Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC

⚡ GHOSTLYR00T - CVE-2026-82222 GiveWP RCE Exploit Framework Unauthenticated RCE on GiveWP <= 4.16.7.1. Mass scanning, auto-detection (form/gateway/amount), multi-threading, JSON/TXT output, interactive shell. CVSS 9.8 Critical. ⚠️ Authorized testing only.

CVE-2026-82222CRITICAL08 sep 2026

WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

63RIESGO

GitHub PoC

composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Mage-OS stores, via cweagans/composer-patches. Companion to stylesmuggler-adobe-patches (Magento).

CVE-2026-75650CRITICALbajo ataque08 sep 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

100RIESGO

VulnCheck XDB

local

CVE-2009-3547—08 sep 2026

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of servi

23RIESGO

GitHub PoC

CVE-2026-59903 / CVE-2026-33870: offline checker for io.netty:netty-codec-http - its 14 CVEs plus 9 advisories Netty published on 2026-09-10 that the GitHub Advisory Database (Dependabot) does not list. 4.1.137.Final / 4.2.17.Final is no longer enough; upgrade to 4.1.138.Final / 4.2.18.Final.

CVE-2026-59903MEDIUM08 sep 2026

Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

33RIESGO

GitHub PoC★ 1

Writeup/finding of CVE-2026-24061 within the Cyberhawks lab

CVE-2026-24061CRITICALbajo ataque08 sep 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC★ 7

Docker lab reproducing the complete CVE-2026-75650 StyleSmuggler unauthenticated HTTP RCE and validating Adobe VULN-39341.

CVE-2026-75650CRITICALbajo ataque08 sep 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

100RIESGO

GitHub PoC

Public reference for CVE-2026-52307

CVE-2026-52307MEDIUM08 sep 2026

An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.

33RIESGO

GitHub PoC★ 9

Marimo Pre Authentication RCE

CVE-2026-39987CRITICALbajo ataque08 sep 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

GitHub PoC

CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight deserialization

CVE-2025-55182CRITICALbajo ataqueransomware08 sep 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

VulnCheck XDB

local

CVE-2009-2692—08 sep 2026

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socke

43RIESGO

GitHub PoC

CVE-2025-58434 - Flowise (CVE-2025-58434) unauthenticated account takeover via password-reset token disclosure

CVE-2025-58434CRITICAL08 sep 2026

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

85RIESGO

VulnCheck XDB

info-leak

CVE-2015-3306CRITICALbajo ataque08 sep 2026

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

100RIESGO

GitHub PoC★ 8

CVE-2026-85046 | Chrome V8 Type Confusion in Inline Array.prototype.sort (Maglev/Turbofan) | CVSS 8.8 | CWE-843 | Chrome < 152.0.7977.82

CVE-2026-85046HIGHbajo ataque08 sep 2026

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

71RIESGO

VulnCheck XDB

initial-access

CVE-2026-19949HIGH08 sep 2026

All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

41RIESGO

GitHub PoC

From patch to RCE: hand-built exploit for CVE-2010-4221 (ProFTPD TELNET IAC stack overflow), with the full failure-driven journey documented

CVE-2010-4221—08 sep 2026

Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow rem

60RIESGO

VulnCheck XDB

client-side

CVE-2026-85046HIGHbajo ataque08 sep 2026

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

71RIESGO

VulnCheck XDB

initial-access

CVE-2026-8732CRITICAL08 sep 2026

WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action

68RIESGO

VulnCheck XDB

initial-access

CVE-2025-8110HIGHbajo ataque08 sep 2026

File overwrite in file update API in Gogs

100RIESGO

VulnCheck XDB

local

CVE-2026-75650CRITICALbajo ataque08 sep 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

100RIESGO

GitHub PoC

CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184

CVE-2026-13181HIGH07 sep 2026

RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

41RIESGO

GitHub PoC

Linux Kernel Exploits -> CVE-2006-2451 + CVE-2006-3626

CVE-2006-2451—07 sep 2026

The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a l

23RIESGO

GitHub PoC

StyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells, persistence artifacts, and known indicators of compromise.

CVE-2026-75650CRITICALbajo ataque07 sep 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

100RIESGO

GitHub PoC

Linux Kernel Exploits -> CVE-2004-0077 + CVE-2004-1235 + caps_to_root

CVE-2004-0077—07 sep 2026

The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not prop

23RIESGO

GitHub PoC

BlueGate Exploit validator - RD Gateway validator for CVE-2020-0609 and CVE-2020-0610 (BlueGate) using OpenSSL DTLS over UDP/3391.

CVE-2020-0609—07 sep 2026

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated atta

45RIESGO

GitHub PoC

Buffer overflow in FreeFloat FTP Server 1.0

CVE-2025-5548MEDIUM07 sep 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RIESGO

GitHub PoC

Linux Kernel Exploits -> CVE-2005-0736 + CVE-2005-1263

CVE-2005-0736—07 sep 2026

Integer overflow in sys_epoll_wait in eventpoll.c for Linux kernel 2.6 to 2.6.11 allows local users to overwrite kernel

23RIESGO

GitHub PoC

Reproducible Docker lab + raw-socket exploit for CVE-2015-3306 (ProFTPD mod_copy pre-auth arbitrary file copy) — a patch-diffing learning exercise

CVE-2015-3306CRITICALbajo ataque07 sep 2026

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

100RIESGO

GitHub PoC

Log4Shell (CVE-2021-44228) exploitation from a Kali VM against a vulnerable containerized app, with Splunk-based detection engineering and validated remediation. Covers the full attack lifecycle: exploitation, JNDI and host-level auditd detection, and before/after remediation proof.

CVE-2021-44228CRITICALbajo ataqueransomware07 sep 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC

iurhfiu6/CVE-2021-4034

CVE-2021-4034HIGHbajo ataqueransomware07 sep 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

VulnCheck XDB

local

CVE-2009-2698—07 sep 2026

The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel befo

23RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.