Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.464exploits catalogados

40.695CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientes populares riesgo

87.464 exploits

GitHub PoC★ 1

node2shell-detector - local + network detections for Node2Shell (CVE-2026-111497) by IONSEC. Python CLI: runtime posture, Brotli decoder fingerprints, dependency exposure, log fingerprints, opt-in self-test; plus Sigma, Suricata, ModSecurity, YARA rules and edge/app snippets.

CVE-2026-111497CRITICAL26 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC★ 2

Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, no dependencies or exploit payloads.

CVE-2026-111497CRITICAL26 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

VulnCheck XDB

initial-access

CVE-2025-31161CRITICALbajo ataqueransomware26 oct 2026

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RIESGO

VulnCheck XDB

initial-access

CVE-2017-5689CRITICALbajo ataque26 oct 2026

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALbajo ataque26 oct 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

GitHub PoC★ 1

CVE-2026-109618-109619 PHP2shell

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-109619CRITICALbajo ataque26 oct 2026

RCE via stale global state

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-109619CRITICALbajo ataque26 oct 2026

RCE via stale global state

100RIESGO

VulnCheck XDB

denial-of-service

CVE-2026-109619CRITICALbajo ataque26 oct 2026

RCE via stale global state

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-109619CRITICALbajo ataque26 oct 2026

RCE via stale global state

100RIESGO

VulnCheck XDB

info-leak

CVE-2026-99999CRITICAL26 oct 2026

ipv4: validate checksum_start before completing checksum

48RIESGO

VulnCheck XDB

info-leak

CVE-2017-1000028—26 oct 2026

Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trave

60RIESGO

VulnCheck XDB

initial-access

CVE-2024-45409CRITICAL26 oct 2026

The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

53RIESGO

VulnCheck XDB

info-leak

CVE-2021-48015HIGH26 oct 2026

JeeWMS Path Traversal via showOrDownByurl.do

41RIESGO

VulnCheck XDB

initial-access

CVE-2025-3987MEDIUM26 oct 2026

TOTOLINK N150RT formWsc command injection

38RIESGO

VulnCheck XDB

info-leak

CVE-2024-58396HIGH26 oct 2026

YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId

41RIESGO

VulnCheck XDB

initial-access

CVE-2020-25213CRITICALbajo ataque26 oct 2026

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra

100RIESGO

VulnCheck XDB

denial-of-service

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

VulnCheck XDB

denial-of-service

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

VulnCheck XDB

denial-of-service

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

Secure REST API with CI/CD security scanning (Bandit SAST + pip-audit SCA) and a reproducible CVE-2017-1000028 lab (GlassFish 4.1)

CVE-2017-1000028—26 oct 2026

Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trave

60RIESGO

GitHub PoC★ 1

CVE-2026-111497

CVE-2026-111497CRITICAL26 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC★ 1

hack-ita/php2shell-cve-2026-109618-109619

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

CVE-2026-84589: macOS TCC privacy bypass via FaceTime impersonation. Technical PoC analysis, Apple disclosure timeline, and patch coverage.

CVE-2026-84589MEDIUM26 oct 2026

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27. An app may

33RIESGO

GitHub PoC★ 1

CVE-2026-90932: LaraDashboard path traversal to arbitrary file deletion/write — bilingual analysis and safe PoC

CVE-2026-90932HIGH26 oct 2026

LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE

41RIESGO

GitHub PoC

CVE-2026-90931: LaraDashboard stored XSS via SVG upload — bilingual analysis and safe PoC

CVE-2026-90931MEDIUM26 oct 2026

LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload

33RIESGO

GitHub PoC

Offline Python detector for CVE-2026-91403 certificate indicators in Java trust stores, with fingerprint matching and JSON reports.

CVE-2026-91403CRITICAL26 oct 2026

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE

48RIESGO

VulnCheck XDB

initial-access

CVE-2026-114509CRITICAL26 oct 2026

Laravel TokenGuard authentication bypass through non-string API credentials

63RIESGO

GitHub PoC

PHP2Shell（CVE-2026-109618 / CVE-2026-109619）远程批量检测工具

CVE-2026-109618CRITICALbajo ataque26 oct 2026

RCE via OOM corruption

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.