Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC

This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox credential leak), and the CVE-2021-27101 / CVE-2021-27102 exploit chain (Accellion FTA).

CVE-2018-14847CRITICALbajo ataque07 sep 2026

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated

100RIESGO

GitHub PoC

iurhfiu6/CVE-2021-4034

CVE-2021-4034HIGHbajo ataqueransomware07 sep 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

GitHub PoC

Buffer overflow in FreeFloat FTP Server 1.0

CVE-2025-5548MEDIUM07 sep 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RIESGO

GitHub PoC

Reproducible Docker lab + raw-socket exploit for CVE-2015-3306 (ProFTPD mod_copy pre-auth arbitrary file copy) — a patch-diffing learning exercise

CVE-2015-3306CRITICALbajo ataque07 sep 2026

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

100RIESGO

GitHub PoC

This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox credential leak), and the CVE-2021-27101 / CVE-2021-27102 exploit chain (Accellion FTA).

CVE-2017-17215—07 sep 2026

Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could se

45RIESGO

VulnCheck XDB

initial-access

CVE-2026-32475CRITICAL07 sep 2026

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

63RIESGO

GitHub PoC

CVE-2026-39987 Proof of Concept

CVE-2026-39987CRITICALbajo ataque07 sep 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

GitHub PoC★ 1

moksh-nfsu/CVE-2026-36392

CVE-2026-36392MEDIUM07 sep 2026

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject

33RIESGO

GitHub PoC★ 15

CVE-2026-67276 MikroTik RouterOS SSH Authentication Bypass Exploit

CVE-2026-67276CRITICAL07 sep 2026

SSH user impersonation possible in Mikrotik RouterOS

48RIESGO

VulnCheck XDB

initial-access

CVE-2021-44228CRITICALbajo ataqueransomware07 sep 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALbajo ataque07 sep 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

GitHub PoC★ 3

PoC for the CVE-2026-69451 - Fastprox EoP

CVE-2026-69451HIGH07 sep 2026

Windows Management Instrumentation Elevation of Privilege Vulnerability

41RIESGO

VulnCheck XDB

initial-access

CVE-2024-12356CRITICALbajo ataque07 sep 2026

Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-32475CRITICAL07 sep 2026

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

63RIESGO

VulnCheck XDB

initial-access

CVE-2026-19598CRITICAL07 sep 2026

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

63RIESGO

VulnCheck XDB

initial-access

CVE-2026-18366CRITICAL07 sep 2026

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

48RIESGO

VulnCheck XDB

client-side

CVE-2026-85046HIGHbajo ataque07 sep 2026

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

71RIESGO

VulnCheck XDB

info-leak

CVE-2020-10770—07 sep 2026

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using

50RIESGO

VulnCheck XDB

initial-access

CVE-2026-56290CRITICALbajo ataque07 sep 2026

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-82329CRITICALbajo ataque07 sep 2026

Potential authentication bypass leading to administrative access in Artifactory

98RIESGO

VulnCheck XDB

initial-access

CVE-2026-18963CRITICAL07 sep 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RIESGO

GitHub PoC★ 1

CVE-2026-86218 - Draft or TODO - N-central is vulnerable to a pre-auth remote code execution

CVE-2026-86218CRITICALbajo ataque07 sep 2026

pre-authentication remote code execution

98RIESGO

VulnCheck XDB

local

CVE-2026-31431HIGHbajo ataque07 sep 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

VulnCheck XDB

initial-access

CVE-2023-42793CRITICALbajo ataqueransomware07 sep 2026

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-67276CRITICAL07 sep 2026

SSH user impersonation possible in Mikrotik RouterOS

48RIESGO

VulnCheck XDB

initial-access

CVE-2026-0920CRITICAL07 sep 2026

LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter

48RIESGO

VulnCheck XDB

initial-access

CVE-2025-29927CRITICAL07 sep 2026

Authorization Bypass in Next.js Middleware

85RIESGO

GitHub PoC

Eliot-code/CVE-2026-52924

CVE-2026-52924CRITICAL07 sep 2026

sctp: purge outqueue on stale COOKIE-ECHO handling

48RIESGO

VulnCheck XDB

initial-access

CVE-2026-11613CRITICAL07 sep 2026

Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter

48RIESGO

VulnCheck XDB

info-leak

CVE-2026-42031HIGH07 sep 2026

CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`

56RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.