Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.464exploits catalogados

40.695CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientes populares riesgo

87.464 exploits

GitHub PoC

Finds copies of the Google Brotli decoder affected by CVE-2026-111497 on Ubuntu and Debian hosts: the OS packages, and the bundled copies an OS update does not fix (Node.js, Python, Envoy, browsers and more). Built by trial and error with AI-Ops, starting with the OSes on my own machines and servers. A PowerShell version for Windows is planned.

CVE-2026-111497CRITICAL25 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC

Quarterly security briefing research notes and remediation tracking for Log4Shell (CVE-2021-44228).

CVE-2021-44228CRITICALbajo ataqueransomware25 oct 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC

CVE-2020-25213 - Unauthenticated RCE exploit for WP File Manager plugin (≤ 6.0) | Educational purposes only

CVE-2020-25213CRITICALbajo ataque25 oct 2026

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra

100RIESGO

GitHub PoC★ 3

vivo/IQOO (kernel 6.1.145) CVE-2026-98260 POSIX CPU timer UAF LPE

CVE-2026-98260HIGH25 oct 2026

exec: Cleanup POSIX timers right after de_thread()

41RIESGO

GitHub PoC★ 1

A curated, deep-dive guide to leveraging Artificial Intelligence, Machine Learning, and Large Language Models (LLMs) to detect, analyze, and neutralize advanced web application threats—with a specific focus on recent, critical PHP CGI Argument Injection vulnerabilities (such as CVE-2024-4577) and similar Remote Code Execution (RCE) breaches.

CVE-2024-4577CRITICALbajo ataqueransomware25 oct 2026

Argument Injection in PHP-CGI

100RIESGO

GitHub PoC★ 1

Security backport toolkit for CVE-2026-111497 on Ubuntu 24.04, featuring upstream patch verification, custom Debian package builds, and offline remediation procedures.

CVE-2026-111497CRITICAL25 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC★ 2

Exposure scanner, patch verifier and threat hunter for CVE-2026-109618/9, with a cyberpunk TUI.

CVE-2026-109618CRITICALbajo ataque25 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

Hassham1/CVE-2026-112866-woo-product-filter-sqli-poc

CVE-2026-112866CRITICAL25 oct 2026

WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability

63RIESGO

GitHub PoC

PHP2Shell Monitor - Real-time detection for CVE-2026-109618/109619 exploitation attempts

CVE-2026-109618CRITICALbajo ataque25 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC★ 2

A local Docker-based research lab for investigating PHP2Shell (CVE-2026-109618 and CVE-2026-109619), comparing PHP 8.4.26 and 8.4.27, and validating upstream security fixes and regression tests.

CVE-2026-109618CRITICALbajo ataque25 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

CVE-2026-59248

CVE-2026-59248HIGH25 oct 2026

Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

41RIESGO

GitHub PoC★ 1

PHP2Shell: finding and patching affected PHP CVE-2026-109618 and CVE-2026-109619

CVE-2026-109618CRITICALbajo ataque25 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

Exploit & analysis for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Demonstrating memory disclosure, ASLR bypass, and RCE via session.upload_progress memory bailout dangling pointers.

CVE-2026-109618CRITICALbajo ataque25 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

在 REDMI K90 Max（代号 prague / OS4.0.0.14）上，从手机端一键开一个临时 root。利用 CVE-2026-64560（posix-cpu-timers UAF）加载 KernelSU LKM，重启即失效。不需要电脑、不刷机、不解锁 Bootloader。

CVE-2026-64560HIGH25 oct 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RIESGO

GitHub PoC★ 1

Exact-build PHP 5.6 research and reproducible labs for CVE-2026-109618 and CVE-2026-109619

CVE-2026-109618CRITICALbajo ataque25 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

CVE-2026-83548 — SonicWall SMA1000 Work Place pre-auth SSRF

CVE-2026-83548CRITICALbajo ataque25 oct 2026

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

93RIESGO

GitHub PoC★ 2

Proof of Concept (PoC) demonstrating Argument Injection in Pillow's Ghostscript call (Pillow < 13.0.0) potentially leading to arbitrary command execution (RCE).

CVE-2026-112900CRITICAL25 oct 2026

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

48RIESGO

GitHub PoC★ 2

CVE-2026-74580 vhost: reset the vring metadata cache on vring reconfiguration - Exploit

CVE-2026-74580HIGH25 oct 2026

vhost: reset the vring metadata cache on vring reconfiguration

41RIESGO

GitHub PoC

PoC for CVE-2026-72708 (blind SQLi) and CVE-2026-109378 (SSRF) in SPIP, both fixed in 4.4.18

CVE-2026-72708HIGH25 oct 2026

SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html

41RIESGO

GitHub PoC

php:7.4.33-fpm-alpine + official PHP patch for CVE-2026-109618/109619

CVE-2026-109618CRITICALbajo ataque25 oct 2026

RCE via OOM corruption

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-109618CRITICALbajo ataque25 oct 2026

RCE via OOM corruption

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-109618CRITICALbajo ataque25 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

Non-invasive Python detector for CVE-2026-111497 with Brotli/Node.js version checks, JSON inventories, and CI-ready reports.

CVE-2026-111497CRITICAL25 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC★ 2

PoC for CVE-2026-111497, a buffer overflow in Google Brotli 1.0.3–1.2.0 that may cause memory corruption, data disclosure, DoS, or RCE when processing crafted compressed data.

CVE-2026-111497CRITICAL25 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC★ 1

Security research on CVE-2026-111497 (HTTP2Shell): Docker-only differential lab probing the Brotli decoder OOB write across vulnerable/fixed Node builds

CVE-2026-111497CRITICAL25 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC

lushinshang/cve-2026-111497-http2shell-guide

CVE-2026-111497CRITICAL25 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC

CVE-2026-88009 — Traefik forwards a rootless opaque request target that routing/forwardAuth see as '/'. Auth bypass + access-log evasion, verified v3.7.10 / v3.7.13.

CVE-2026-88009HIGH25 oct 2026

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

41RIESGO

VulnCheck XDB

initial-access

CVE-2026-109618CRITICALbajo ataque25 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

CVE-2026-106781 CH341SER Driver Installer Privilege Escalation

CVE-2026-106781HIGH25 oct 2026

An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker

41RIESGO

GitHub PoC

unixreaper/CVE-2026-99999-Research

CVE-2026-99999CRITICAL25 oct 2026

ipv4: validate checksum_start before completing checksum

48RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.