Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.636exploits catalogados

40.917CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.560Exploit-DB 24.489GitHub PoC 18.399VulnCheck XDB 11.064Nuclei 4584Metasploit 3540✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC★ 2

CVE-2025-24813 - Apache Tomcat RCE via Session Deserialization - PoC Exploit

CVE-2025-24813CRITICALbajo ataque12 jul 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RIESGO

abrir ↗

GitHub PoC

CVE-2023-4911 (Looney Tunables) analysis report and Docker reproduction lab

CVE-2023-4911HIGHbajo ataque12 jul 2026

Glibc: buffer overflow in ld.so leading to privilege escalation

98RIESGO

abrir ↗

GitHub PoC★ 2

Wordpress Plugin Planyo Online Reservation System <= 3.0 - Arbitrary File Read via SSRF

CVE-2026-3576HIGH12 jul 2026

Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter

56RIESGO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-43866 — Apache Camel camel-jms forged DefaultExchangeHolder bypass of the CVE-2026-40860 deserialization filter (Exchange-state injection)

CVE-2026-43866HIGH12 jul 2026

Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder

41RIESGO

abrir ↗

GitHub PoC★ 2

Hunt-Benito/samsung-bixby-command-execution-cve-2026-21055-improper-component-export

CVE-2026-21055HIGH12 jul 2026

Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute a

41RIESGO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-43865 — Apache Camel camel-hazelcast default-configured instance unsafe Java deserialization (RCE)

CVE-2026-43865HIGH12 jul 2026

Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

41RIESGO

abrir ↗

GitHub PoC

Write-up and exploitation steps for the pedit COW vulnerability (CVE-2026-46331)

CVE-2026-46331HIGH12 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-41773HIGHbajo ataqueransomware12 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-4631CRITICAL12 jul 2026

Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

68RIESGO

abrir ↗

GitHub PoC

Unauthenticated Remote Code Execution via SSH Command-Line Argument Injection Cockpit versions 327 – 359 | CVSS 9.8 Critical | CWE-78

CVE-2026-4631CRITICAL12 jul 2026

Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

68RIESGO

abrir ↗

GitHub PoC★ 226

CVE-2026-43499 Implementation for 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k

CVE-2026-43499HIGH12 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC★ 3

GhostLock - CVE-2026-43499 backport patch for openVZ 7

CVE-2026-43499HIGH12 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC★ 269

GhostLock (CVE-2026-43499) kernel exploit for OnePlus devices with locked bootloader

CVE-2026-43499HIGH12 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC★ 94

基于 CVE-2026-43499 的 8E5 机型自动化解锁辅助工具，仅限授权安全研究与自有设备使用。

CVE-2026-43499HIGH12 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2019-0232 - Apache Tomcat CGIServlet enableCmdLineArguments RCE - PoC Exploit

CVE-2019-0232—12 jul 2026

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RIESGO

abrir ↗

GitHub PoC★ 1

Dahua CVE-2026-29115

CVE-2026-29115MEDIUM11 jul 2026

A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially c

33RIESGO

abrir ↗

GitHub PoC

Wazuh + Suricata SOC lab detecting real exploits (CVE-2011-2523) and brute-force attacks, with custom detection rules for gaps in default IDS signatures.

CVE-2011-2523—11 jul 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-42527 — Apache Camel permissive default ObjectInputFilter admits java.net.URL, enabling a DNS-based out-of-band side channel

CVE-2026-42527HIGH11 jul 2026

Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

41RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-56291CRITICALbajo ataque11 jul 2026

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1

98RIESGO

abrir ↗

VulnCheck XDB

local

CVE-2026-46331HIGH11 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

abrir ↗

VulnCheck XDB

local

CVE-2016-5195HIGHbajo ataque11 jul 2026

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-29078—11 jul 2026

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[

50RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2019-15107CRITICALbajo ataqueransomware11 jul 2026

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-0740CRITICAL11 jul 2026

Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

75RIESGO

abrir ↗

GitHub PoC

Cybersecurity Capstone Project completed during the NCSC Nashama CyberCamp 11, delivered in collaboration with IT Security C&T. The project demonstrates vulnerability assessment, exploitation, mitigation, and SIEM detection for Oracle WebLogic (CVE-2017-10271) and Apache Druid (CVE-2021-25646).

CVE-2017-10271HIGHbajo ataqueransomware11 jul 2026

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

100RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2021-43798HIGHbajo ataque11 jul 2026

Grafana path traversal

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-41773HIGHbajo ataqueransomware11 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-23744CRITICAL11 jul 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

GitHub PoC★ 1

Azure IoT Hub where exposure of an owner-level Shared Access Key enables unauthenticated remote code execution (RCE) against connected IoT devices. Proof-Of-Concept

CVE-2026-13768CRITICAL11 jul 2026

Gardyn IoT Hub Use of Hard-coded Credentials

48RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2019-1003030CRITICALbajo ataque11 jul 2026

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.