Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.554exploits catalogados

39.165CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.153 exploits

GitHub PoC★ 2

PoC for CVE-2026-17633 — Authenticated RCE in IBM Langflow OSS 1.0.0–1.10.3 via custom_component endpoint. Includes CVE-2026-17632 AST scanner bypass research.

CVE-2026-17633HIGH15 sep 2026

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

41RIESGO

GitHub PoC

e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-24813

CVE-2025-24813CRITICALbajo ataque15 sep 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RIESGO

GitHub PoC★ 12

PoC for CVE-2026-59346 - 32-bit integer overflow in VMware's VMXNET3 TSO segmentation path, guest-to-host crash.

CVE-2026-59346CRITICAL15 sep 2026

VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability

48RIESGO

GitHub PoC

Testing for CVE-2025-8191

CVE-2025-8191MEDIUM15 sep 2026

macrozheng mall Swagger UI index.html cross site scripting

33RIESGO

GitHub PoC★ 3

Langflow 1.10.0 urllib SSRF POC

CVE-2026-12944CRITICAL15 sep 2026

Incomplete Security Scanner Blocklist Enables Network-Based Code Execution

48RIESGO

GitHub PoC

FLX-0x00/CVE-2026-59550

CVE-2026-59550CRITICAL15 sep 2026

WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability

48RIESGO

GitHub PoC

Authenticated Arbitrary File Upload leading to Remote Code Execution Technical analysis and controlled reproduction of CVE-2026-38526 in Webkul Krayin CRM 2.2.x.

CVE-2026-38526CRITICAL15 sep 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

GitHub PoC

fix for not working exploit script on exploitdb (50057.py)

CVE-2009-2265—15 sep 2026

Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable fil

60RIESGO

GitHub PoC

Si13NTTT/CVE-2025-24813

CVE-2025-24813CRITICALbajo ataque15 sep 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RIESGO

GitHub PoC

isaca0315/CVE-2026-65013-BOLA-IDOR

CVE-2026-65013HIGH15 sep 2026

Onlook tRPC Insecure Direct Object Reference via multiple procedures

41RIESGO

GitHub PoC★ 1

NONAME-ELV/CVE-2026-48907

CVE-2026-48907CRITICALbajo ataque15 sep 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

98RIESGO

GitHub PoC★ 2

CVE-2026-76461

CVE-2026-76461CRITICALbajo ataque15 sep 2026

Cisco Secure Email Gateway SQL Injection Vulnerability

83RIESGO

GitHub PoC

0xf9b6a41ec/CVE-2026-69328

CVE-2026-69328HIGH15 sep 2026

Windows Storage Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC

CVE-2026-15315, CVE-2026-15316 - Draft or TODO

CVE-2026-15315HIGH15 sep 2026

Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200

41RIESGO

GitHub PoC★ 2

CVE-2026-65343: OOB read in AppleKeyStore.kext (_LibSer_SEPControl_Deserialize) copies an ACM buffer to userspace without length validation, letting sandboxed processes leak kernel pointers (0xfffffff0…) and defeat KASLR via DYLD_INTERPOSE ACM handle capture. Fixed in iOS 26.6.1 (23G83).

CVE-2026-65343HIGH15 sep 2026

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.

41RIESGO

GitHub PoC

Laboratorio académico de análisis y explotación de CVE-2025-5548 en FreeFloat FTP Server 1.0.

CVE-2025-5548MEDIUM15 sep 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RIESGO

GitHub PoC★ 4

CVE-2026-82329 – JFrog Artifactory Auth Bypass Toolkit (CVSS 9.8) | Red/Blue Team suite for self-hosted Artifactory 7.x (111-161). 2 tools: Full Exploit (JWTforge, admin token, user create, mass scan, stealth, interactive menu, resistence, WAF bypass etc.), SafeChecker (version detect, audit, JSON report). 🦾 Use Ethically, Stay Legal :V

CVE-2026-82329CRITICALbajo ataque15 sep 2026

Potential authentication bypass leading to administrative access in Artifactory

98RIESGO

GitHub PoC

Tenda Technology Co., Ltd NVR_4H: CH3 v2.1.V27.5.58.6 was discovered to contain a hardcoded cryptographic key.

CVE-2026-79551HIGH15 sep 2026

Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.

41RIESGO

GitHub PoC

CVE-2026-85706 — GitLab unauthenticated arbitrary file read (CVSS 10.0). Root-cause analysis, vulnerable Docker lab, and PoC.

CVE-2026-85706CRITICALbajo ataque14 sep 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

100RIESGO

GitHub PoC

POC of cve-2026-52910

CVE-2026-52910HIGH14 sep 2026

bpf: Free reuseport cBPF prog after RCU grace period.

41RIESGO

GitHub PoC

hands on investigation of the heartbleed vulnerability (CVE-2014-0160).

CVE-2014-0160HIGHbajo ataque14 sep 2026

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC

Standalone PoC for CVE-2026-90782: status-clobbering NULL dereference in S2OPC alloc_notification_message_items() (DataChange fails, Event succeeds)

CVE-2026-90782MEDIUM14 sep 2026

S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()

33RIESGO

GitHub PoC

Si13NTTT/CVE-2025-32432

CVE-2025-32432CRITICALbajo ataque14 sep 2026

Craft CMS Allows Remote Code Execution

100RIESGO

GitHub PoC★ 2

CVE-2019-2215 & DirtyCOW exploit automation + post-root debloat + Magisk modules for Sony BRAVIA KDL-43W800C

CVE-2019-2215HIGHbajo ataque14 sep 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RIESGO

GitHub PoC

CVE-2026-85706 — GitLab unauthenticated arbitrary file read (CVSS 10.0). Root-cause analysis, vulnerable Docker lab, and PoC.

CVE-2026-85706CRITICALbajo ataque14 sep 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

100RIESGO

GitHub PoC

PwnKit - polkit pkexec Local Privilege Escalation <= 0.105-31

CVE-2021-4034HIGHbajo ataqueransomware14 sep 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

GitHub PoC

rh-rahulshetty/log4shell-CVE-2021-44228

CVE-2021-44228CRITICALbajo ataqueransomware14 sep 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC

e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-32432

CVE-2025-32432CRITICALbajo ataque14 sep 2026

Craft CMS Allows Remote Code Execution

100RIESGO

GitHub PoC

Knowns 0.30.0: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem

CVE-2026-88899CRITICAL14 sep 2026

knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

48RIESGO

GitHub PoC

CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read exploit PoC.

CVE-2026-85706CRITICALbajo ataque14 sep 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.