Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados

36.206CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientes populares riesgo

14.316 exploits

GitHub PoC★ 1

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping

CVE-2026-26718CRITICAL14 jul 2026

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an att

48RIESGO

GitHub PoC★ 65

Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only.

CVE-2026-43499HIGH14 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC

本次个人漏洞研究进展成果

CVE-2026-43499HIGH14 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC★ 2

will be published

CVE-2026-15706CRITICAL14 jul 2026

Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

48RIESGO

GitHub PoC

This contains the Dockerfile for building and reproduing shellshock

CVE-2014-7169CRITICALbajo ataque14 jul 2026

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

100RIESGO

GitHub PoC★ 3

CVE-2026-0740

CVE-2026-0740CRITICAL14 jul 2026

Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

75RIESGO

GitHub PoC

Intentionally vulnerable VM-hosted Java shop — Log4Shell (CVE-2021-44228) workshop lab (EC2 / Azure VM / GCE)

CVE-2021-44228CRITICALbajo ataqueransomware14 jul 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC

Log4j Vulnerability homelab

CVE-2021-44228CRITICALbajo ataqueransomware14 jul 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC★ 1

CVE-2026-46529 - Atril Evince XReader PDF Clickable Link RCE - PoC & Analysis | CVSS 7.8 HIGH | AMN SECURITY

CVE-2026-46529HIGH13 jul 2026

PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

41RIESGO

GitHub PoC★ 1

CVE-2026-48907 - Joomla JCE Editor Unauthenticated RCE - PoC & Analysis | CVSS 9.8 CRITICAL | AMN SECURITY

CVE-2026-48907CRITICALbajo ataque13 jul 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

GitHub PoC★ 6

Multi OS Support: Version for MacOS/Linux and Windows, Fully translated to English

CVE-2026-43499HIGH13 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC

Reproducer for CVE-2026-43867 — Apache Camel camel-pqc AwsSecretsManagerKeyLifecycleManager unsafe key-metadata deserialization (RCE)

CVE-2026-43867CRITICAL13 jul 2026

Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter

48RIESGO

GitHub PoC★ 1

CVE-2026-40047 - Apache Camel Docling CLI Argument Injection - PoC & Analysis | CVSS 9.1 CRITICAL | AMN SECURITY

CVE-2026-40047CRITICAL13 jul 2026

Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

28RIESGO

GitHub PoC★ 1

CVE-2026-36214 - osTicket Stored XSS via Bootstrap Tooltip - PoC & Analysis | CVSS 8.7 HIGH | AMN SECURITY

CVE-2026-36214MEDIUM13 jul 2026

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable

13RIESGO

GitHub PoC

CVE-2026-53805 - Draft

CVE-2026-53805CRITICAL13 jul 2026

NVIDIA SIL GEN3C Unauthenticated RCE via Pickle Deserialization in Inference API

48RIESGO

GitHub PoC

Admin-only terminal bootstrap routes checked only for login state, which let a normal team member drive Coolify's realtime terminal backend and execute commands on team servers.

CVE-2026-34048CRITICAL13 jul 2026

Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers

48RIESGO

GitHub PoC★ 1

CVE-2026-6307 - Google Chrome V8 Turbofan Type Confusion Sandbox Escape - PoC & Analysis | CVSS 8.8 HIGH | AMN SECURITY

CVE-2026-6307HIGH13 jul 2026

Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code

41RIESGO

GitHub PoC★ 21

CVE-2026-43724 - Apple's published enough advisories about the issue, I'm not getting paid for any of my kernel bugs.

CVE-2026-43724HIGH13 jul 2026

The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.

41RIESGO

GitHub PoC★ 7

(Hopefully) A tool to root for (most) Android devices through CVE-2026-43499

CVE-2026-43499HIGH13 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC

CVE-2026-49049 Helix3 (JoomShaper) Joomla Unauthenticated AJAX RCE Scanner

CVE-2026-49049HIGH13 jul 2026

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

61RIESGO

GitHub PoC

nuclei template for CVE-2026-56291

CVE-2026-56291CRITICALbajo ataque13 jul 2026

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1

100RIESGO

GitHub PoC★ 5

OPPO Find X6 Pro GhostLock (CVE-2026-43499) exploit adaptation

CVE-2026-43499HIGH13 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC★ 1

Mendeteksi versi (passive detection) & Exploitation CVE POC

CVE-2026-56291CRITICALbajo ataque13 jul 2026

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1

100RIESGO

GitHub PoC

Reproducer for CVE-2026-46453 — Apache Camel camel-elasticsearch-rest-client unprefixed-header injection (operation/query override via inbound HTTP headers)

CVE-2026-46453MEDIUM13 jul 2026

Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

33RIESGO

GitHub PoC

Reproducer for CVE-2026-46455 — Apache Camel camel-keycloak missing TokenVerifier.IS_ACTIVE check (expired access tokens accepted)

CVE-2026-46455CRITICAL13 jul 2026

Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

48RIESGO

GitHub PoC

1beelze/CVE-2026-5118

CVE-2026-5118CRITICAL13 jul 2026

Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'

48RIESGO

GitHub PoC★ 3

CVE-2026-38526 exploit for Krayin CRM v2.2.x - Authenticated RCE via TinyMCE file upload bypass. Features interactive shell, multi-type payloads, auto shell generation, and verification. Author: Sudeepa Wanigarathna. For authorized testing only.

CVE-2026-38526CRITICAL13 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

GitHub PoC★ 4

Unauthenticated Stored XSS in Joomla Helix Ultimate (JoomShaper) <= 2.2.6

CVE-2026-57829HIGH13 jul 2026

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7

41RIESGO

GitHub PoC

Qurclinc/CVE-2026-38526

CVE-2026-38526CRITICAL13 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

GitHub PoC★ 3

Unauthenticated Arbitrary File/Folder Deletion in Joomla Helix Ultimate (JoomShaper) <= 2.2.6 — CVE-2026-57830

CVE-2026-57830HIGH13 jul 2026

Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7

41RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.