Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados

39.531CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientes populares riesgo

16.313 exploits

GitHub PoC

Xmyronn/CVE-2026-10290-SQLI

CVE-2026-10290MEDIUM11 may 2026

code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection

33RIESGO

abrir ↗

GitHub PoC★ 68

EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization.

CVE-2026-34486HIGHbajo ataque11 may 2026

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

86RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-31431 - Linux Kernel Page Cache Vulnerability

CVE-2026-31431HIGHbajo ataque11 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

abrir ↗

GitHub PoC

Relatório de Análise Técnica: Exploração de Falha de Isolamento no Kernel Linux (CVE-2026-31431)

CVE-2026-31431HIGHbajo ataque11 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

abrir ↗

GitHub PoC★ 15

CVE-2026-43284/CVE-2026-43500 'DirtyFrag' Benign patch & mitigation detection script

CVE-2026-43284HIGH11 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC★ 3

Arbitrary command execution on Cockpit

CVE-2026-4802HIGH11 may 2026

Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui

21RIESGO

abrir ↗

GitHub PoC

CVE-2026-43284 & CVE-2026-43500 discovered by Hyunwoo Kim

CVE-2026-43284HIGH11 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC

Proof of concept of CVE-2026-8161 (Multiparty)

CVE-2026-8161HIGH11 may 2026

multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception

21RIESGO

abrir ↗

GitHub PoC★ 32

Double-free in Apache httpd mod_http2 stream cleanup leading to pre-auth RCE.

CVE-2026-23918HIGH11 may 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

abrir ↗

GitHub PoC★ 5

Crihexe/v8-poc-CVE-2026-5865

CVE-2026-5865HIGH10 may 2026

Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside

21RIESGO

abrir ↗

GitHub PoC

Educational Proof of Concept for CVE-2026-31431 / Copy Fail Linux local privilege escalation via AF_ALG algif_aead

CVE-2026-31431HIGHbajo ataque10 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

abrir ↗

GitHub PoC

Threat intelligence brief on CVE-2026-42208, a critical pre-auth SQL injection in BerriAI LiteLLM exploited within 36 hours of disclosure. Covers attack path, detection opportunities, and recommended actions.

CVE-2026-42208CRITICALbajo ataque10 may 2026

LiteLLM: SQL injection in Proxy API key verification

93RIESGO

abrir ↗

GitHub PoC

rootdirective-sec/CVE-2026-42208-Lab

CVE-2026-42208CRITICALbajo ataque10 may 2026

LiteLLM: SQL injection in Proxy API key verification

93RIESGO

abrir ↗

GitHub PoC

Technical analysis of the LangChain serialization injection vulnerability CVE-2025-68664.

CVE-2025-68664CRITICAL10 may 2026

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

60RIESGO

abrir ↗

GitHub PoC

kaleth4/CVE-2026-7482

CVE-2026-7482HIGH10 may 2026

Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers

41RIESGO

abrir ↗

GitHub PoC

ryan2929/CVE-2026-43284-

CVE-2026-43284HIGH10 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC

A temporary mitigation against copy_fail variant (copyfail2_electric_boogaloo) - Unprivileged Linux LPE via xfrm ESP-in-UDP MSG_SPLICE_PAGES no-COW fast path. Page-cache write into any readable file. Overwrites a nologin line in /etc/passwd with sick::0:0:…:/:/bin/bash and sus into it. Same class as Copy Fail (CVE-2026-31431), different subsystem.

CVE-2026-31431HIGHbajo ataque10 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

abrir ↗

GitHub PoC

Exploit Windows server 2019 vulnerable to Zerologon with Garble, Chisel, wp-file-manager vulnerability (have video demo)

CVE-2020-25213CRITICALbajo ataque10 may 2026

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra

100RIESGO

abrir ↗

GitHub PoC★ 34

arm64/aarch64 port of V4bel/dirtyfrag (CVE-2026-43284). ESP-only - rxrpc path kernel-oopses on arm64 due to flush_dcache_page

CVE-2026-43284HIGH10 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC★ 2

cPanelSniper STABLE - CVE-2026-41940 optimized for 10M+ targets

CVE-2026-41940CRITICALbajo ataqueransomware10 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

GitHub PoC

Форензика после CVE-2026-41940 (cPanel/WHM) — bash-скрипт и чек-лист

CVE-2026-41940CRITICALbajo ataqueransomware10 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-20131

CVE-2026-20131CRITICALbajo ataqueransomware10 may 2026

Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability

90RIESGO

abrir ↗

GitHub PoC

Elegant C++ exploit for CVE-2026-31431 (Copy Fail) using AF_ALG authenticated encryption + splice(2) to overwrite setuid binary memory

CVE-2026-31431HIGHbajo ataque09 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-0073 - ADB Wireless Mutual Authentication Bypass PoC

CVE-2026-0073HIGH09 may 2026

In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic err

41RIESGO

abrir ↗

GitHub PoC

Hunt-Benito/copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe

CVE-2026-31431HIGHbajo ataque09 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

abrir ↗

GitHub PoC

A bash script for mitigating linux dirtyfrag exploit CVE-2026-43500, and fragnesia

CVE-2026-43500HIGH09 may 2026

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

56RIESGO

abrir ↗

GitHub PoC

Hack The Box - Silentium machine writeup | CVE-2025-58434, CVE-2025-59528, CVE-2025-8110

CVE-2025-58434CRITICAL09 may 2026

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

75RIESGO

abrir ↗

GitHub PoC★ 3

Read-only checker for CVE-2026-31431 (algif_aead local root). Reports kernel/module state and suggests mitigations.

CVE-2026-31431HIGHbajo ataque09 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

abrir ↗

GitHub PoC

Educational cybersecurity project demonstrating exploitation and mitigation of CVE-2020-25213 (WordPress File Manager Plugin RCE). Includes malware simulation, VAPT analysis, and security patch implementation in a controlled lab environment.

CVE-2020-25213CRITICALbajo ataque09 may 2026

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra

100RIESGO

abrir ↗

GitHub PoC

This script will attempt to mitigate the copy_fail attack. CVE-2026-31431

CVE-2026-31431HIGHbajo ataque09 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.