Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

76.107exploits catalogados

34.679CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.443Referência 21.692GitHub PoC 13.812VulnCheck XDB 8460Nuclei 4233Metasploit 3467✓ solo verificadosrecientes populares riesgo

21.692 exploits

Referência

CVE-2026-17459

CVE-2026-17459MEDIUM

perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink

33RIESGO

abrir ↗

Referência

CVE-2018-4404

CVE-2018-4404HIGH

In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improve

61RIESGO

abrir ↗

Referência

CVE-2026-17458

CVE-2026-17458MEDIUM

mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-17457

CVE-2026-17457MEDIUM

mf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-65010

CVE-2026-65010MEDIUM

Datasets Symlink-following Arbitrary File Write via Extractor.extract()

33RIESGO

abrir ↗

Referência

CVE-2026-63765

CVE-2026-63765HIGH

Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation

41RIESGO

abrir ↗

Referência

CVE-2018-5702

CVE-2018-5702—

Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access con

28RIESGO

abrir ↗

Referência

CVE-2026-38764

CVE-2026-38764HIGH

An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kerne

41RIESGO

abrir ↗

Referência

CVE-2026-16628

CVE-2026-16628MEDIUM

oclif JIT Plugin Entry child_process.exec os command injection

33RIESGO

abrir ↗

Referência

CVE-2026-65013

CVE-2026-65013HIGH

Onlook tRPC Insecure Direct Object Reference via multiple procedures

41RIESGO

abrir ↗

Referência

CVE-2026-12968

CVE-2026-12968HIGH

Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload

41RIESGO

abrir ↗

Referência

CVE-2026-16490

CVE-2026-16490MEDIUM

itsourcecode Hospital Management System prescription.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-8989

CVE-2026-8989HIGH

Open Recovery Mode

41RIESGO

abrir ↗

Referência

CVE-2026-8988

CVE-2026-8988HIGH

Access to Bootloader

41RIESGO

abrir ↗

Referência

CVE-2026-8982

CVE-2026-8982CRITICAL

Hard-coded / Backdoor Accounts

48RIESGO

abrir ↗

Referência

CVE-2016-20096

CVE-2016-20096CRITICAL

Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp

48RIESGO

abrir ↗

Referência

CVE-2026-16451

CVE-2026-16451MEDIUM

zsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-64824

CVE-2026-64824CRITICAL

Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

48RIESGO

abrir ↗

Referência

CVE-2026-16450

CVE-2026-16450MEDIUM

zsadmin2025 ZS-Admin MyBatis-Plus Tenant Plugin page getTenantId authorization

33RIESGO

abrir ↗

Referência

CVE-2026-16449

CVE-2026-16449MEDIUM

zsadmin2025 ZS-Admin com.zs.sys.dept.controller.SysDeptController page OrderItem.desc sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-16448

CVE-2026-16448MEDIUM

D-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection

33RIESGO

abrir ↗

Referência

CVE-2026-16331

CVE-2026-16331MEDIUM

D-Link DNS-320 save_ajax.php unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-16330

CVE-2026-16330MEDIUM

D-Link DNS-320 uploadify.php unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-16327

CVE-2026-16327MEDIUM

D-Link DNS-320 upload.php unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-16324

CVE-2026-16324MEDIUM

Metasoft 美特软件 MetaCRM upload.jsp unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-63770

CVE-2026-63770HIGH

Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass

41RIESGO

abrir ↗

Referência

CVE-2026-63771

CVE-2026-63771MEDIUM

Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header

33RIESGO

abrir ↗

Referência

CVE-2026-15535

CVE-2026-15535MEDIUM

AkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization

33RIESGO

abrir ↗

Referência

CVE-2026-15481

CVE-2026-15481HIGH

Trendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injection

41RIESGO

abrir ↗

Referência

CVE-2026-15480

CVE-2026-15480HIGH

Trendnet TEW-635BRM Web Service rc start_httpd stack-based overflow

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.