Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.554exploits catalogados

39.165CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.153 exploits

GitHub PoC★ 1

Technical details, proof of concept, and responsible disclosure timeline for CVE-2026-93528 (Unauthenticated Order Data Disclosure in NP Quote Request for WooCommerce).

CVE-2026-93528LOW21 sep 2026

NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page

28RIESGO

GitHub PoC★ 1

jvidhan/autofs-cve-2026-84568

CVE-2026-84568HIGH21 sep 2026

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS S

41RIESGO

GitHub PoC★ 1

Netcore NBR200V2 traceroute command injection PoC (CVE-2026-94095); ubus JSON-RPC -> system() root RCE; for authorized testing

CVE-2026-94095CRITICAL21 sep 2026

Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection

48RIESGO

GitHub PoC

Mass check/research exploit for HP HPLIP CVE-2026-91097–91106 (<3.26.6), PAPPL :8000 IPP probes + hpssd templates

CVE-2026-91097HIGH21 sep 2026

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

41RIESGO

GitHub PoC

CVE-2026-8932 PoC - incomplete mTLS config matching in conn reuse

CVE-2026-8932HIGH21 sep 2026

incomplete mTLS config matching in conn reuse

41RIESGO

GitHub PoC

A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header — no credentials required.

CVE-2026-41940CRITICALbajo ataqueransomware21 sep 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC

Craft CMS CVE-2026-72778 condition.config RCE PoC

CVE-2026-72778HIGH21 sep 2026

Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

41RIESGO

GitHub PoC

Craft CMS CVE-2026-72781 Twig sandbox escape RCE PoC

CVE-2026-72781HIGH21 sep 2026

Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

41RIESGO

GitHub PoC

Security research lab — Unauthenticated RCE via insecure deserialization in ComfyUI v0.23.0 (CVSS 9.8). Isolated Docker environment, technical analysis and documentation.

CVE-2026-68771CRITICAL21 sep 2026

ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

48RIESGO

GitHub PoC

CVE-2026-74469 DiagSpill

CVE-2026-74469HIGH21 sep 2026

sctp: prevent peer transport count overflow

41RIESGO

GitHub PoC

CVE-2026-68121 PPPoEject

CVE-2026-68121HIGH21 sep 2026

pppoe: reload header pointer after dev_hard_header()

41RIESGO

GitHub PoC★ 3

CVE-2026-88854 — OrdaSoft Joomla Gallery unauth SQLi PoC (check / mass scan / EXTRACTVALUE read)

CVE-2026-88854CRITICAL20 sep 2026

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

48RIESGO

GitHub PoC

mfahdk/CVE-2026-39987_RCE_PoC

CVE-2026-39987CRITICALbajo ataque20 sep 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

GitHub PoC★ 7

Proof-of-concept and instrumented reproduction harness for CVE-2026-28609, an out-of-bounds write in Android's MatroskaExtractor reachable via a crafted WebM file with a big-endian PCM audio track.

CVE-2026-28609HIGH20 sep 2026

In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to re

41RIESGO

GitHub PoC

o-sec/CVE-2026-41452-poc

CVE-2026-41452CRITICAL20 sep 2026

Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup

63RIESGO

GitHub PoC

CVE-2021-43798 Grafana Unauthenticated Path Traversal - Security Lab | Shivam Gupta | 23104003

CVE-2021-43798HIGHbajo ataque20 sep 2026

Grafana path traversal

100RIESGO

GitHub PoC★ 1

DJI Drone Cleartext Bluetooth Transmission of Wi-Fi PSK and Session UUID — Proof of Concept for CVE-2026-77812.

CVE-2026-77812CRITICAL20 sep 2026

Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE

48RIESGO

GitHub PoC

shambhaviM18/cve-2019-15107-lab

CVE-2019-15107CRITICALbajo ataqueransomware20 sep 2026

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RIESGO

GitHub PoC

suominen/CVE-2026-53266

CVE-2026-53266HIGHbajo ataque20 sep 2026

netfilter: bridge: make ebt_snat ARP rewrite writable

71RIESGO

GitHub PoC

Unauthenticated Arbitrary Shortcode Execution

CVE-2026-89274CRITICAL20 sep 2026

WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

48RIESGO

GitHub PoC★ 1

A PoC for CVE-2026-71217

CVE-2026-71217HIGH20 sep 2026

Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

41RIESGO

GitHub PoC

ZTE SmartLife security findings leading to account takeover: 100K+ Google Play downloads and CVE-2026-86552 through CVE-2026-86555.

CVE-2026-86552MEDIUM20 sep 2026

A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

33RIESGO

GitHub PoC★ 18

DJI Drone DUML Command Injection over Bluetooth — Proof of Concept for CVE-2026-78306

CVE-2026-78306HIGH20 sep 2026

DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

41RIESGO

GitHub PoC

CVE-2026-36213: MEmu Android Emulator 9.2.7.0 Local Privilege Escalation

CVE-2026-36213HIGH20 sep 2026

An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.e

41RIESGO

GitHub PoC★ 4

D-Link R95 (BE9500) DHMAPI SetTimeSettings command injection -> root RCE PoC (CVE-2026-93958); for authorized testing

CVE-2026-93958CRITICAL20 sep 2026

D-Link R95 DHMAPI ssi system os command injection

48RIESGO

GitHub PoC

CVE-2026-74469

CVE-2026-74469HIGH19 sep 2026

sctp: prevent peer transport count overflow

41RIESGO

GitHub PoC

IDOR/BOLA in Events Manager <= 7.4.3 REST ticket update endpoint — CVE-2026-93661

CVE-2026-93661LOW19 sep 2026

Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR

28RIESGO

GitHub PoC

CVE-2026-68121

CVE-2026-68121HIGH19 sep 2026

pppoe: reload header pointer after dev_hard_header()

41RIESGO

GitHub PoC

abhaybansal16/cve-2025-55182-lab

CVE-2025-55182CRITICALbajo ataqueransomware19 sep 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

CVE-2026-77635 - CakePHP - Critical 9.2 - Unauthenticated GET /?path= - SQL Injection

CVE-2026-77635CRITICAL19 sep 2026

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

48RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.