PoC★ 1

Evidence-based PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619.

CVE-2026-109618CRITICALbajo ataque01 nov 2026

RCE via OOM corruption

100RIESGO

abrir ↗

GitHub PoC

LB-LINK WR1210M (CVE-2026-19971) 未授权配置泄露漏洞与访客网络扩展攻击链分析

CVE-2026-19971MEDIUM01 nov 2026

LB-Link WR1210M Backup Endpoint backup.cgi main missing authentication

33RIESGO

abrir ↗

GitHub PoC★ 1

🚨 CVE ID: CVE-2026-116779 📦 Product: FreeSWITCH 💉 Type: Command Injection (via SIP MESSAGE) 🔥 Score: 9.8 (Critical(RCE)) +20K target

CVE-2026-116779CRITICAL01 nov 2026

FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

48RIESGO

abrir ↗

GitHub PoC★ 1

Ghost-Bx1/cve-2026-98432-linux-tcp-uaf

CVE-2026-98432CRITICAL01 nov 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

abrir ↗

GitHub PoC

Independent technical analysis of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), covering root cause, disclosure, honeypot evidence, business risk, open-source security governance, and PHP ecosystem resilience.

CVE-2026-109618CRITICALbajo ataque01 nov 2026

RCE via OOM corruption

100RIESGO

abrir ↗

GitHub PoC★ 1

Read-only Node2Shell detection for CVE-2026-111497 using verified Node.js artifact identities.

CVE-2026-111497CRITICAL01 nov 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

abrir ↗

GitHub PoC

Analysis of buffer overflow in Google Brotli decoder (CVE-2026-111497)

CVE-2026-111497CRITICAL01 nov 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

abrir ↗

GitHub PoC

Simulasi type juggling & implicit type conversion CVE-2026-114509 pada query autentikasi

CVE-2026-114509CRITICAL01 nov 2026

Laravel TokenGuard authentication bypass through non-string API credentials

63RIESGO

abrir ↗

GitHub PoC★ 1

基于CVE-2026-98260漏洞开发的提权项目

CVE-2026-98260HIGH01 nov 2026

exec: Cleanup POSIX timers right after de_thread()

41RIESGO

abrir ↗

GitHub PoC

PHP2Shell scanner - CVE-2026-109618 and CVE-2026-109619

CVE-2026-109618CRITICALbajo ataque01 nov 2026

RCE via OOM corruption

100RIESGO

abrir ↗

GitHub PoC★ 1

Dependency-free toolkit that contains, patches and verifies the *2Shell families: PHP2Shell (CVE-2026-109618/109619), HTTP2Shell/Brotli (CVE-2026-111497), CVE-2024-4577, CVE-2019-11043. Cuts exploitation channels at the edge in minutes, applies verified upstream source patches, recycles workers, then re-checks every fix. Unattended: setup.sh --auto

CVE-2026-109618CRITICALbajo ataque01 nov 2026

RCE via OOM corruption

100RIESGO

abrir ↗

GitHub PoC

POC of CVE-2026-109618(PHP2SHELL)

CVE-2026-109618CRITICALbajo ataque01 nov 2026

RCE via OOM corruption

100RIESGO

abrir ↗

GitHub PoC

Xboard 节点后端：基于 Xray-core v26.10.31，单补丁实现设备数/限速，严格对齐 Xboard V2 契约，内置 CVE-2026-98432 缓解

CVE-2026-98432CRITICAL01 nov 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

abrir ↗

GitHub PoC★ 3

Independent lab reproduction and post-patch verification tool for CVE-2026-112816 (LXD/MicroCloud mTLS chain bypass).

CVE-2026-112816CRITICAL01 nov 2026

Improper certificate validation in the HTTPS listener in LXD

48RIESGO

abrir ↗

GitHub PoC

PHP 5.6.40 RPM packages with PHP2Shell security patches for CVE-2026-109618 and CVE-2026-109619 on EL6.

CVE-2026-109618CRITICALbajo ataque01 nov 2026

RCE via OOM corruption

100RIESGO

abrir ↗

GitHub PoC

Proof-of-Concept for CVE-2026-98258.

CVE-2026-98258HIGH01 nov 2026

posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list

41RIESGO

abrir ↗

GitHub PoC

Incident Response Case Study: Zero-Day RCE Vulnerability Mitigation & Zero-Downtime Container Hotfix on AWS + Docker (CVE-2026-109618)

CVE-2026-109618CRITICALbajo ataque01 nov 2026

RCE via OOM corruption

100RIESGO

abrir ↗

GitHub PoC★ 2

A CVE-2026-98260 adapt for OPPO Pad Air 5

CVE-2026-98260HIGH01 nov 2026

exec: Cleanup POSIX timers right after de_thread()

41RIESGO

abrir ↗

GitHub PoC★ 5

One-tap Android root for Samsung Galaxy devices, built around the CVE-2026-98260 timer exploit.

CVE-2026-98260HIGH01 nov 2026

exec: Cleanup POSIX timers right after de_thread()

41RIESGO

abrir ↗

GitHub PoC★ 1

基于CVE-2026-98260的iQOO Neo9 Pro 临时Root实现，AwA

CVE-2026-98260HIGH01 nov 2026

exec: Cleanup POSIX timers right after de_thread()

41RIESGO

abrir ↗

GitHub PoC

Citrix NetScaler RCE/DoS CVE-2026-107406

CVE-2026-107406CRITICAL01 nov 2026

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

48RIESGO

abrir ↗

GitHub PoC

Mervent/cve-2026-98432

CVE-2026-98432CRITICAL01 nov 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-60004 (Gitea): unauth RCE via diffpatch add/add collision -> live git hook in bare temp clone (KEV) — b63 showcase, lab-verified with patched + unaffected negatives

CVE-2026-60004CRITICALbajo ataque01 nov 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

98RIESGO

abrir ↗

GitHub PoC

Unauthenticated SQL injection (CVSS 9.8) in the Oracle EBS 12.2.312.2.15 TCF servlet

CVE-2026-101767CRITICAL31 oct 2026

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported

48RIESGO

abrir ↗

GitHub PoC★ 4

Detect CVE-2026-98432 on the running Linux kernel and apply the official fixed kernel only on verified distributions (Debian 12/13, Amazon Linux 2/2023). Ubuntu/RHEL detect-only; Rocky/Alma/Oracle/Fedora/SUSE/Arch/Alpine identified but not auto-fixed.

CVE-2026-98432CRITICAL31 oct 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.