Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.554exploits catalogados

39.165CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.153 exploits

GitHub PoC

Tracking TUNderflow (CVE-2026-81000), the Linux kernel TUN/TAP receive-headroom underflow

CVE-2026-81000HIGH18 sep 2026

net: tun: bound receive headroom

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-91843 - Draft or TODO

CVE-2026-91843CRITICAL18 sep 2026

Stack overflow in login process to the Security Management and Log Servers

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-18574 - Draft or TODO

CVE-2026-18574CRITICAL18 sep 2026

Authentication Bypass in Check Point Security Management Server

48RIESGO

abrir ↗

GitHub PoC

Tracking the Unbound CVE-2026-81642 DNSKEY digest heap overflow

CVE-2026-81642CRITICAL18 sep 2026

Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-77179 - Draft or TODO

CVE-2026-77179CRITICAL18 sep 2026

Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback

48RIESGO

abrir ↗

GitHub PoC

WP Import Export Lite < 3.9.33 - Authenticated Path Traversal to Sensitive File Disclosure

CVE-2026-76555MEDIUM18 sep 2026

WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal

33RIESGO

abrir ↗

GitHub PoC

CVE-2026-45140 - chamilo - Critical 9.8 - Unauthenticated POST /plugin/CStudio/editor/import-project... - Remote Code Execution

CVE-2026-45140CRITICAL18 sep 2026

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

48RIESGO

abrir ↗

GitHub PoC

Device-bound CVE-2026-64560 adaptation for RedMi K80pro miro OS 3.0.304.0

CVE-2026-64560HIGH18 sep 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RIESGO

abrir ↗

GitHub PoC

Enumerate Grafana plugin enumeration PoC for CVE-2021-43798

CVE-2021-43798HIGHbajo ataque18 sep 2026

Grafana path traversal

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-84753 - WPFunnels - Critical 9.8 - Unauthenticated POST /?rest_route=/mint-mail/v1/mint-form-... - PHP Object Injection

CVE-2026-84753CRITICAL18 sep 2026

WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

48RIESGO

abrir ↗

GitHub PoC

Tracking DirtyAH6 (CVE-2026-80844), the Linux kernel IPv6 AH routing-header out-of-bounds write

CVE-2026-80844—18 sep 2026

xfrm: ah6: validate routing header segments_left

23RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-93453 Exploit — SOGo password reset link poisoning via attacker-controlled Origin header, enabling password reset token interception and account takeover.

CVE-2026-93453HIGH18 sep 2026

SOGo before 5.12.11 Password Reset Token Interception via Origin Header

41RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-76461

CVE-2026-76461CRITICALbajo ataque17 sep 2026

Cisco Secure Email Gateway SQL Injection Vulnerability

83RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-85706 – GitLab Unauth File Read Toolkit (CVSS 10.0) | Red/Blue Team suite for self-managed GitLab CE/EE 18.7–19.3.1. 2 tools: Full Exploit (unauth file read, admin token, mass scan, loot, shell, stealth, SQLite/HTML/JSON output) etc., SafeChecker (version detect, audit, security headers, TLS check, MITRE). Only Use Ethically, Educ. <3

CVE-2026-85706CRITICALbajo ataque17 sep 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-12793 - JetFormBuilder Unauthorized RCE (CRITICAL 9.8)

CVE-2026-12793CRITICAL17 sep 2026

JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

48RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-49179: Active Directory WriteSPNScript Command Injection

CVE-2026-49179HIGH17 sep 2026

Windows Active Directory Domain Services Remote Code Execution Vulnerability

41RIESGO

abrir ↗

GitHub PoC★ 1

exploit para reverse shell en MCPJamInspector v1.4.2< por endpoint mal configurado

CVE-2026-23744CRITICAL17 sep 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

GitHub PoC★ 1

SneakyNachos/CVE-2026-85048-the-gpu-died

CVE-2026-85048HIGH17 sep 2026

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the

41RIESGO

abrir ↗

GitHub PoC

isaca0315/CVE-2026-44840-poc

CVE-2026-44840HIGH17 sep 2026

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

41RIESGO

abrir ↗

GitHub PoC

A Python-based security tool for checking sudo versions for potential exposure to CVE-2021-3156 (Baron Samedit). Designed for authorized security testing and learning.

CVE-2021-3156HIGHbajo ataque17 sep 2026

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

abrir ↗

GitHub PoC

Educational cyber range for CVE-2026-59827 (Metabase H2 unsafe deserialization / CWE-502). Isolated Docker lab — training only, not for attacking production Metabase.

CVE-2026-59827CRITICAL17 sep 2026

Metabase: Unsafe Deserialization of H2 Query Results

48RIESGO

abrir ↗

GitHub PoC★ 1

Forensic Analysis and Local Replication of the OpenAI-Artifactory Privilege Escalation Incident (CVE-2026-65616)

CVE-2026-65616HIGH17 sep 2026

Potential privilege escalation to JFrog administrator privileges

41RIESGO

abrir ↗

GitHub PoC

SangSenimanWartefak/CVE-2026-80467

CVE-2026-80467HIGH17 sep 2026

Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-85706

CVE-2026-85706CRITICALbajo ataque17 sep 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-87930 Joomla Multi-CVE RCE suite — authorized testing only

CVE-2026-87930CRITICAL17 sep 2026

MaxSite CMS through 109.6 PHP Object Injection via ci_session

48RIESGO

abrir ↗

GitHub PoC★ 5

PoC for CVE-2026-67401 — cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE. Includes a self-contained vulnerable lab, SQLi detection, and full exploit chain.

CVE-2026-67401CRITICAL17 sep 2026

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-48908 SP Page Builder (Joomla) unauth RCE suite — authorized testing only

CVE-2026-48908CRITICALbajo ataque17 sep 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

100RIESGO

abrir ↗

GitHub PoC★ 2

Unbounded memory allocation in NanaZip's UFS handler via an attacker-controlled `fs_bsize` field.

CVE-2026-55781LOW17 sep 2026

NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields

28RIESGO

abrir ↗

GitHub PoC

Isolated educational FreePBX-compatible cyber range for CVE-2025-57819 (CWE-89/CWE-288). Docker lab — not official Sangoma FreePBX.

CVE-2025-57819CRITICALbajo ataque17 sep 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RIESGO

abrir ↗

GitHub PoC

Issabel pbxapi hard coded JWT RCE POC

CVE-2026-89026CRITICAL17 sep 2026

Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

48RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.