Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC

Shams-Ul-Mehmood/CVE-2018-7600-Drupalgeddon2-RCE

CVE-2018-7600CRITICALbajo ataqueransomware06 ago 2026

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-55040CRITICALbajo ataque06 ago 2026

Microsoft SharePoint Server Security Feature Bypass Vulnerability

100RIESGO

abrir ↗

GitHub PoC

Read-only N-able N-central CVE-2026-18556/CVE-2026-18577 post-exploitation IoC hunter for Windows endpoints

CVE-2026-18556HIGHbajo ataque06 ago 2026

Unauthenticated administrative account takeover

71RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-56164 is a critical missing-authentication vulnerability affecting on-premises Microsoft SharePoint Server. It allows unauthenticated, remote attackers to elevate privileges over a network.

CVE-2026-56164MEDIUMbajo ataque06 ago 2026

Microsoft SharePoint Server Elevation of Privilege Vulnerability

63RIESGO

abrir ↗

GitHub PoC

The Joomla extension PhocaCommander is vulnerable to Path Traversal in delete, copy, move actions - CVSS 6.4

CVE-2026-66493MEDIUM06 ago 2026

Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3

33RIESGO

abrir ↗

GitHub PoC

CVE-2022-31626, CVE-2024-2961, CVE-2019-6977, PHP security research

CVE-2019-6977—06 ago 2026

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch funct

45RIESGO

abrir ↗

GitHub PoC★ 7

CVE-2026-58048 – cPanel Root SQL Execution Toolkit (CVSS 9.4) | Full Red/Blue Team Toolkit suite for unpatched cPanel & WHM 11.x. 2 tools: Safe Checker (audit/reporting), Weaponized (reverse shell, persistence, UDF RCE, deployment, file read/write, database operations, mass scan). w/Python. Use Ethically, Stay Legal <3

CVE-2026-58048CRITICAL06 ago 2026

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

48RIESGO

abrir ↗

GitHub PoC

tfawnies/CVE-2026-64633

CVE-2026-64633CRITICAL06 ago 2026

A vulnerability allowing remote unauthenticated code execution on the agent host.

48RIESGO

abrir ↗

GitHub PoC

Non-destructive proof-of-concept and verification harness for CVE-2026-60137, a blind SQL injection in WordPress core (`WP_Query::author__not_in`), reachable via the REST API's `author_exclude` parameter.

CVE-2026-60137MEDIUMbajo ataque05 ago 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RIESGO

abrir ↗

VulnCheck XDB

remote-with-credentials

CVE-2026-60004CRITICALbajo ataque05 ago 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

98RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-26190CRITICAL05 ago 2026

Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

75RIESGO

abrir ↗

GitHub PoC

CVE-2026-0092- Possible device lock controller bypass due to a missing permission check.

CVE-2026-0092CRITICAL05 ago 2026

In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead

48RIESGO

abrir ↗

GitHub PoC

xuwu-xuwu/CVE-2026-68004

CVE-2026-68004CRITICAL05 ago 2026

An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP pub

48RIESGO

abrir ↗

GitHub PoC

ICS-Park Smart Park Management System v2.0

CVE-2026-67687HIGH05 ago 2026

Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/rol

41RIESGO

abrir ↗

GitHub PoC★ 1

WordPress Core Pre-Auth RCE — Batch Route Confusion + SQL Injection

CVE-2026-63030CRITICALbajo ataque05 ago 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

abrir ↗

GitHub PoC★ 1

Craft CMS CVE-2025-32432 command runner adapted from Nicolas Bourras and Orange Cyberdefense research

CVE-2025-32432CRITICALbajo ataque05 ago 2026

Craft CMS Allows Remote Code Execution

100RIESGO

abrir ↗

GitHub PoC

Detection rules and analysis for Dirty Frag (CVE-2026-43284/CVE-2026-43500) Linux kernel LPE vulnerability. Based on community research and health probe configurations.

CVE-2026-43284HIGH05 ago 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC★ 5

learner330/fastjson-cve-2026-16723

CVE-2026-16723CRITICAL05 ago 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

abrir ↗

GitHub PoC★ 1

Proof of concept exploit code for CVE-2026-9198

CVE-2026-9198CRITICALbajo ataque05 ago 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

98RIESGO

abrir ↗

GitHub PoC

CVE-2026-71211 exploit

CVE-2026-71211HIGH05 ago 2026

mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

41RIESGO

abrir ↗

GitHub PoC

Dungsocool/CVE-2023-6553

CVE-2023-6553CRITICAL05 ago 2026

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

85RIESGO

abrir ↗

GitHub PoC

CVE-2026-33017 Langflow RCE PoC

CVE-2026-33017CRITICALbajo ataque05 ago 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RIESGO

abrir ↗

GitHub PoC

minwunn/wp2shell-CVE-2026-63030

CVE-2026-63030CRITICALbajo ataque05 ago 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

abrir ↗

GitHub PoC

0xdak/CVE-2026-44024_exploit

CVE-2026-44024CRITICAL05 ago 2026

Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

48RIESGO

abrir ↗

GitHub PoC★ 25

PoCs for Wellbia XIGNCODE3 anti-cheat xhunter driver family - xhunter1.sys v2023.12.7.78 and xhunter2.sys v2026.6.1.192 (CVE-2026-15430, CVE-2026-3609).

CVE-2026-15430MEDIUM05 ago 2026

CVE-2026-15430

33RIESGO

abrir ↗

GitHub PoC

lucastran05/CVE-2021-41773

CVE-2021-41773HIGHbajo ataqueransomware05 ago 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC

Python script to bypass Azure APIM signup when UI is disabled, this is different from the CVE-2025-66390 as it does not require you to setup anything cross tenant.

CVE-2025-66390CRITICAL05 ago 2026

In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication)

48RIESGO

abrir ↗

GitHub PoC

Offline scanner telling you which of the 2026 Bouncy Castle CVEs actually apply to you - across BC, BC-LTS and BC-FJA (FIPS), which do not share a version scheme. CVE-2026-58062 / CVE-2026-8763 / CVE-2026-59650 / CVE-2026-59638

CVE-2026-58062CRITICAL05 ago 2026

Stapled OCSP response accepted without binding to the checked certificate

48RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-42533: pre-auth nginx heap overflow and info leak from PCRE capture clobbering in the map/script engine, chained to RCE.

CVE-2026-42533CRITICAL05 ago 2026

NGINX Map directive and Regex matching vulnerability

48RIESGO

abrir ↗

GitHub PoC★ 2

Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting PoC

CVE-2026-17532MEDIUM05 ago 2026

Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting

48RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.