Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
71.063exploits catalogados
31.617CVEs con explotación pública
0probados en laboratorio
TodosExploit-DB 22.467Referência 19.791GitHub PoC 13.086VulnCheck XDB 8069Nuclei 4188Metasploit 3462✓ solo verificadosrecientespopularesriesgo
71.062 exploits
VulnCheck XDB
denial-of-service
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
76RIESGO
abrir ↗VulnCheck XDB
local
Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks
56RIESGO
abrir ↗VulnCheck XDB
initial-access
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
100RIESGO
abrir ↗GitHub PoC
Dhananjayasj/CVE-2025-24813-Apache-Tomcat-Partial-PUT-Deserialization-RCE-
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-45659
Microsoft SharePoint Remote Code Execution Vulnerability
71RIESGO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗GitHub PoC
CVE-2026-42271 - Draft
LiteLLM: Authenticated command execution via MCP stdio test endpoints
100RIESGO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-0257
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
100RIESGO
abrir ↗GitHub PoC
Patched google_gax 0.4.1 for Tesla 1.18.3+ compatibility (CVE-2026-48598)
CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection
28RIESGO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-28318
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
76RIESGO
abrir ↗GitHub PoC
PoC and writeup for CVE-2026-46394: OS command injection in HAXcms Git.php (CWE-78). Authorized security research only.
HAX CMS Vulnerable to Command Injection using Git.php
41RIESGO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-35616
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta
100RIESGO
abrir ↗GitHub PoC
v3s9er/CVE-2026-52885
Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory
41RIESGO
abrir ↗GitHub PoC
I created simple react2shell CVE-2025-55182 python exploit
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
PoC and writeup for CVE-2026-46395: unauthenticated private key disclosure via broken HMAC in HAXcms Node.js (CWE-321/CWE-200). Authorized security research only.
HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation
48RIESGO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-23479
redis-server use-after-free in unblock client flow may allow remote code execution
41RIESGO
abrir ↗VulnCheck XDB
client-side
Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting
41RIESGO
abrir ↗VulnCheck XDB
initial-access
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote
85RIESGO
abrir ↗GitHub PoC
rootdirective-sec/CVE-2025-11262-Lab
Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting
41RIESGO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-48595
Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects
21RIESGO
abrir ↗GitHub PoC
Running OWASP cve-lite-cli against the pi monorepo: scan journey and key finding (vitest CVE-2026-47429).
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
48RIESGO
abrir ↗GitHub PoC
CVE-2026-45067 - Draft
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
33RIESGO
abrir ↗GitHub PoC
Caderno Temático NotebookLM: análise de vulnerabilidades SQL Injection (CVE-2024-42327, CVE-2026-23921) no Zabbix, com engenharia de prompts, cadeia de ataque até RCE e miniguia de hardening
SQL injection in user.get API
70RIESGO
abrir ↗GitHub PoC
fevar54/CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
83RIESGO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-41089
Windows Netlogon Remote Code Execution Vulnerability
70RIESGO
abrir ↗GitHub PoC
Go Proof of Concept (PoC) exploit for Flowise CustomMCP Remote Code Execution (RCE) CVE-2025-59528
Flowise has Remote Code Execution vulnerability
85RIESGO
abrir ↗VulnCheck XDB
initial-access
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
83RIESGO
abrir ↗GitHub PoC★ 1
Insert PHP Plugin PHP Code Injection
WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API
48RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.