Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.554exploits catalogados

39.165CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.153 exploits

GitHub PoC★ 3

CVE-2026-18963 — Keycloak reset-credentials bypass -> Account Takeover

CVE-2026-18963CRITICAL05 sep 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RIESGO

abrir ↗

GitHub PoC

Unauthenticated arbitrary file upload -> RCE in WPLP Cookie Consent (gdpr-cookie-consent) <= 4.4.1 - technical write-up and PoC

CVE-2026-75865CRITICAL05 sep 2026

WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint

48RIESGO

abrir ↗

GitHub PoC

A PoC and automated version detection/exploit tool for JetBrains TeamCity Authentication Bypass & RCE (CVE-2023-42793).

CVE-2023-42793CRITICALbajo ataqueransomware05 sep 2026

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

100RIESGO

abrir ↗

GitHub PoC★ 3

0xCyp1337/CVE-2026-19598-

CVE-2026-19598CRITICAL05 sep 2026

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

63RIESGO

abrir ↗

GitHub PoC

postgres CVE-2026-6471 Exploit

CVE-2026-6471HIGH05 sep 2026

PostgreSQL logical decoding can dlopen arbitrary file

41RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-6471

CVE-2026-6471HIGH05 sep 2026

PostgreSQL logical decoding can dlopen arbitrary file

41RIESGO

abrir ↗

GitHub PoC

katranSefa/CVE-2026-18366

CVE-2026-18366CRITICAL05 sep 2026

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

48RIESGO

abrir ↗

GitHub PoC

a reflected XSS vulnerability in YesWiki's Bazar widget handler.

CVE-2026-52774MEDIUM05 sep 2026

Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki

48RIESGO

abrir ↗

GitHub PoC★ 21

Device-bound CVE-2026-64560 adaptation for Xiaomi 15 dada OS4.0.0.8

CVE-2026-64560HIGH05 sep 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RIESGO

abrir ↗

GitHub PoC★ 1

AppleAVE2 kernel driver wire-format research and macOS reachability PoC for CVE-2026-64747.

CVE-2026-64747HIGH05 sep 2026

A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iO

41RIESGO

abrir ↗

GitHub PoC

Exploit Framework for CVE-2025-4255

CVE-2025-4255MEDIUM05 sep 2026

PCMan FTP Server RMD Command buffer overflow

33RIESGO

abrir ↗

GitHub PoC

katranSefa/CVE-2026-15981

CVE-2026-15981CRITICAL05 sep 2026

SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter

48RIESGO

abrir ↗

GitHub PoC

CVE-2025-55163 / CVE-2026-56819: offline checker for the 7 netty-codec-http2 CVEs. Tells you which ones you are exposed to, and the one version that fixes all seven (4.1.136.Final / 4.2.16.Final) - written on none of the advisories. Does not scan pom.xml on purpose: WebFlux pulls it in transitively.

CVE-2026-56819HIGH05 sep 2026

Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-63077 - Unauthenticated RCE exploit for JetBrains TeamCity via Agent Polling Deserialization. Supports mass scanning, multi-threading, and interactive shell. For authorized security testing only.

CVE-2026-63077CRITICALbajo ataqueransomware04 sep 2026

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin

100RIESGO

abrir ↗

GitHub PoC

gustanini/CVE-2022-42889-Text4Shell-POC

CVE-2022-42889—04 sep 2026

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

60RIESGO

abrir ↗

GitHub PoC

n0c71v3x/CVE-2026-78745

CVE-2026-78745CRITICAL04 sep 2026

An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via

48RIESGO

abrir ↗

GitHub PoC

Unauthenticated account takeover PoC for TranslatePress Multilingual <= 3.3.1 (WordPress)

CVE-2026-19632CRITICAL04 sep 2026

TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure

63RIESGO

abrir ↗

GitHub PoC

Divi Ajax Filter <= 5.1.2 Unauthenticated Local File Inclusion via 'custom_loop_template'

CVE-2026-11613CRITICAL04 sep 2026

Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter

48RIESGO

abrir ↗

GitHub PoC

cve-2026-19900-PoC

CVE-2026-19900CRITICAL04 sep 2026

LB-LINK X-PRO shadow hard-coded credentials

63RIESGO

abrir ↗

GitHub PoC★ 2

Detection-first, evidence-preserving incident-response toolkit for Zimbra CVE-2026-73570. Includes read-only host checks, IOC feeds, triage, persistence, containment, and recovery guidance based on sanitized incident evidence.

CVE-2026-73570HIGHbajo ataque04 sep 2026

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp

100RIESGO

abrir ↗

GitHub PoC

PoC exploit code for CVE-2026-10134

CVE-2026-10134CRITICAL04 sep 2026

Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-19516

CVE-2026-19516CRITICAL04 sep 2026

CVE-2026-19516 CVE Record

48RIESGO

abrir ↗

GitHub PoC

Non-intrusive detector for SonicWall SMA 1000 exposure to CVE-2026-83548/-83549 (version/patch-state check; no exploitation)

CVE-2026-83548CRITICALbajo ataque04 sep 2026

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

93RIESGO

abrir ↗

GitHub PoC

Hasanuyarrr/CVE-2026-86595-Iron-Mountain-enVision-EBYSde-Kimlik-Dogrulamal-SQL-Enjeksiyonu-Zafiyeti

CVE-2026-86595HIGH04 sep 2026

SQLi in Iron Mountain's enVision

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-82329 Poc

CVE-2026-82329CRITICALbajo ataque04 sep 2026

Potential authentication bypass leading to administrative access in Artifactory

98RIESGO

abrir ↗

GitHub PoC★ 1

[MIRROR] The CVE-2026-85649 Security Research Publication.

CVE-2026-85649HIGH04 sep 2026

(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the A

41RIESGO

abrir ↗

GitHub PoC

Conceptual C++ patch and structural analysis for CVE-2026-85046, a critical type confusion zero-day vulnerability in Google Chrome's V8 engine

CVE-2026-85046HIGHbajo ataque04 sep 2026

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

83RIESGO

abrir ↗

GitHub PoC

Heap out-of-bounds read in libtpms TPM 2.0 state deserialization — CVE-2026-85769

CVE-2026-85769MEDIUM04 sep 2026

Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize

33RIESGO

abrir ↗

GitHub PoC

CVE-2020-1938 (Ghostcat) Tomcat AJP file read/file include PoC with python3 port

CVE-2020-1938CRITICALbajo ataque04 sep 2026

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-85046

CVE-2026-85046HIGHbajo ataque04 sep 2026

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

83RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.