Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.554exploits catalogados

39.165CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.153 exploits

GitHub PoC

CVE-2026-81780 — Hash Form RCE

CVE-2026-81780CRITICAL07 sep 2026

WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability

48RIESGO

abrir ↗

GitHub PoC

Advisory: Cute Editor 6.4 reflected XSS via 'Theme' parameter in colorpicker_more.aspx

CVE-2021-3030MEDIUM06 sep 2026

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme G

33RIESGO

abrir ↗

GitHub PoC

CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE (PoC)

CVE-2025-57819CRITICALbajo ataque06 sep 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RIESGO

abrir ↗

GitHub PoC★ 100

CVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC

CVE-2026-67276CRITICAL06 sep 2026

SSH user impersonation possible in Mikrotik RouterOS

48RIESGO

abrir ↗

GitHub PoC★ 115

**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.

CVE-2026-18963CRITICAL06 sep 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RIESGO

abrir ↗

GitHub PoC

0xCyp1337/CVE-2026-82222-MassExploit

CVE-2026-82222CRITICAL06 sep 2026

WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

63RIESGO

abrir ↗

GitHub PoC

A mock app for the GitLab CVE-2023-7028, which allow multile email adresses when ordering a password reset.

CVE-2023-7028CRITICALbajo ataque06 sep 2026

Weak Password Recovery Mechanism for Forgotten Password in GitLab

100RIESGO

abrir ↗

GitHub PoC★ 1

katranSefa/CVE-2026-19949

CVE-2026-19949HIGH06 sep 2026

All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

41RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-67276 - Draft or TODO

CVE-2026-67276CRITICAL06 sep 2026

SSH user impersonation possible in Mikrotik RouterOS

48RIESGO

abrir ↗

GitHub PoC

este laboratorio puede estar bien o mal preguntale a la IA estoy probando pero debe funcionar hahahah

CVE-2026-64849CRITICALbajo ataque06 sep 2026

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

93RIESGO

abrir ↗

GitHub PoC

CVE-2021-44228 Log4Shell reproduced end to end: exploitation through remediation

CVE-2021-44228CRITICALbajo ataqueransomware06 sep 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

0xCyp1337/CVE-2026-44402

CVE-2026-44402CRITICAL06 sep 2026

Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi

48RIESGO

abrir ↗

GitHub PoC

LangGrinch - CVE-2025-68664 demo

CVE-2025-68664CRITICAL06 sep 2026

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

60RIESGO

abrir ↗

GitHub PoC★ 21

Device-bound CVE-2026-64560 adaptation for Xiaomi 15 dada OS4.0.0.8

CVE-2026-64560HIGH05 sep 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RIESGO

abrir ↗

GitHub PoC

Exploit Framework for CVE-2025-4255

CVE-2025-4255MEDIUM05 sep 2026

PCMan FTP Server RMD Command buffer overflow

33RIESGO

abrir ↗

GitHub PoC★ 1

V8 TurboFan CheckMaps type-confusion research and compressed-heap R/W exploit notes for CVE-2026-78938.

CVE-2026-78938HIGH05 sep 2026

Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside

41RIESGO

abrir ↗

GitHub PoC

Root-cause analysis and crash-tier PoC for CVE-2026-64705, an HFS xattr kernel heap overflow on macOS.

CVE-2026-64705MEDIUM05 sep 2026

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Se

33RIESGO

abrir ↗

GitHub PoC★ 8

A/B Docker lab + PoC for CVE-2026-32475 (Elementor Pro Forms unauthenticated arbitrary file upload -> RCE via validation/move loop desync)

CVE-2026-32475CRITICAL05 sep 2026

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

63RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2026-18963 — Keycloak reset-credentials bypass -> Account Takeover

CVE-2026-18963CRITICAL05 sep 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RIESGO

abrir ↗

GitHub PoC★ 3

0xCyp1337/CVE-2026-19598-

CVE-2026-19598CRITICAL05 sep 2026

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

63RIESGO

abrir ↗

GitHub PoC

Zimbra Collaboration Suite RCE — SMTP log poisoning → swatchdog → OS Command Injection (CVSS 8.9, CISA KEV)

CVE-2026-73570HIGHbajo ataque05 sep 2026

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp

100RIESGO

abrir ↗

GitHub PoC

postgres CVE-2026-6471 Exploit

CVE-2026-6471HIGH05 sep 2026

PostgreSQL logical decoding can dlopen arbitrary file

41RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-6471

CVE-2026-6471HIGH05 sep 2026

PostgreSQL logical decoding can dlopen arbitrary file

41RIESGO

abrir ↗

GitHub PoC

katranSefa/CVE-2026-18366

CVE-2026-18366CRITICAL05 sep 2026

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

48RIESGO

abrir ↗

GitHub PoC★ 1

AppleAVE2 kernel driver wire-format research and macOS reachability PoC for CVE-2026-64747.

CVE-2026-64747HIGH05 sep 2026

A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iO

41RIESGO

abrir ↗

GitHub PoC

katranSefa/CVE-2026-15981

CVE-2026-15981CRITICAL05 sep 2026

SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter

48RIESGO

abrir ↗

GitHub PoC

CVE-2025-55163 / CVE-2026-56819: offline checker for the 7 netty-codec-http2 CVEs. Tells you which ones you are exposed to, and the one version that fixes all seven (4.1.136.Final / 4.2.16.Final) - written on none of the advisories. Does not scan pom.xml on purpose: WebFlux pulls it in transitively.

CVE-2026-56819HIGH05 sep 2026

Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

41RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-32475 PoC : Elementor Pro Unauthenticated Arbitrary File Upload to RCE

CVE-2026-32475CRITICAL05 sep 2026

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

63RIESGO

abrir ↗

GitHub PoC★ 2

Jenkins PersistenceRoot Deserialization RCE (SECURITY-3972) — PoC & analysis. Requires Item/Configure; affects weekly <= 2.579 / LTS <= 2.568.2

CVE-2026-84645HIGH05 sep 2026

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in indepen

41RIESGO

abrir ↗

GitHub PoC

Ritinify/CVE-2025-29927-PoC

CVE-2025-29927CRITICAL05 sep 2026

Authorization Bypass in Next.js Middleware

85RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.