Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

80.842exploits catalogados

37.493CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.482Referência 23.901GitHub PoC 15.465VulnCheck XDB 9066Nuclei 4426Metasploit 3502✓ solo verificadosrecientes populares riesgo

80.842 exploits

GitHub PoC

Heartbleed (CVE-2014-0160) was devastating because it leaked adjacent memory. CTT-Heartbleed goes further—it uses 33-layer temporal resonance to map, reconstruct, and extract specific memory regions across time, not just adjacent buffers.

CVE-2014-0160HIGHbajo ataque28 ene 2026

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 1

0xLittleSpidy/CVE-2025-54309

CVE-2025-54309CRITICALbajo ataque27 ene 2026

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and

100RIESGO

VulnCheck XDB

initial-access

CVE-2024-50498CRITICAL27 ene 2026

WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

75RIESGO

VulnCheck XDB

client-side

CVE-2026-21509HIGHbajo ataque27 ene 2026

Microsoft Office Security Feature Bypass Vulnerability

93RIESGO

VulnCheck XDB

initial-access

CVE-2025-54309CRITICALbajo ataque27 ene 2026

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and

100RIESGO

GitHub PoC★ 1

Telnetd Auth Bypass Scanner (CVE-2026-24061) A Python-based scanner for detecting and exploiting the CVE-2026-24061 vulnerability in GNU Inetutils telnetd services. This tool scans IP addresses or networks for vulnerable telnetd services that allow authentication bypass leading to root shell access.

CVE-2026-24061CRITICALbajo ataque27 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC

Simple and effective PoC for CVE-2021-43798 Grafana Path Traversal

CVE-2021-43798HIGHbajo ataque27 ene 2026

Grafana path traversal

100RIESGO

GitHub PoC

Payload CVE-2026-24061

CVE-2026-24061CRITICALbajo ataque27 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC

An advanced exploit for Microsoft Exchange Server (CVE-2021-26855, CVE-2021-27065) enhanced with Convergent Time Theory principles, achieving near-perfect theoretical rating through quantum temporal resonance and α-dispersion techniques.

CVE-2021-26855CRITICALbajo ataqueransomware27 ene 2026

Microsoft Exchange Server Remote Code Execution Vulnerability

100RIESGO

GitHub PoC

androidteacher/CVE-2026-24061-PoC-Telnetd

CVE-2026-24061CRITICALbajo ataque27 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC★ 4

This is a security exploit tool targeting CVE-2025-55182. It exploits a Remote Code Execution (RCE) vulnerability in React Server Components

CVE-2025-55182CRITICALbajo ataqueransomware27 ene 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

Arguments to reject CVE-2025-56005

CVE-2025-56005CRITICAL27 ene 2026

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the

53RIESGO

GitHub PoC

Looking at current high-impact vulnerabilities, let's use the VMware vCenter Server CVE-2021-21972 (CVSS 9.8) as our base. This is a publicly known RCE with patches available, perfect for demonstrating CTT enhancements.

CVE-2021-21972CRITICALbajo ataqueransomware27 ene 2026

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor

100RIESGO

GitHub PoC

androidteacher/CVE-2024-50498-wpquery

CVE-2024-50498CRITICAL27 ene 2026

WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

75RIESGO

GitHub PoC

Sn0wBaall/CVE-2024-23334-PoC

CVE-2024-23334MEDIUM27 ene 2026

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

70RIESGO

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALbajo ataque27 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALbajo ataque27 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

VulnCheck XDB

info-leak

CVE-2026-25253HIGH27 ene 2026

OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically mak

46RIESGO

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALbajo ataqueransomware27 ene 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALbajo ataque27 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALbajo ataque27 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC★ 1

FurkanKAYAPINAR/CVE-2026-24061-telnet2root

CVE-2026-24061CRITICALbajo ataque27 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC

CVE-2026-24061-Scanner by XsanLahci

CVE-2026-24061CRITICALbajo ataque26 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC

punitdarji/telnetd-cve-2026-24061

CVE-2026-24061CRITICALbajo ataque26 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-24893CRITICALbajo ataque26 ene 2026

Remote code execution as guest via SolrSearchMacros request in xwiki

100RIESGO

VulnCheck XDB

remote-with-credentials

CVE-2026-24061CRITICALbajo ataque26 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

VulnCheck XDB

local

CVE-2023-38817—26 ene 2026

An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to th

23RIESGO

GitHub PoC

🔍 Analyze WebKit and ANGLE vulnerabilities with this repository for CVE-2025-43529 and CVE-2025-14174, focusing on verified components and ongoing efforts.

CVE-2025-43529HIGHbajo ataque26 ene 2026

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and

71RIESGO

GitHub PoC

Spring Cloud Gateway SpEL RCE Vulnerability Environment

CVE-2025-41243CRITICAL26 ene 2026

Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

63RIESGO

VulnCheck XDB

remote-with-credentials

CVE-2009-3103—26 ene 2026

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Window

60RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.