Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC

CVE-2026-8347 is an Insecure Direct Object Reference (IDOR) combined with a wrong authorization level vulnerability in Concrete CMS versions 9.5.0 and earlier. The flaw exists in the Express association Reorder dialog, allowing a user with only view permissions on an Express entry to modify the ordering of associations for another entity.

CVE-2026-8347LOW31 jul 2026

Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog

28RIESGO

VulnCheck XDB

initial-access

CVE-2026-20896CRITICAL31 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RIESGO

GitHub PoC★ 2

VampSecure Labs: FortiOS CVE scanner (CVE-2018-13379, CVE-2022-40684, CVE-2023-27997, CVE-2024-21762)

CVE-2022-40684CRITICALbajo ataqueransomware31 jul 2026

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an

100RIESGO

GitHub PoC

Demonstrate the unauthenticated remote code execution vulnerability in the RSFiles! Joomla component through an arbitrary file upload.

CVE-2026-57827CRITICAL30 jul 2026

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

68RIESGO

VulnCheck XDB

initial-access

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

GitHub PoC

PoC exploits for CVE-2026-52824 (GHSA-jr9p-4h4j-6c58) — Kimai time-tracking default APP_SECRET authentication bypass affecting versions ≤ 2.57.0

CVE-2026-52824CRITICAL30 jul 2026

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

63RIESGO

GitHub PoC★ 6

CVE-2026-60004

CVE-2026-60004CRITICALbajo ataque30 jul 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

98RIESGO

GitHub PoC★ 6

CVE-2026-60004

CVE-2026-60004CRITICALbajo ataque30 jul 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

98RIESGO

GitHub PoC

the CVE-2018-4878 Adobe Flash DRM UAF exploit for educational vulnerability research

CVE-2018-4878HIGHbajo ataqueransomware30 jul 2026

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to

93RIESGO

GitHub PoC★ 2

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover (openclaw-dashboard)

CVE-2026-66418CRITICAL30 jul 2026

OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field

48RIESGO

GitHub PoC★ 1

Fastjson RCE

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

GitHub PoC

Hasanuyarrr/CVE-2026-18783-TREX-MES-Uygulamalarinda-Yetkisiz-Nesne-Erisimi

CVE-2026-18783HIGH30 jul 2026

Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES

41RIESGO

GitHub PoC★ 2

A critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83.

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

GitHub PoC★ 30

rails/rails-forensics-CVE-2026-66066

CVE-2026-66066CRITICAL30 jul 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

75RIESGO

GitHub PoC★ 1

Gitea diffpatch RCE

CVE-2026-60004CRITICALbajo ataque30 jul 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

98RIESGO

GitHub PoC

Hands-on exploit lab for CVE-2024-28000 — unauthenticated privilege escalation in LiteSpeed Cache (WordPress plugin, <=6.3.0.1). Spins up a vulnerable environment with Docker and includes a Go-based brute-forcer that cracks the weak mt_rand hash to create an administrator account.

CVE-2024-28000CRITICAL30 jul 2026

WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

75RIESGO

GitHub PoC

CVE-2026-63030 Exploit | by gr1tx

CVE-2026-63030CRITICALbajo ataque30 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC★ 2

Nowafen/CVE-2026-16723

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

GitHub PoC

JetBrains TeamCity On-Premises CVE-2026-63077 Emergency Hardening & Patch Runbook Package

CVE-2026-63077CRITICALbajo ataqueransomware30 jul 2026

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

GitHub PoC

shootcannon/CVE-2026-61511

CVE-2026-61511CRITICAL30 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

63RIESGO

GitHub PoC★ 1

DJ-Classifieds Joomla Component Unauthenticated File Upload RCE. 3-string filter bypass via PHP short tags. CVSS 10.0 | CWE-434 | com_djclassifieds < 3.11.2

CVE-2026-61424CRITICAL30 jul 2026

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

48RIESGO

GitHub PoC

KunalKhandelwal-dev/cve-2021-41773-lab

CVE-2021-41773HIGHbajo ataqueransomware30 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

VulnCheck XDB

initial-access

CVE-2024-28000CRITICAL30 jul 2026

WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

75RIESGO

GitHub PoC

Hasanuyarrr/CVE-2026-18782-TREX-MES-Uygulamalarinda-SQL-Zafiyeti

CVE-2026-18782CRITICAL30 jul 2026

SQL Injection in Trex Digital Manufacturing's Trex MES

48RIESGO

GitHub PoC

PoC exploits for CVE-2026-52824 (GHSA-jr9p-4h4j-6c58) — Kimai time-tracking default APP_SECRET authentication bypass affecting versions ≤ 2.57.0

CVE-2026-49865MEDIUM30 jul 2026

Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

13RIESGO

GitHub PoC

CVE-2026-59726 - Draft or Todo

CVE-2026-59726CRITICAL30 jul 2026

Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

63RIESGO

VulnCheck XDB

initial-access

CVE-2026-23760CRITICALbajo ataqueransomware30 jul 2026

SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-60004CRITICALbajo ataque30 jul 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

98RIESGO

GitHub PoC

Aimy Captcha-Less Form Guard Joomla Component PHP Object Injection RCE. clfgd XOR keystream recovery + unserialize(). CVSS 10.0 | CWE-502 | aimy_captcha-less_form_guard < 20.1

CVE-2026-65883CRITICAL30 jul 2026

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

48RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.