Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.044exploits catalogados

31.616CVEs con explotación pública

0probados en laboratorio

Todos Exploit-DB 22.467Referência 19.791GitHub PoC 13.077VulnCheck XDB 8060Nuclei 4187Metasploit 3462✓ solo verificadosrecientes populares riesgo

13.079 exploits

GitHub PoC

Reproducer for CVE-2026-43866 — Apache Camel camel-jms forged DefaultExchangeHolder bypass of the CVE-2026-40860 deserialization filter (Exchange-state injection)

CVE-2026-43866HIGH12 jul 2026

Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder

41RIESGO

GitHub PoC

Reproducer for CVE-2026-43865 — Apache Camel camel-hazelcast default-configured instance unsafe Java deserialization (RCE)

CVE-2026-43865HIGH12 jul 2026

Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

41RIESGO

GitHub PoC

Write-up and exploitation steps for the pedit COW vulnerability (CVE-2026-46331)

CVE-2026-46331HIGH12 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

GitHub PoC★ 1

Dahua CVE-2026-29116

CVE-2026-29116HIGH11 jul 2026

A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially

41RIESGO

GitHub PoC★ 2

Termux Privilege Escalation Tool & Root Manager - CVE-2026-43501

CVE-2026-43501CRITICAL11 jul 2026

ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

48RIESGO

GitHub PoC

MW-HF/Drupal-CVE-2026-9082

CVE-2026-9082CRITICALbajo ataque11 jul 2026

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

100RIESGO

GitHub PoC★ 4

CVE-2026-46331 act_pedit page-cache corruption exploit, with Alpine PIE fix

CVE-2026-46331HIGH11 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

GitHub PoC

Azure IoT Hub where exposure of an owner-level Shared Access Key enables unauthenticated remote code execution (RCE) against connected IoT devices. Proof-Of-Concept

CVE-2026-13768CRITICAL11 jul 2026

Gardyn IoT Hub Use of Hard-coded Credentials

48RIESGO

GitHub PoC

Reproducer for CVE-2026-42527 — Apache Camel permissive default ObjectInputFilter admits java.net.URL, enabling a DNS-based out-of-band side channel

CVE-2026-42527HIGH11 jul 2026

Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

41RIESGO

GitHub PoC

An unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database.

CVE-2026-40887CRITICAL11 jul 2026

@vendure/core has a SQL Injection vulnerability

63RIESGO

GitHub PoC

Instant Appointment <= 1.2 — Unauthenticated Arbitrary File Upload to RCE via add_service_front AJAX | CVSS 9.8

CVE-2026-15282CRITICAL11 jul 2026

Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload

48RIESGO

GitHub PoC

A PoC script for CVE-2026-38526, RCE via a file upload vulnerability in the /admin/tinymce/upload endpoint of webkul krayin 2.2.x

CVE-2026-38526CRITICAL11 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

GitHub PoC

OS Command Injection in Health Check → Remote Code Execution

CVE-2026-59734HIGH11 jul 2026

Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution

41RIESGO

GitHub PoC

sn0x-sharma/CVE-2026-57850

CVE-2026-57850HIGH11 jul 2026

RustDesk before 1.4.9 Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection

41RIESGO

GitHub PoC

Balbooa Forms (com_baforms) < 2.4.1 — Unauthenticated File Upload to RCE via form.uploadAttachmentFile | CVSS 9.8 | CISA KEV

CVE-2026-56291CRITICALbajo ataque11 jul 2026

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1

78RIESGO

GitHub PoC

1beelze/CVE-2026-14894

CVE-2026-14894CRITICAL11 jul 2026

Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)

48RIESGO

GitHub PoC★ 1

Dahua CVE-2026-29114

CVE-2026-29114LOW11 jul 2026

A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that

28RIESGO

GitHub PoC★ 1

Dahua CVE-2026-29115

CVE-2026-29115MEDIUM11 jul 2026

A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially c

33RIESGO

GitHub PoC

CVE-2026-46242

CVE-2026-46242HIGH11 jul 2026

eventpoll: fix ep_remove struct eventpoll / struct file UAF

41RIESGO

GitHub PoC★ 1

This is and exploit for CVE-2026-46215 (Linux Kernel Use After Free) Adapted for Linux 7.0 !!! by Antonius (ev1lut10n / sw0rdm4n)

CVE-2026-46215HIGH11 jul 2026

drm: Set old handle to NULL before prime swap in change_handle

41RIESGO

GitHub PoC

Reproducer for CVE-2026-40860 — Apache Camel camel-jms/sjms/amqp JMS ObjectMessage unsafe deserialization (RCE)

CVE-2026-40860CRITICAL10 jul 2026

Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

48RIESGO

GitHub PoC★ 1

Reproducer for CVE-2026-40858 — Apache Camel camel-infinispan remote aggregation repository unsafe deserialization (RCE)

CVE-2026-40858HIGH10 jul 2026

Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository

41RIESGO

GitHub PoC

CVE-2026-28992 IOHIDFamily FastPathUserClient race condition PoC — security research

CVE-2026-28992MEDIUM10 jul 2026

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7

33RIESGO

GitHub PoC

caspy123/CVE-2026-43499

CVE-2026-43499HIGH10 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC★ 1

inforcqb/CVE-2026-43499-pja110

CVE-2026-43499HIGH10 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC

Exploitability PoC for CVE-2026-9558 (SSTI Mautic Theme)

CVE-2026-9558CRITICAL10 jul 2026

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twi

48RIESGO

GitHub PoC★ 2

A Proof of Concept (PoC) exploit for CVE-2026-46331

CVE-2026-46331HIGH10 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

GitHub PoC

CVE-2026-54390 — JTL Shop Smarty SSTI RCE | Pre-Auth Template Injection via fetch('string:' . ) | 5.2.0-5.7.1

CVE-2026-54390CRITICAL10 jul 2026

JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer

48RIESGO

GitHub PoC

PoC for CVE-2026-56423: MISP deleteSelection broken access control (CWE-862, contributor hard-deletes other orgs' Event Reports/Sharing Groups, CVSS 8.8)

CVE-2026-56423CRITICAL10 jul 2026

MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

48RIESGO

GitHub PoC

Dr-D25/CVE-2026-49049

CVE-2026-49049HIGH10 jul 2026

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

41RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.