Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
88.056 exploits
VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
Autonomous AI agent with its own crypto identity — hunts CVEs, builds exploit labs, validates vulnerabilities (first public PoC of CVE-2026-86283), trades crypto 24/7 to fund itself. Sentric Research.
MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
41RIESGO
abrir ↗VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗VulnCheck XDB
initial-access
User Authentication Bypass in VPN Remote Access and Mobile Access
100RIESGO
abrir ↗GitHub PoC
Safe local proof of concept for the Cotonti CommentsWidget PHP object injection vulnerability (CAN-2026-2035973 / CVE-2026-71294).
Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions
41RIESGO
abrir ↗GitHub PoC★ 4
Public release of CVE-2026-87492 🥷
Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially exe
48RIESGO
abrir ↗GitHub PoC
brigadeops32/CVE-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC★ 1
miniOrange 2FA CVE POC
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator
48RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-85706 · GitLab CE/EE unauthenticated file read · research PoC with oracle mode, fd enumeration, and tiered loot targeting
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC★ 6
SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.
Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social en
33RIESGO
abrir ↗GitHub PoC
Standalone proof of concept for CVE-2026-86547, a NULL pointer dereference in mrubyc op_enter() through 4.0.0.
mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER
33RIESGO
abrir ↗VulnCheck XDB
info-leak
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local file
56RIESGO
abrir ↗VulnCheck XDB
initial-access
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
100RIESGO
abrir ↗GitHub PoC★ 1
Docmost < 0.22.0 - Arbitrary File Read
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local file
56RIESGO
abrir ↗GitHub PoC★ 4
cve-2026-85706-poc-exploit-gitlab
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-85706 — GitLab Path Traversal IOC Scanner & Detection Toolkit. Detect and hunt for exploitation of the critical unauthenticated GitLab CE/EE path traversal vulnerability with IOC scanning, Sigma, Suricata/Snort, and SIEM detection rules.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗VulnCheck XDB
client-side
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code in
71RIESGO
abrir ↗GitHub PoC★ 1
PoC for CVE-2026-92099 on WPGraphQL Smart Cache
WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting
33RIESGO
abrir ↗GitHub PoC
Apache Tomcat CVE-2025-24813 本地复现、利用条件分析与 AI 辅助验证记录
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗GitHub PoC
Defensive IOC and detection toolkit for CVE-2026-86218, a critical pre-auth RCE in N-able N-central. Includes IOCs, log scanner, Sigma, Splunk, Elastic/KQL detections, and incident response guidance.
pre-authentication remote code execution
98RIESGO
abrir ↗GitHub PoC
vanivamshi/CVE-2013-2028-Exploit
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
60RIESGO
abrir ↗VulnCheck XDB
client-side
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside
71RIESGO
abrir ↗GitHub PoC
MataKucing-OFC/CVE-2026-49049
Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
56RIESGO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
56RIESGO
abrir ↗VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
Comprehensive multi-layer defense system against Adobe Flash CVE exploits (CVE-2012-0754, CVE-2015-xxxx, CVE-2016-xxxx, CVE-2018-xxxx) with browser, mobile, server, and system-level protection
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.
100RIESGO
abrir ↗GitHub PoC
In the miniOrange 2FA WordPress plugin (versions before 6.3.1 and 19.3), the two-factor authentication (2FA) attempt limit is flawed.
miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout
41RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.