Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
88.056 exploits
GitHub PoC★ 6
jaf0rk/CVE-2026-9973-exploit
Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code i
41RIESGO
abrir ↗GitHub PoC★ 4
Use CVE-2026-43499 on Redmi Turbo 5 to escalate privilege
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
Tracking the nginx CVE-2026-42533 map/regex capture-clobbering heap overflow
NGINX Map directive and Regex matching vulnerability
48RIESGO
abrir ↗GitHub PoC★ 1
PoC reproducer for CVE-2026-53913 (Apache Camel camel-keycloak): KeycloakSecurityPolicy fails open in the Basic Setup — with no required roles/permissions the token is never verified, so any forged/garbage bearer token bypasses authentication (unauthenticated RCE). Fixed in 4.18.3/4.21.0.
Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted
48RIESGO
abrir ↗VulnCheck XDB
initial-access
Qwik affected by unauthenticated RCE via server$ Deserialization
63RIESGO
abrir ↗GitHub PoC★ 11
CVE-2026-52910 kernel crash PoC. screen goes off.
bpf: Free reuseport cBPF prog after RCU grace period.
41RIESGO
abrir ↗GitHub PoC
CVE-2026-43499
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
OnePlus Ace 3 preload.so for CVE-2026-43499 (GhostLock)
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC★ 1
gigachadusers/CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerability
33RIESGO
abrir ↗GitHub PoC★ 27
Technical analysis and Proof-of-Concept (PoC) for CVE-2026-41089, a critical unauthenticated Remote Code Execution (RCE) vulnerability in the Windows Netlogon service affecting Domain Controllers.
Windows Netlogon Remote Code Execution Vulnerability
70RIESGO
abrir ↗GitHub PoC★ 2
a shitty poc utilizing CVE-2026-0059.
In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overfl
41RIESGO
abrir ↗VulnCheck XDB
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-52813 (Gogs Path Traversal → Git Hooks RCE) defensive writeup: root-cause & patch analysis, Sigma/SIEM detection rules, IOCs, non-intrusive version scanner. No weaponized PoC.
Gogs: Path Traversal in organization name results in RCE through Git hooks
48RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗GitHub PoC
WhatsWrongAndWhy/CVE-2021-22555
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
100RIESGO
abrir ↗GitHub PoC
WhatsWrongAndWhy/CVE-2017-1000112
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE
43RIESGO
abrir ↗GitHub PoC★ 1
PoC tool for CVE-2026-44680 affecting MikroORM ≤7.0.13. Exploits JSON path injection to extract database contents via UNION-based attacks. Features vulnerability detection, automated data extraction, table enumeration, and blind injection support. Includes proxy integration for Burp Suite and WAF evasion techniques.
MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys
41RIESGO
abrir ↗GitHub PoC
Docker ortamında Apache HTTP Server 2.4.49 (CVE-2021-42013) zafiyetinin gösterildiği laboratuvar çalışması.
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RIESGO
abrir ↗GitHub PoC★ 4
WordPress REST API SQLi to RCE PoC (CVE-2026-63030 & CVE-2026-60137)
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗GitHub PoC★ 1
WordPress wp2shell pre-auth RCE exploit kit (CVE-2026-63030 + CVE-2026-60137)
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability
68RIESGO
abrir ↗VulnCheck XDB
info-leak
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗GitHub PoC
PoC reproducer for CVE-2026-49098 (Apache Camel camel-kafka): the non-Camel-prefixed kafka.OVERRIDE_TOPIC header escapes the upstream HTTP header filter and overrides the producer's configured topic, injecting an attacker-forged record onto a privileged Kafka topic (cross-topic injection). Fixed in 4.14.8/4.18.3/4.21.0.
Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topic
33RIESGO
abrir ↗GitHub PoC
Reproducer for CVE-2026-48206: Apache Camel camel-jira IssueKey (and other non-Camel-prefixed) header injection driving arbitrary JIRA issue operations with the endpoint's service-account credentials (fixed in 4.14.8/4.18.3/4.21.0)
Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue operations using the endpoint's configured credentials
33RIESGO
abrir ↗GitHub PoC★ 206
Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @JSONType resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType DISABLED via polymorphic types (@JSONType(seeAlso) / Jackson @JsonSubTypes). Marker-only payloads; safeMode + JDK17 controls.
Remote Code Execution in fastjson 1.2.68–1.2.83
48RIESGO
abrir ↗GitHub PoC★ 2
noLKM,5.10 use CVE-2026-52910.
bpf: Free reuseport cBPF prog after RCU grace period.
41RIESGO
abrir ↗GitHub PoC★ 1
Detection script for CVE-2026-11374
Account Takeover via Predictable SSO Ticket Generation
48RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.