Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.678exploits catalogados

40.947CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.571Exploit-DB 24.489GitHub PoC 18.430VulnCheck XDB 11.064Nuclei 4584Metasploit 3540✓ solo verificadosrecientes populares riesgo

88.680 exploits

GitHub PoC★ 2

⚠️ DISCLAIMER: This tool is intended for authorized penetration testing and educational purposes only. Using this tool against systems without explicit written permission is illegal. The developers are not responsible for any misuse or damage caused.

CVE-2026-41940CRITICALbajo ataqueransomware27 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC

PrintNightmare Report

CVE-2021-34527HIGHbajo ataqueransomware27 may 2026

Windows Print Spooler Remote Code Execution Vulnerability

100RIESGO

GitHub PoC

SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298) Walkthrough

CVE-2025-21298CRITICAL27 may 2026

Windows OLE Remote Code Execution Vulnerability

70RIESGO

GitHub PoC

thinhap/CVE-2026-9082-PoC

CVE-2026-9082CRITICALbajo ataque27 may 2026

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

100RIESGO

GitHub PoC★ 1

mein-0/cve-2026-0828

CVE-2026-0828HIGH27 may 2026

Kernel driver vulnerability in Safetica Endpoint Client

41RIESGO

GitHub PoC★ 3

Ghost Content API SQL Injection

CVE-2026-26980CRITICAL27 may 2026

Ghost has a SQL Injection in its Content API

85RIESGO

GitHub PoC

This exploit is based on CVE-2019-6340 and was built upon the original exploit by leonjza and the Metasploit module, extending it can be executed multiple times against the same target without waiting for cache expiration.

CVE-2019-6340HIGHbajo ataque27 may 2026

Drupal core - Highly critical - Remote Code Execution

100RIESGO

GitHub PoC★ 1

Starlette Host-Header URL Confusion Lab (X41-2026-002) - CVE-2026-48710

CVE-2026-48710MEDIUMbajo ataque27 may 2026

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

100RIESGO

Exploit-DB

Realtek rtl819x - Local Privilege

CVE-2026-36355HIGHlocallinux27 may 2026

The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perfo

41RIESGO

GitHub PoC★ 1

CVE-2026-45659

CVE-2026-45659HIGHbajo ataqueransomware27 may 2026

Microsoft SharePoint Remote Code Execution Vulnerability

93RIESGO

GitHub PoC

Lab 3: Supervisord XML-RPC Remote Code Execution (CVE-2017-11610) - Writeup and Exploit

CVE-2017-11610—27 may 2026

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows rem

60RIESGO

GitHub PoC

hadhub/CVE-2026-49344-Mercator-JSON-DSL

CVE-2026-49344HIGH27 may 2026

Mercator has a Personal Identifiable Information Leak from Query Executor feature

21RIESGO

GitHub PoC

SSRF Discovered in Mercator

CVE-2026-49345MEDIUM27 may 2026

Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)

13RIESGO

Exploit-DB

Linux Kernel - Local Privilege Escalation

CVE-2026-43500HIGHlocallinux27 may 2026

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

78RIESGO

Exploit-DB

scramble - Remote Code Execution

CVE-2026-44262CRITICALwebappsphp27 may 2026

Scramble: Remote code execution via evaluation of user-controlled input in validation rules

63RIESGO

GitHub PoC

lwd3c/CVE-2026-47342

CVE-2026-47342HIGH27 may 2026

Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass

21RIESGO

VulnCheck XDB

initial-access

CVE-2017-11610—27 may 2026

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows rem

60RIESGO

GitHub PoC

CVE-2021-3560 — Polkit privilege escalation exploit via accounts-daemon D-Bus race condition

CVE-2021-3560HIGHbajo ataque27 may 2026

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile

91RIESGO

GitHub PoC

CVE-2026-27771

CVE-2026-27771HIGH27 may 2026

Gitea Composer package source links use insufficient permission checks

56RIESGO

VulnCheck XDB

initial-access

CVE-2026-20182CRITICALbajo ataque26 may 2026

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

100RIESGO

Exploit-DB

Grav CMS 2.0.0-beta.2 - Remote Code Execution

CVE-2026-42607CRITICALwebappsphp26 may 2026

Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

48RIESGO

GitHub PoC★ 2

Proof-of-concept for CVE-2026-43284 — 4-byte XFRM/ESP page-cache write primitive to patch a setuid binary (x86_64, user namespaces). Includes kernel preflight + SUID scan.

CVE-2026-43284HIGH26 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

GitHub PoC

Dungsocool/CVE-2017-5638

CVE-2017-5638CRITICALbajo ataqueransomware26 may 2026

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RIESGO

GitHub PoC★ 3

CVE-2026-82090 · CVSS 9.2 CRITICAL · 0-click stored XSS in Mozilla Pocket — all versions (v0 → v8.33.0.0) · 18-year forever-day · no patch · MITRE published

CVE-2026-82090CRITICAL26 may 2026

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alt

48RIESGO

GitHub PoC

CVE-2026-6741 is a CVSS 8.8 (High) Authenticated (Agent+) Privilege Escalation vulnerability in the LatePoint – Calendar Booking Plugin

CVE-2026-6741HIGH26 may 2026

LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability

41RIESGO

GitHub PoC

CVE-2026-5718: Unauthenticated File Upload To RCE in DnD Upload CF7 Plugin

CVE-2026-5718HIGH26 may 2026

Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass

56RIESGO

Exploit-DB

Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service

CVE-2026-23918HIGHwebappsmultiple26 may 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

GitHub PoC

xxconi/CVE-2026-6271

CVE-2026-6271CRITICAL26 may 2026

Career Section <= 1.7 - Unauthenticated Arbitrary File Upload

48RIESGO

GitHub PoC

CVE-2026-5364 is a CVSS 8.1 (High) Unauthenticated Arbitrary File Upload vulnerability in the Drag and Drop File Upload for Contact Form 7

CVE-2026-5364HIGH26 may 2026

Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass

41RIESGO

GitHub PoC★ 1

Working exploit for ssrf issue reported in CVE-2026–45401

CVE-2026-45401HIGH26 may 2026

Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints

41RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.