Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.989exploits catalogados

40.450CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.240Exploit-DB 24.488GitHub PoC 18.042VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.240 exploits

Referência

CVE-2021-35464

CVE-2021-35464CRITICALbajo ataqueransomware

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pa

100RIESGO

abrir ↗

Referência

CVE-2026-16222

CVE-2026-16222MEDIUM

1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-63731

CVE-2026-63731MEDIUM

HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint

33RIESGO

abrir ↗

Referência

CVE-2026-63107

CVE-2026-63107MEDIUM

LimeSurvey SSRF via REST API Survey Template Host Header

33RIESGO

abrir ↗

Referência

CVE-2026-15678

CVE-2026-15678MEDIUM

code-projects Online Job Portal DetailJob.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-114374

CVE-2026-114374MEDIUM

leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2018-15687

CVE-2018-15687HIGH

systemd: chown_one() can dereference symlinks

41RIESGO

abrir ↗

Referência

CVE-2026-15699

CVE-2026-15699MEDIUM

spencermountain compromise Public Root API extend.js nlp.extend prototype pollution

33RIESGO

abrir ↗

Referência

CVE-2026-58477

CVE-2026-58477HIGH

Sustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP Parameters

41RIESGO

abrir ↗

Referência

CVE-2021-36260

CVE-2021-36260CRITICALbajo ataque

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RIESGO

abrir ↗

Referência

CVE-2026-81424

CVE-2026-81424MEDIUM

Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR

33RIESGO

abrir ↗

Referência

CVE-2026-13580

CVE-2026-13580HIGH

Edimax EW-7478APC POST Request formQoS buffer overflow

41RIESGO

abrir ↗

Referência

CVE-2026-13544

CVE-2026-13544MEDIUM

Feehi CMS API users access control

33RIESGO

abrir ↗

Referência

CVE-2026-11883

CVE-2026-11883HIGH

WebAuthn Provider for Two Factor < 2.5.6 - 2FA Bypass

41RIESGO

abrir ↗

Referência

CVE-2026-11880

CVE-2026-11880LOW

Fluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDOR

28RIESGO

abrir ↗

Referência

CVE-2026-58172

CVE-2026-58172CRITICAL

Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests

48RIESGO

abrir ↗

Referência

CVE-2026-58166

CVE-2026-58166HIGH

OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete

41RIESGO

abrir ↗

Referência

CVE-2026-58116

CVE-2026-58116CRITICAL

LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path

48RIESGO

abrir ↗

Referência✓ VexDay Proof

crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow

CVE-2006-1236—remotelinux

Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrar

28RIESGO

abrir ↗

Referência

CVE-2020-37236

CVE-2020-37236MEDIUM

NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel

33RIESGO

abrir ↗

Referência

CVE-2020-37235

CVE-2020-37235MEDIUM

WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component

33RIESGO

abrir ↗

Referência

CVE-2025-12669

CVE-2025-12669MEDIUM

Improper Control of Generation of Code ('Code Injection') in GitLab

33RIESGO

abrir ↗

Referência

CVE-2025-13874

CVE-2025-13874MEDIUM

Authorization Bypass Through User-Controlled Key in GitLab

33RIESGO

abrir ↗

Referência

CVE-2025-14869

CVE-2025-14869HIGH

Improper Validation of Specified Quantity in Input in GitLab

41RIESGO

abrir ↗

Referência

CVE-2025-14870

CVE-2025-14870HIGH

Allocation of Resources Without Limits or Throttling in GitLab

41RIESGO

abrir ↗

Referência

CVE-2026-3607

CVE-2026-3607MEDIUM

Access Control Check Implemented After Asset is Accessed in GitLab

33RIESGO

abrir ↗

Referência

CVE-2020-37234

CVE-2020-37234MEDIUM

Internet Download Manager 6.38.12 Scheduler Buffer Overflow

33RIESGO

abrir ↗

Referência

CVE-2020-37233

CVE-2020-37233MEDIUM

WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting

33RIESGO

abrir ↗

Referência

CVE-2020-37230

CVE-2020-37230HIGH

Syncplify.me Server! 5.0.37 Unquoted Service Path Privilege Escalation

41RIESGO

abrir ↗

Referência

CVE-2020-37229

CVE-2020-37229HIGH

OKI sPSV Port Manager 1.0.41 Unquoted Service Path Privilege Escalation

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.