Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.464 exploits
GitHub PoC★ 24
Independent discovery & coordinated disclosure: CoreMedia bytestream XPC (mediaplaybackd) vended live file descriptors for protected paths to any sandboxed app on iOS 26.5–27.0.1. Fixed in iOS 27.2 as CVE-2026-112706. PoC + evidence.
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS
33RIESGO
abrir ↗GitHub PoC★ 1
Script avanzado del motor de scripting de Nmap (NSE) diseñado para identificar vulnerabilidades de PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Ofrece análisis de caja negra multicapa resistente a WAF, proxies y eliminación de encabezados.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Unofficial rebuild of Remi's php80-php 8.0.30-21 SCL packages for CentOS/RHEL 7 (EOL). Includes all 44 CVE fixes between Remi -6 and -21, among them CVE-2026-109618 / CVE-2026-109619 (PHP2Shell).
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Hands-on PHP2Shell workshop: Docker labs, guided debugging, and annotated exploits for CVE-2026-109618 and CVE-2026-109619.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Multi-worker exploitation of the PHP 8.5 OOM-to-RCE chain (CVE-2026-109618/109619): pool pinning, measured
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
Remote Zend MM ASLR leak testbed (PHP CVE-2026-109618 / CVE-2026-109619)
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
php2shell (CVE-2026-109618/109619) reproduction lab — lab only, targets the vulnerable php:8.5.11 images
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Security-patched php56 RPMs for Amazon Linux 1 (AMI 2018.03): PHP2Shell (CVE-2026-109618, CVE-2026-109619) and post-5.6.40 fixes backported from deb.sury.org
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Reproducible RHITE fixed PHP runtime images for CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
One-click exploit PoC for CVE-2026-109618 and CVE-2026-109619 against vulnerable PHP + Apache mod_php (prefork) targets.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
[PHP2Shell] Golang exploit for CVE-2026-109618 / CVE-2026-109619: Unauthenticated RCE in PHP 5.4–8.5.11 via OOM corruption + session.upload_progress UAF
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Detection-only triage scanner for MLflow scorer RCE CVE-2026-116692: version check via the /version endpoint. No payloads, no scorer invocation.
MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules
48RIESGO
abrir ↗GitHub PoC
paktiko1986/CVE-2026-96778-pillow
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
41RIESGO
abrir ↗GitHub PoC
Offline Python detector for CVE-2026-15723 version exposure in self-managed GitLab CE/EE, with CSV/JSON inventories and auditable reports.
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
41RIESGO
abrir ↗GitHub PoC
Triagem de Alerta SOC 335, que destaca a exploração da vulnerabilidade CVE-2024-49138 , uma vulnerabilidade de escalonamento de privilégios do Windows.
Windows Common Log File System Driver Elevation of Privilege Vulnerability
76RIESGO
abrir ↗GitHub PoC
Práctica Integradora de Ciberseguridad (Comisión 1) - Investigación, análisis técnico y laboratorio práctico de CVE-2021-41773 (Apache HTTP Server)
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
48RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC
sachincool/cve-2026-84383-poc
libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items
48RIESGO
abrir ↗GitHub PoC★ 4
CVE-2026-98260 (posix-cpu-timers exec UAF) exploit research: S9280 Android 14 GKI 6.1 — UAF trigger + zero-write primitive + SELinux Permissive. Handoff doc in HANDOFF.md
exec: Cleanup POSIX timers right after de_thread()
41RIESGO
abrir ↗GitHub PoC
sudo5Q/CVE-2026-38056-PoC
ST Engineering iDirect iQ-Series Terminals Missing Authorization
48RIESGO
abrir ↗GitHub PoC★ 2
Research notes on CVE-2026-101767 — unauthenticated vulnerability in Oracle Application Object Library (E-Business Suite)
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported
48RIESGO
abrir ↗VulnCheck XDB
initial-access
Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
63RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.