Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.464 exploits
GitHub PoC★ 1
Linux kernel IPv4 SYN IP-options use-after-free CVE-2026-98432 Mitigation work (Ansible Role)
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
우분투 커널 TCP 구멍(CVE-2026-98432) 쉽게 보기 · 벨로키 보안 공부
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
Reproducer for CVE-2026-95664 — Apache Camel camel-aws2-s3 evaluated a header-supplied object key as a Simple expression (CWE-917). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
33RIESGO
abrir ↗GitHub PoC★ 3
PHP2Shell (CVE-2026-109618/109619): demos reproducibles y guia de parcheo paso a paso.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
Realistic multi-version lab + toolkit for the PHP php2shell pre-auth RCE (CVE-2026-109618/109619): detect, blindly prove, and understand it. No shared mounts, no planted files, no LFI.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Node2Shell (CVE-2026-111497) detection-only scanner + lab — RedSide Security
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC
Adapted PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗GitHub PoC
Local inventory triage for Node2Shell (CVE-2026-111497): grade every Node, Bun and Brotli copy on disk. Detection-only, no network probes, no payloads.
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC
Detect Oracle E-Business Suite exposure to CVE-2026-101767 (Application Object Library, CVSS 9.8): read-only DB patch check and network exposure probe
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported
48RIESGO
abrir ↗GitHub PoC
aymencdm/cve-2026-92424-content-egg-stored-xss-
Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue
33RIESGO
abrir ↗GitHub PoC
Offline Python detector for CVE-2026-115889 version exposure in Wasmtime.
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
48RIESGO
abrir ↗GitHub PoC
CLI scanner and PoC for CVE-2026-109618 / CVE-2026-109619 (PHP OOM heap corruption and session upload-progress injection, CVSS 9.2). Affects PHP 5.4.0-8.5.11; patched in 8.2.35, 8.3.36, 8.4.27, 8.5.12. No external dependencies.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 12
Temporary mitigation for CVE-2026-98432 (Linux IPv4 TCP ireq_opt use-after-free): drop IPv4 TCP with IP options, disable MPTCP. Tested scripts + verification. EN/KO.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC★ 26
Xplo8E/CVE-2026-112621-oob-write-poc
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2
41RIESGO
abrir ↗GitHub PoC
Exploit for CVE-2026-104286 — FortiMail: Unauthenticated Arbitrary File Write → Code Execution
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
78RIESGO
abrir ↗GitHub PoC
Scyrix-LLC/CVE-2026-109722
JIT miscompilation in the JavaScript Engine: JIT component
41RIESGO
abrir ↗GitHub PoC★ 4
CVE-2026-97229 + CVE-2026-110264 — GitLab Onigmo RCE Exploit Toolkit (CVSS 10.0)
Integer Overflow or Wraparound in GitLab
100RIESGO
abrir ↗GitHub PoC
Weaponized CVE-2026-112396 (Pillow heap use-after-free): deterministic heap grooming, file-triggered chain, attacker-chosen post-free writes - verified PoCs, evidence, CI. Plus pypdf CVE-2026-113792 DoS and a fileless macOS memory-injection demo.
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
13RIESGO
abrir ↗GitHub PoC
Local Gitea CVE-2026-110311 reproduction: vulnerable vs patched comparison, Python verifier, recorded evidence, and Turkish report.
Gitea draft release creation disclosing attachment metadata
33RIESGO
abrir ↗GitHub PoC★ 1
PoC CVE-2026-88804 (Rancher)
Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
63RIESGO
abrir ↗VulnCheck XDB
initial-access
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.