Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.794exploits catalogados

36.057CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientes populares riesgo

14.316 exploits

GitHub PoC★ 1

A PoC for CVE-2026-64725

CVE-2026-64725HIGH28 jul 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS

41RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-8206: Kirki Customizer Framework - Unauthenticated Account Takeover (CVSS 9.8)

CVE-2026-8206CRITICAL28 jul 2026

Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

48RIESGO

abrir ↗

GitHub PoC★ 2

Exploit code for CVE-2026-55040, it can create auth header for any validate account.

CVE-2026-55040CRITICALbajo ataque28 jul 2026

Microsoft SharePoint Server Security Feature Bypass Vulnerability

78RIESGO

abrir ↗

GitHub PoC

Clickbait. The CVE is AI slop.

CVE-2026-51302—28 jul 2026

23RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2026-53264 - Draft or Todo

CVE-2026-53264HIGH28 jul 2026

net/sched: act_api: use RCU with deferred freeing for action lifecycle

41RIESGO

abrir ↗

GitHub PoC

Isolated regression and security-control lab for CVE-2026-59891 in @sigstore/oci

CVE-2026-59891CRITICAL28 jul 2026

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

48RIESGO

abrir ↗

GitHub PoC

Microsoft SharePoint CVE-2026-50522

CVE-2026-50522CRITICALbajo ataque28 jul 2026

Microsoft SharePoint Remote Code Execution Vulnerability

100RIESGO

abrir ↗

GitHub PoC★ 1

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

CVE-2026-54121HIGH28 jul 2026

Active Directory Certificate Services Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC★ 1

IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution [RCE]

CVE-2026-9198CRITICALbajo ataque28 jul 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

98RIESGO

abrir ↗

GitHub PoC

Proof of Concept for CVE-2026-65761 - EasyStore Pro Unauthenticated SQL Injection via `filter_sortby`

CVE-2026-65761CRITICAL28 jul 2026

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1

48RIESGO

abrir ↗

GitHub PoC★ 34

nginx heap buffer overflow PoC — CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed on Ubuntu 24.04.

CVE-2026-42533CRITICAL27 jul 2026

NGINX Map directive and Regex matching vulnerability

48RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-65008

CVE-2026-65008CRITICAL27 jul 2026

Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

48RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-15013

CVE-2026-15013CRITICAL27 jul 2026

SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion

48RIESGO

abrir ↗

GitHub PoC

Dungsocool/CVE-2026-60137_CVE-2026-63030

CVE-2026-60137MEDIUMbajo ataque27 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

100RIESGO

abrir ↗

GitHub PoC

yuimamur/CVE-2024-4367-hands-on

CVE-2024-4367MEDIUM27 jul 2026

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RIESGO

abrir ↗

GitHub PoC

A Python-based static patch analysis tool for studying the root cause and remediation of CVE-2021-41773 (Apache HTTP Server Path Traversal) by comparing the vulnerable Apache HTTP Server 2.4.49 source code with the patched 2.4.51 implementation.

CVE-2021-41773HIGHbajo ataqueransomware27 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC

PoC and analysis of CVE-2021-41773

CVE-2021-41773HIGHbajo ataqueransomware27 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC★ 11

Unprivileged user to root on macOS Sonoma, Sequoia, and Tahoe. Patched in macOS 26.6 / 15.7.8 / 14.8.8.

CVE-2026-39875HIGH27 jul 2026

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonom

41RIESGO

abrir ↗

GitHub PoC

Procjevt/CVE-2026-58138

CVE-2026-58138CRITICAL27 jul 2026

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

63RIESGO

abrir ↗

GitHub PoC

Phucc29/CVE-2025-55182

CVE-2025-55182CRITICALbajo ataqueransomware27 jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC★ 1

soralis0912/CVE-2026-43499-pmg110-root

CVE-2026-43499HIGH27 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.

CVE-2026-9830HIGH27 jul 2026

BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug

41RIESGO

abrir ↗

GitHub PoC

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

CVE-2026-50522CRITICALbajo ataque27 jul 2026

Microsoft SharePoint Remote Code Execution Vulnerability

100RIESGO

abrir ↗

GitHub PoC

yuimamur/CVE-2024-4367-hands-on-01

CVE-2024-4367MEDIUM27 jul 2026

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RIESGO

abrir ↗

GitHub PoC★ 10

CVE-2026-54121 (Certighost) AD CS DC-impersonation PoC. Patched SAN handling + MAQ-safe account reuse.

CVE-2026-54121HIGH27 jul 2026

Active Directory Certificate Services Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-57973 is a medium-severity (CVSS 6.3) TOCTOU race condition flaw in Windows Subsystem for Linux (WSL2). It allows a local, low-privileged attacker to bypass security boundaries and perform unauthorized kernel-level tampering on the host machine without user interaction.

CVE-2026-57973MEDIUM27 jul 2026

Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability

13RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-43499: Linux kernel futex PI use-after-free research package

CVE-2026-43499HIGH27 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC★ 1

A poc for a vulnerability in ZTE File Manager (zte.com.cn.filer) which allows to read arbitrary files from other apps as the privileges of this file manager

CVE-2026-40000LOW27 jul 2026

Path Traversal Vulnerability in ZTE Blade A75 5G

28RIESGO

abrir ↗

GitHub PoC

jelasin/CVE-2026-42533

CVE-2026-42533CRITICAL27 jul 2026

NGINX Map directive and Regex matching vulnerability

48RIESGO

abrir ↗

GitHub PoC★ 3

A POC for the recently discovered Qualys bug on COW with XFS

CVE-2026-64600HIGH27 jul 2026

xfs: resample the data fork mapping after cycling ILOCK

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.