Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.402exploits catalogados
39.049CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.184Exploit-DB 24.485GitHub PoC 16.124VulnCheck XDB 9617Nuclei 4473Metasploit 3519✓ solo verificadosrecientespopularesriesgo
15.945 exploits
GitHub PoC★ 1
CVE-2026-59358 - Cloud Foundry UAA - High - Remote - Privilege leftover - user PKCE token as client_credentials Bearer
CVE-2026-59358HIGH07 oct 2026
UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type
41RIESGO
abrir ↗
GitHub PoC
Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison
CVE-2026-90977MEDIUM07 oct 2026
Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison
33RIESGO
abrir ↗
GitHub PoC
Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN
CVE-2026-85102CRITICALbajo ataque07 oct 2026
Improper Certificate Validation in Quantum Security Gateway
78RIESGO
abrir ↗
GitHub PoC★ 1
CVE-2026-105844 — Payload CMS @payloadcms/plugin-import-export <3.88.0 unauth prototype pollution (CWE-1321, CVSS 4.0 9.3). PoCbit PoC: POST /api/exports/export-preview fields __proto__.overrideAccess → ACL bypass / data leak. check/exploit/mass. Fix 3.88.0+. https://pocbit.org/pocs/cve-2026-105844
CVE-2026-105844CRITICAL07 oct 2026
Payload: Prototype pollution in Payload Import Export plugin
48RIESGO
abrir ↗
GitHub PoC
CVE-2026-63277,
CVE-2026-63277HIGH06 oct 2026
RCE via calcext:data-mappings, sql provider and jdbc connector
41RIESGO
abrir ↗
GitHub PoC★ 10
watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589
CVE-2026-21589CRITICAL06 oct 2026
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RIESGO
abrir ↗
GitHub PoC★ 8
CVE-2026-21589 - Atlassian Data Center Unauth Arbitrary File Read (CVSS 9.3). Red/Blue Team suite with 2 tools: Full Exploit (path traversal, WEB-INF read, interactive shell, 8 products, mass scan, SOCKS5/Tor, stealth) and SafeChecker (non-intrusive version audit, WAF detection, IoC guidance, JSON/CSV/JSONL reports). Use Ethically, Stay Legal.
CVE-2026-21589CRITICAL06 oct 2026
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RIESGO
abrir ↗
GitHub PoC★ 1
0xCyp1337/CVE-2026-10196
CVE-2026-10196CRITICAL06 oct 2026
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
48RIESGO
abrir ↗
GitHub PoC
One-day analysis + sanitizer PoC of CVE-2026-43805 (IOKit IODMACommand DriverKit RPC race, CWE-362)
CVE-2026-43805CRITICAL06 oct 2026
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequ
48RIESGO
abrir ↗
GitHub PoC
CVE-2026-57967 PoC — Apache ActiveMQ Artemis unauthenticated session hijacking via SESSION_REATTACH (2.50.0–2.56.0)
CVE-2026-57967CRITICAL06 oct 2026
Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
48RIESGO
abrir ↗
GitHub PoC★ 1
PHP Object Injection -> Arbitrary File Deletion in FacturaScripts <= 2026.66 (CWE-502). PoC + advisory.
CVE-2026-104905MEDIUM06 oct 2026
FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
33RIESGO
abrir ↗
GitHub PoC
Technical advisory and proof of concept for CVE-2026-97286 in the WordPress Strong Testimonials plugin
CVE-2026-97286MEDIUM06 oct 2026
WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability
33RIESGO
abrir ↗
GitHub PoC
CVE-2026-105221 - gist RubyGem - High - MITM - GitHub OAuth token theft
CVE-2026-105221CRITICAL06 oct 2026
Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
48RIESGO
abrir ↗
GitHub PoC★ 5
Zammad Session Leak to Remote Code Execution
CVE-2026-102489HIGHbajo ataque06 oct 2026
Undisclosed RCE in Zammad v6.3 and higher
71RIESGO
abrir ↗
GitHub PoC
CVE-2023-54391: Proxmox VE Authentication Bypass RCE
CVE-2023-54391CRITICAL06 oct 2026
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RIESGO
abrir ↗
GitHub PoC
CVE-2026-59265
CVE-2026-59265HIGH06 oct 2026
Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover
41RIESGO
abrir ↗
GitHub PoC
beyavuz/cve-2026-105080-poc
CVE-2026-105080CRITICAL06 oct 2026
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-conve
48RIESGO
abrir ↗
GitHub PoC
Upstream OpenVPN kernel fix for CVE-2026-74727, tested on Ubuntu kernel 7.0.0-38.38. Includes build instructions and functional test results.
CVE-2026-74727CRITICAL06 oct 2026
ovpn: skip rehash for peers already removed from by_id
48RIESGO
abrir ↗
GitHub PoC★ 9
MarcusProgram/CVE-2026-21589
CVE-2026-21589CRITICAL06 oct 2026
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RIESGO
abrir ↗
GitHub PoC
PoC for CVE-2026-67401 — cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE. Includes a self-contained vulnerable lab, SQLi detection, and full exploit chain.
CVE-2026-67401CRITICAL06 oct 2026
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr
48RIESGO
abrir ↗
GitHub PoC★ 1
CVE-2026-96940
CVE-2026-96940HIGH06 oct 2026
Microsoft Exchange Server Elevation of Privilege Vulnerability
41RIESGO
abrir ↗
GitHub PoC
Xen0nize/CVE-2026-21096
CVE-2026-21096CRITICAL05 oct 2026
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attac
48RIESGO
abrir ↗
GitHub PoC
CVE-2026-16444 — Arbitrary file write on the controller via TeamViewer Classical File Transfer (TV-2026-1008)
CVE-2026-16444HIGH05 oct 2026
Improper Validation of File Paths in TeamViewer Desktop Clients
41RIESGO
abrir ↗
GitHub PoC
r30xlqo6从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）w680rjb2afux
CVE-2026-71486MEDIUM05 oct 2026
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
33RIESGO
abrir ↗
GitHub PoC
Analysis of CVE-2026-86881: An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages
CVE-2026-86881CRITICAL05 oct 2026
A certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and i
48RIESGO
abrir ↗
GitHub PoC
Educational lab and clean-room reproduction demonstrating the OS command injection pattern in CVE-2026-105134. For defensive research only.
CVE-2026-105134CRITICAL05 oct 2026
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
48RIESGO
abrir ↗
GitHub PoC
kashishtopi/CVE-2026-105314
CVE-2026-105314HIGH05 oct 2026
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call
41RIESGO
abrir ↗
GitHub PoC
CVE-2026-86950
CVE-2026-86950HIGHbajo ataque05 oct 2026
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2
71RIESGO
abrir ↗
GitHub PoC★ 1
hhg69/CVE-2026-41875-EXPLOIT-QuickCart-one-click-Account-Takeover
CVE-2026-41875MEDIUM05 oct 2026
Cross-Site Request Forgery in admin panel of Quick.Cart
33RIESGO
abrir ↗
GitHub PoC
Ubuntu's node-braces plus the CVE-2026-93687 nesting-depth fix, for ppa:pillarsdotnet/ppa
CVE-2026-93687HIGH05 oct 2026
braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
41RIESGO
abrir ↗
← anteriorpágina 2 / 532siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.