Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.464exploits catalogados

40.695CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientes populares riesgo

87.464 exploits

GitHub PoC

CVE-2026-75650 (StyleSmuggler): unauthenticated RCE via template injection in Magento Open Source / Adobe Commerce 2.4.4–2.4.9 — b63 showcase, lab-verified with patched-build negative test

CVE-2026-75650CRITICALbajo ataque26 oct 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

100RIESGO

GitHub PoC★ 46

villager1314/CVE-2026-98260-Analysis

CVE-2026-98260HIGH26 oct 2026

exec: Cleanup POSIX timers right after de_thread()

41RIESGO

GitHub PoC★ 2

Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, no dependencies or exploit payloads.

CVE-2026-111497CRITICAL26 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC★ 1

Audit & Vulnerability Detection Scanner for PHP2Shell (CVE-2026-109618 & CVE-2026-109619) with Hardening Guidelines

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC★ 1

Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, no dependencies or exploit payloads.

CVE-2026-111497CRITICAL26 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC★ 3

Check whether a website is affected by PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC★ 1

node2shell-detector - local + network detections for Node2Shell (CVE-2026-111497) by IONSEC. Python CLI: runtime posture, Brotli decoder fingerprints, dependency exposure, log fingerprints, opt-in self-test; plus Sigma, Suricata, ModSecurity, YARA rules and edge/app snippets.

CVE-2026-111497CRITICAL26 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC

Detection-only triage scanner for PHP2Shell CVE-2026-109618 / CVE-2026-109619: PHP version fingerprinting, SAPI detection, and local php.ini audit. No exploit payloads.

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

Next.js Middleware Bypass CVE-2025-29927 Mitigation work (Ansible Role)

CVE-2025-29927CRITICAL26 oct 2026

Authorization Bypass in Next.js Middleware

85RIESGO

GitHub PoC

Reproducible local Docker lab for CVE-2026-109618 PHP-FPM validation

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

PHP 8.2.35 rebuild (CVE-2026-109618 / CVE-2026-109619 fix, no telemetry) for Ubuntu 24.04 hosts running php8.2 8.2.7-1ubuntu1

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

This is a Exploit Code For CVE-2021-3560 - Polkit Privilege Escalation Develop using Bash Language.

CVE-2021-3560HIGHbajo ataque26 oct 2026

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile

91RIESGO

GitHub PoC

regreSSHion CVE-2024-6387 Mitigation work (Ansible Role)

CVE-2024-6387HIGH26 oct 2026

Openssh: regresshion - race condition in ssh allows rce/dos

63RIESGO

VulnCheck XDB

initial-access

CVE-2026-114509CRITICAL26 oct 2026

Laravel TokenGuard authentication bypass through non-string API credentials

63RIESGO

GitHub PoC

Python PoC for CVE-2026-106173 unauthenticated path-traversal file write in FortiSIEM's QueryResult gRPC handler.

CVE-2026-106173CRITICAL26 oct 2026

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5

48RIESGO

GitHub PoC

NXP Semiconductors USB middleware <2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset.

CVE-2026-116487MEDIUM26 oct 2026

NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

33RIESGO

GitHub PoC

Claude Code plugin: audit and patch PHP2Shell (CVE-2026-109618/109619) on Debian/Ubuntu PHP servers

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

PoC / exploit archive for CVE-2026-109618

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC★ 1

This was the exploit released by Offsec for CVE-2026-109618 on 23rd October 2026. Source: https://www.exploit-db.com/exploits/52704

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC★ 1

NXP Semiconductors USB middleware <2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values.

CVE-2026-116488HIGH26 oct 2026

NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers

41RIESGO

GitHub PoC★ 2

Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, no dependencies or exploit payloads.

CVE-2026-111497CRITICAL26 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC

formbricks 5.1.4 with Node.js 24.22.1 (CVE-2026-111497 and others) swapped in

CVE-2026-111497CRITICAL26 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC

PHP2Shell（CVE-2026-109618 / CVE-2026-109619）远程批量检测工具

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

Brotli decoder CVE-2026-111497 Mitigation work (Ansible Role)

CVE-2026-111497CRITICAL26 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC

PwnKit CVE-2021-4034 Mitigation work (Ansible Role)

CVE-2021-4034HIGHbajo ataqueransomware26 oct 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

VulnCheck XDB

local

CVE-2016-5195HIGHbajo ataque26 oct 2026

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RIESGO

VulnCheck XDB

denial-of-service

CVE-2021-31166CRITICALbajo ataque26 oct 2026

HTTP Protocol Stack Remote Code Execution Vulnerability

100RIESGO

VulnCheck XDB

initial-access

CVE-2024-7314CRITICAL26 oct 2026

anji-plus AJ-Report Authentication Bypass

75RIESGO

GitHub PoC

Secure REST API with CI/CD security scanning (Bandit SAST + pip-audit SCA) and a reproducible CVE-2017-1000028 lab (GlassFish 4.1)

CVE-2017-1000028—26 oct 2026

Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trave

60RIESGO

GitHub PoC

A local Docker environment and proof of concept for Node2Shell (CVE-2026-111497)

CVE-2026-111497CRITICAL26 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.