Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados
39.531CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientespopularesriesgo
16.313 exploits
GitHub PoC
EspoCRM 9.3.3 - Authenticated SSRF via Alternative IPv4 Notation
CVE-2026-33534MEDIUM08 may 2026
EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
48RIESGO
abrir ↗
GitHub PoC
AegisGraph: graph-based application-layer assessment evidence platform for Secure Messaging Applications (SMAs). DARPA ASEMA HR0011SB20254-12 Tier 3 research. ReproChain CVE-2023-4863 reachability + PolyDiff differential parser fuzzing + claim-state governance + reproducible benchmark surface.
CVE-2023-4863HIGHbajo ataque08 may 2026
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to
93RIESGO
abrir ↗
GitHub PoC
branixsolutions/Security-CVE-2026-41940-cPanel-WHM-WP2
CVE-2026-41940CRITICALbajo ataqueransomware08 may 2026
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RIESGO
abrir ↗
GitHub PoC★ 18
A proof-of-concept demonstrating how a default, unprivileged Kubernetes Pod can achieve node-level code execution on Amazon EKS by exploiting the Dirty Frag (CVE-2026-43284) Linux kernel page-cache corruption vulnerability through shared container image layers.
CVE-2026-43284HIGH08 may 2026
xfrm: esp: avoid in-place decrypt on shared skb frags
78RIESGO
abrir ↗
GitHub PoC★ 23
Detector + PoC for Linux page-cache write vulnerabilities: Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284/43500). Authorized security research only.
CVE-2026-31431HIGHbajo ataque08 may 2026
crypto: algif_aead - Revert to operating out-of-place
86RIESGO
abrir ↗
GitHub PoC★ 2
Vulnerability detection and mitigation tool for Copy Fail and Dirty Frag bugs (CVE-2026-31431, CVE-2026-43284, CVE-2026-43500)
CVE-2026-31431HIGHbajo ataque08 may 2026
crypto: algif_aead - Revert to operating out-of-place
86RIESGO
abrir ↗
GitHub PoC
ameerhamza-malik/CVE-2026-42796
CVE-2026-42796CRITICAL08 may 2026
Arelle < 2.39.10 Unauthenticated RCE via /rest/configure
43RIESGO
abrir ↗
GitHub PoC★ 3
Wazuh 4.14.4 detection rules for CVE-2026-43284 / CVE-2026-43500 (Dirty Frag) - Linux Local Privilege Escalation via page cache write
CVE-2026-43284HIGH08 may 2026
xfrm: esp: avoid in-place decrypt on shared skb frags
78RIESGO
abrir ↗
GitHub PoC★ 23
CVE-2026-43284
CVE-2026-43284HIGH08 may 2026
xfrm: esp: avoid in-place decrypt on shared skb frags
78RIESGO
abrir ↗
GitHub PoC★ 2
Dirty Frag (CVE-2026-43284/43500) - Linux Kernel LPE Deep Technical Analysis by Bomb
CVE-2026-43284HIGH08 may 2026
xfrm: esp: avoid in-place decrypt on shared skb frags
78RIESGO
abrir ↗
GitHub PoC★ 1
CVE-2026-31431 in C for aarch64 and amd64
CVE-2026-31431HIGHbajo ataque08 may 2026
crypto: algif_aead - Revert to operating out-of-place
86RIESGO
abrir ↗
GitHub PoC
CVE-2025-58434 Proof of Concept
CVE-2025-58434CRITICAL08 may 2026
Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
75RIESGO
abrir ↗
GitHub PoC
A fully refactored, Python 3 compatible exploit script for Tomcat Ghostcat (CVE-2020-1938 / CNVD-2020-10487) AJP Local File Inclusion
CVE-2020-1938CRITICALbajo ataque08 may 2026
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RIESGO
abrir ↗
GitHub PoC★ 1
kyukazamiqq/cve-2026-5718
CVE-2026-5718HIGH08 may 2026
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
56RIESGO
abrir ↗
GitHub PoC
Full black-box penetration test against SecOS:1 (VulnHub) — CSRF exploitation, privilege escalation via CVE-2015-1328 (OverlayFS), post-exploitation
CVE-2015-1328—08 may 2026
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no
50RIESGO
abrir ↗
GitHub PoC
rootdirective-sec/CVE-2026-34197-Lab
CVE-2026-34197HIGHbajo ataque08 may 2026
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
91RIESGO
abrir ↗
GitHub PoC
Paranoid disable Linux IPsec ESP support (esp4/esp6) and RxRPC support.
CVE-2026-43284HIGH08 may 2026
xfrm: esp: avoid in-place decrypt on shared skb frags
78RIESGO
abrir ↗
GitHub PoC
Desc "Fix Redis CVE ultil 20260508-10h51 GMT+7"
CVE-2026-25589HIGH08 may 2026
RedisBloom RESTORE invalid memory access may allow remote code execution
21RIESGO
abrir ↗
GitHub PoC
CVE-2026-31431 ("Copy Fail") vulnerability detector & exploit on Astra linux 1.7.6 with 3.7+ python
CVE-2026-31431HIGHbajo ataque08 may 2026
crypto: algif_aead - Revert to operating out-of-place
86RIESGO
abrir ↗
GitHub PoC★ 6
Simple Ansible Playbook to mitigate against CopyFail (CVE-2026-31431) and DirtyFrag (CVE-2026-43284) vulnerabilities.
CVE-2026-31431HIGHbajo ataque08 may 2026
crypto: algif_aead - Revert to operating out-of-place
86RIESGO
abrir ↗
GitHub PoC
CTT-Enhanced Apache mod_auth_digest Timing Attack — CVE-2026-33006 Remote Digest Authentication Bypass → 33-Layer Temporal Timing Attack Original vulnerability: Apache HTTP Server 2.4.66 (mod_auth_digest timing leak) CTVSS (Original): 4.8 (Medium) CTT-Enhanced CVSS: 7.5 (High) — Network, low complexity, temporal wedge evasion
CVE-2026-33006MEDIUM08 may 2026
Apache HTTP Server: mod_auth_digest timing attack
13RIESGO
abrir ↗
GitHub PoC
julichaan/CVE-2026-31431-python-copyfail-POC
CVE-2026-31431HIGHbajo ataque07 may 2026
crypto: algif_aead - Revert to operating out-of-place
86RIESGO
abrir ↗
GitHub PoC★ 171
Next.js v16.2.4 Security PoC Collection (CVE-2026-23870, CVE-2026-44575, CVE-2026-44579, CVE-2026-44574, CVE-2026-44578, CVE-2026-44573, CVE-2026-44581, CVE-2026-44580, CVE-2026-44577, CVE-2026-44576, CVE-2026-44582, CVE-2026-44572)
CVE-2026-23870HIGH07 may 2026
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpo
41RIESGO
abrir ↗
GitHub PoC★ 3
One-liner Python LPE for CVE-2026-31431 (CopyFail2). No compilation, no dependencies beyond Python+OpenSSL. Just curl | python3 and get root on Linux 6.5+.
CVE-2026-31431HIGHbajo ataque07 may 2026
crypto: algif_aead - Revert to operating out-of-place
86RIESGO
abrir ↗
GitHub PoC
Caliburn9/CVE-2023-21716-Analysis-ICT287
CVE-2023-21716CRITICAL07 may 2026
Microsoft Word Remote Code Execution Vulnerability
70RIESGO
abrir ↗
GitHub PoC★ 2
Math.js Expression Parser RCE
CVE-2026-40897HIGH07 may 2026
Math.js: Unsafe object property setter in mathjs
41RIESGO
abrir ↗
GitHub PoC
CVE-2026-44590 - Sherlock <= v0.16.0 - RCE via pull_request_target Injection → Supply Chain Compromise
CVE-2026-44590CRITICAL07 may 2026
Sherlock: Command Injection via pull_request_target in validate_modified_targets.yml
28RIESGO
abrir ↗
GitHub PoC★ 33
CVE-2026-23631 (DarkReplica) Redis Exploit
CVE-2026-23631MEDIUM07 may 2026
redis-server Lua use-after-free may allow remote code execution
33RIESGO
abrir ↗
GitHub PoC
CVE-2026-3844
CVE-2026-3844CRITICAL07 may 2026
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
63RIESGO
abrir ↗
GitHub PoC★ 4
Automatic script written in python for CVE-2009-3999
CVE-2009-3999—07 may 2026
Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to ex
60RIESGO
abrir ↗
← anteriorpágina 133 / 544siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.