Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

79.980exploits catalogados

36.899CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.476Referência 23.400GitHub PoC 15.250VulnCheck XDB 8959Nuclei 4393Metasploit 3502✓ solo verificadosrecientes populares riesgo

79.900 exploits

GitHub PoC★ 101

Proof-of-concept exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining a broken access, CAB arbitrary-write path traversal, certificate verification bypass, and DLL hijacking to achieve SYSTEM-level code execution.

CVE-2026-47301HIGH03 ago 2026

Configuration Manager Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC★ 60

villager1314/CVE-2026-64560-Analysis

CVE-2026-64560HIGH03 ago 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RIESGO

GitHub PoC

sam00/POC-CVE-2026-54121-Certighost

CVE-2026-54121HIGH03 ago 2026

Active Directory Certificate Services Elevation of Privilege Vulnerability

41RIESGO

VulnCheck XDB

initial-access

CVE-2026-66066CRITICAL03 ago 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

68RIESGO

GitHub PoC

CVE-2026-12940 — Langflow OSS <=1.10.1 unauthenticated RCE via MCP stdio environment-variable injection (SHELLOPTS/PS4). Author PoC + source analysis + lab.

CVE-2026-12940CRITICAL03 ago 2026

Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints

48RIESGO

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALbajo ataque03 ago 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

GitHub PoC

fastjson vulnerability scanner - detect fastjson in JARs and Spring Boot fat-JARs, check exposure to CVE-2026-16723, and verify whether you already run the official patch 1.2.84. Zero-dependency offline CLI. fastjson 漏洞检测与排查工具：一条命令扫描依赖，支持 fat-JAR 与 shaded 依赖，并判定是否已升到官方补丁版本 1.2.84。

CVE-2026-16723CRITICAL03 ago 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

53RIESGO

VulnCheck XDB

denial-of-service

CVE-2022-21907CRITICAL03 ago 2026

HTTP Protocol Stack Remote Code Execution Vulnerability

70RIESGO

VulnCheck XDB

initial-access

CVE-2025-68613CRITICALbajo ataque03 ago 2026

n8n Vulnerable to Remote Code Execution via Expression Injection

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-57819CRITICALbajo ataque03 ago 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RIESGO

VulnCheck XDB

initial-access

CVE-2014-6271CRITICALbajo ataque03 ago 2026

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-29927CRITICAL03 ago 2026

Authorization Bypass in Next.js Middleware

85RIESGO

VulnCheck XDB

local

CVE-2022-22706HIGHbajo ataque03 ago 2026

Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects

71RIESGO

VulnCheck XDB

initial-access

CVE-2017-12635—03 ago 2026

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be

60RIESGO

GitHub PoC

sam00/POC-CVE-2026-42826-2026-42826-Microsoft-Azure-DevOps-Information-Disclosure-Vulnerability

CVE-2026-42826CRITICAL03 ago 2026

Azure DevOps Information Disclosure Vulnerability

48RIESGO

GitHub PoC★ 1

A proof-of-concept for CVE-2026-39987

CVE-2026-39987CRITICALbajo ataque03 ago 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

GitHub PoC★ 2

CVE-2026-66066 (KindaRails2Shell) PoC - Rails Active Storage/libvips arbitrary file read to RCE; for authorized security testing

CVE-2026-66066CRITICAL03 ago 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

68RIESGO

GitHub PoC★ 2

GhostLock (CVE-2026-43499) kernel exploit port for REDMI K90 Pro Max Taiwan firmware (myron, WPMTWXM) — offsets, build guide, prebuilt binary

CVE-2026-43499HIGH03 ago 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC

Manage BitLocker recovery keys, unlock encrypted drives, and monitor encryption status with this lightweight Windows utility.

CVE-2026-45585MEDIUM03 ago 2026

Windows BitLocker Security Feature Bypass Vulnerability

33RIESGO

GitHub PoC★ 2

PoC for CVE-2026-3891 – Unauthenticated File Upload RCE in Pix for WooCommerce ≤ 1.5.0. Automated nonce retrieval, PHP upload, and command execution.

CVE-2026-3891CRITICAL03 ago 2026

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

68RIESGO

GitHub PoC

This tool exploits two critical vulnerabilities in Apache CouchDB: | CVE | Description | Severity | |-----|-------------|----------| | **CVE-2017-12635** | Privilege Escalation via JSON Parsing Bypass | 🔴 Critical | | **CVE-2017-12636** | Remote Code Execution via Query Server | 🔴 Critical |

CVE-2017-12635—03 ago 2026

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be

60RIESGO

GitHub PoC★ 9

CVE-2026-64531 (OVSwrap) PoC - Linux kernel Open vSwitch LPE; for patch validation and security research

CVE-2026-64531HIGH03 ago 2026

net: openvswitch: reject oversized nested action attrs

41RIESGO

VulnCheck XDB

info-leak

CVE-2017-7921CRITICALbajo ataque03 ago 2026

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16

100RIESGO

GitHub PoC

George0Papasotiriou/CVE-2026-8080-DKIM-Signature-Verification-Bypass-Header-Canonicalization-Flaw-

CVE-2026-8080MEDIUM03 ago 2026

MISP core - Stored XSS in MISP template (old engine) element attribute type

33RIESGO

VulnCheck XDB

info-leak

CVE-2018-9995—03 ago 2026

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L

60RIESGO

VulnCheck XDB

local

CVE-2023-21768HIGH03 ago 2026

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

68RIESGO

GitHub PoC

George0Papasotiriou/CVE-2026-9997-VPN-Split-Tunneling-Bypass-via-DHCP-Option-Injection

CVE-2026-9997HIGH03 ago 2026

Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rende

41RIESGO

GitHub PoC★ 1

Bu laboratuvar ortamını sıfırdan kendim oluşturdum. Next.js uygulaması içerisinde giriş, ana sayfa ve admin sayfalarını hazırladım. Middleware ile yetkilendirme mekanizmasını kurduktan sonra Burp Suite kullanarak CVE-2025-29927 zafiyetini kontrollü ortamda gösterdim.

CVE-2025-29927CRITICAL03 ago 2026

Authorization Bypass in Next.js Middleware

85RIESGO

GitHub PoC★ 3

Proof-of-Concept exploit for CVE-2026-15409 (SonicWall SMA 1000 RCE) via Erlang distribution over WebSocket. Achieves unauthenticated remote code execution as couchdb user.

CVE-2026-15409CRITICALbajo ataqueransomware03 ago 2026

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

100RIESGO

GitHub PoC

George0Papasotiriou/CVE-2026-6666-XPC-Service-NSKeyedUnarchiver-Deserialization-Attack-macOS-iOS-simulation-

CVE-2026-6666MEDIUM03 ago 2026

PgBouncer crash in kill_pool_logins_server_error

33RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.