Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.554exploits catalogados

39.165CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.153 exploits

GitHub PoC★ 9

Marimo Pre Authentication RCE

CVE-2026-39987CRITICALbajo ataque08 sep 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-10795 - Draft or TODO

CVE-2026-10795HIGH08 sep 2026

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

41RIESGO

abrir ↗

GitHub PoC

composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Mage-OS stores, via cweagans/composer-patches. Companion to stylesmuggler-adobe-patches (Magento).

CVE-2026-75650CRITICALbajo ataque08 sep 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

78RIESGO

abrir ↗

GitHub PoC★ 2

0xCyp1337/CVE-2026-57811

CVE-2026-57811CRITICAL08 sep 2026

WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability

48RIESGO

abrir ↗

GitHub PoC★ 5

composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Magento, via cweagans/composer-patches. Auto-selects the patch for your Magento version.

CVE-2026-75650CRITICALbajo ataque08 sep 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

78RIESGO

abrir ↗

GitHub PoC

Log4Shell (CVE-2021-44228) exploitation from a Kali VM against a vulnerable containerized app, with Splunk-based detection engineering and validated remediation. Covers the full attack lifecycle: exploitation, JNDI and host-level auditd detection, and before/after remediation proof.

CVE-2021-44228CRITICALbajo ataqueransomware07 sep 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

Linux Kernel Exploits -> CVE-2006-2451 + CVE-2006-3626

CVE-2006-2451—07 sep 2026

The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a l

23RIESGO

abrir ↗

GitHub PoC★ 37

SQL injection vulnerability in Android 17 (AOSP)

CVE-2026-28576CRITICAL07 sep 2026

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to l

48RIESGO

abrir ↗

GitHub PoC

Security-research lab: CVE-2026-47172 (workflow_run pwn request in deploy.yaml) — flattened snapshot of duck-organization/questbot at 1903b2f

CVE-2026-47172CRITICAL07 sep 2026

Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.

48RIESGO

abrir ↗

GitHub PoC

Linux Kernel Exploits -> CVE-2004-0077 + CVE-2004-1235 + caps_to_root

CVE-2004-0077—07 sep 2026

The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not prop

23RIESGO

abrir ↗

GitHub PoC

Linux Kernel Exploits -> CVE-2009-1185 + CVE-2009-1337 + CVE-2009-2692 + CVE-2009-2698 + CVE-2009-3547

CVE-2009-1185—07 sep 2026

udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to ga

60RIESGO

abrir ↗

GitHub PoC★ 1

moksh-nfsu/CVE-2026-36392

CVE-2026-36392MEDIUM07 sep 2026

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject

33RIESGO

abrir ↗

GitHub PoC

Linux Kernel Exploits -> CVE-2005-0736 + CVE-2005-1263

CVE-2005-0736—07 sep 2026

Integer overflow in sys_epoll_wait in eventpoll.c for Linux kernel 2.6 to 2.6.11 allows local users to overwrite kernel

23RIESGO

abrir ↗

GitHub PoC

Buffer overflow in FreeFloat FTP Server 1.0

CVE-2025-5548MEDIUM07 sep 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-82329 — JFrog Artifactory Auth Bypass

CVE-2026-82329CRITICALbajo ataque07 sep 2026

Potential authentication bypass leading to administrative access in Artifactory

98RIESGO

abrir ↗

GitHub PoC

Bluex707/React2Shell-CVE-2025-55182-Exploit

CVE-2025-55182CRITICALbajo ataqueransomware07 sep 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

Reproducible Docker lab + raw-socket exploit for CVE-2015-3306 (ProFTPD mod_copy pre-auth arbitrary file copy) — a patch-diffing learning exercise

CVE-2015-3306CRITICALbajo ataque07 sep 2026

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

100RIESGO

abrir ↗

GitHub PoC

iurhfiu6/CVE-2021-4034

CVE-2021-4034HIGHbajo ataqueransomware07 sep 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

abrir ↗

GitHub PoC

This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox credential leak), and the CVE-2021-27101 / CVE-2021-27102 exploit chain (Accellion FTA).

CVE-2018-14847CRITICALbajo ataque07 sep 2026

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-86218 - Draft or TODO - N-central is vulnerable to a pre-auth remote code execution

CVE-2026-86218CRITICALbajo ataque07 sep 2026

pre-authentication remote code execution

98RIESGO

abrir ↗

GitHub PoC

Eliot-code/CVE-2026-85046

CVE-2026-85046HIGHbajo ataque07 sep 2026

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

83RIESGO

abrir ↗

GitHub PoC★ 10

CVE-2026-67276 MikroTik RouterOS SSH Authentication Bypass Exploit

CVE-2026-67276CRITICAL07 sep 2026

SSH user impersonation possible in Mikrotik RouterOS

48RIESGO

abrir ↗

GitHub PoC

CVE-2017-17215—07 sep 2026

Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could se

45RIESGO

abrir ↗

GitHub PoC

Linux Kernel Exploits -> CVE-2008-0600 + CVE-2008-0900 + CVE-2008-4210

CVE-2008-0600—07 sep 2026

The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer befo

23RIESGO

abrir ↗

GitHub PoC

Eliot-code/CVE-2026-52924

CVE-2026-52924CRITICAL07 sep 2026

sctp: purge outqueue on stale COOKIE-ECHO handling

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184

CVE-2026-13181HIGH07 sep 2026

RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

41RIESGO

abrir ↗

GitHub PoC

BlueGate Exploit validator - RD Gateway validator for CVE-2020-0609 and CVE-2020-0610 (BlueGate) using OpenSSL DTLS over UDP/3391.

CVE-2020-0609—07 sep 2026

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated atta

45RIESGO

abrir ↗

GitHub PoC

CVE-2026-81780 — Hash Form RCE

CVE-2026-81780CRITICAL07 sep 2026

WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability

48RIESGO

abrir ↗

GitHub PoC★ 3

PoC for the CVE-2026-69451 - Fastprox EoP

CVE-2026-69451HIGH07 sep 2026

Windows Management Instrumentation Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC

StyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells, persistence artifacts, and known indicators of compromise.

CVE-2026-75650CRITICALbajo ataque07 sep 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

78RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.