Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.554exploits catalogados
39.165CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientespopularesriesgo
16.153 exploits
GitHub PoC
Standalone PoC for CVE-2026-90782: status-clobbering NULL dereference in S2OPC alloc_notification_message_items() (DataChange fails, Event succeeds)
S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()
33RIESGO
abrir ↗GitHub PoC★ 2
CVE-2019-2215 & DirtyCOW exploit automation + post-root debloat + Magisk modules for Sony BRAVIA KDL-43W800C
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RIESGO
abrir ↗GitHub PoC
My implementation of the
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
98RIESGO
abrir ↗GitHub PoC
hands on investigation of the heartbleed vulnerability (CVE-2014-0160).
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RIESGO
abrir ↗GitHub PoC
CVE-2026-85706 — GitLab unauthenticated arbitrary file read (CVSS 10.0). Root-cause analysis, vulnerable Docker lab, and PoC.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read exploit PoC.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC★ 4
Public release of CVE-2026-87492 🥷
Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially exe
48RIESGO
abrir ↗GitHub PoC★ 1
miniOrange 2FA CVE POC
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator
48RIESGO
abrir ↗GitHub PoC
brigadeops32/CVE-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
Autonomous AI agent with its own crypto identity — hunts CVEs, builds exploit labs, validates vulnerabilities (first public PoC of CVE-2026-86283), trades crypto 24/7 to fund itself. Sentric Research.
MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
41RIESGO
abrir ↗GitHub PoC
Full home-lab penetration test of Rapid7's Metasploitable3 (Ubuntu 14.04) from Parrot OS. Covers recon, Drupalgeddon (CVE-2014-3704) RCE, SSH credential reuse, privilege escalation to root, and reverse shells. Written as a workable report — feed it back and re-run the whole lab.
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RIESGO
abrir ↗GitHub PoC
Standalone reproducer for CVE-2026-90781: 1-byte OOB write in alsa-lib __snd_ctl_ascii_elem_id_parse() name= parsing (quoted and unquoted)
alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()
33RIESGO
abrir ↗GitHub PoC
Safe local proof of concept for the Cotonti CommentsWidget PHP object injection vulnerability (CAN-2026-2035973 / CVE-2026-71294).
Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions
41RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-85706 · GitLab CE/EE unauthenticated file read · research PoC with oracle mode, fd enumeration, and tiered loot targeting
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
CVE-2026-65343 PoC — AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71)
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.
41RIESGO
abrir ↗GitHub PoC
POC GitLab CE/EE unauthenticated arbitrary file read vulnerability (CVE-2026-85706).
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
Dependency-free PoC generator for CVE-2025-24071 — Windows File Explorer .library-ms NTLM hash disclosure via crafted ZIP
Microsoft Windows File Explorer Spoofing Vulnerability
38RIESGO
abrir ↗GitHub PoC
University Project of developing a template for safely testing for the CVE 2025-24813 on a server. It is intentionally made to not leave any lasting artifacts on the server and does not disrupt its activities.
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗GitHub PoC
Defensive IOC and detection toolkit for CVE-2026-86218, a critical pre-auth RCE in N-able N-central. Includes IOCs, log scanner, Sigma, Splunk, Elastic/KQL detections, and incident response guidance.
pre-authentication remote code execution
98RIESGO
abrir ↗GitHub PoC★ 1
Docmost < 0.22.0 - Arbitrary File Read
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local file
56RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-85706 — GitLab Path Traversal IOC Scanner & Detection Toolkit. Detect and hunt for exploitation of the critical unauthenticated GitLab CE/EE path traversal vulnerability with IOC scanning, Sigma, Suricata/Snort, and SIEM detection rules.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC★ 5
SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.
Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social en
33RIESGO
abrir ↗GitHub PoC
Apache Tomcat CVE-2025-24813 本地复现、利用条件分析与 AI 辅助验证记录
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗GitHub PoC
vanivamshi/CVE-2013-2028-Exploit
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
60RIESGO
abrir ↗GitHub PoC
Description Professional penetration testing assessment of the Sunset: Noontide VulnHub machine, covering reconnaissance, service enumeration, CVE-2010-2075 exploitation, post-exploitation, privilege escalation, and full system compromise.
UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally
60RIESGO
abrir ↗GitHub PoC★ 4
cve-2026-85706-poc-exploit-gitlab
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC★ 4
POC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
48RIESGO
abrir ↗GitHub PoC
Standalone proof of concept for CVE-2026-86547, a NULL pointer dereference in mrubyc op_enter() through 4.0.0.
mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.