Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.464 exploits
GitHub PoC
This is the script to update
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
CVE-2026-98432 firewall mitigation for unpatched Linux OS.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗VulnCheck XDB
initial-access
A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individua
56RIESGO
abrir ↗GitHub PoC
PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Rust/Verus model, without a bug-specific property
RCE via OOM corruption
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp
48RIESGO
abrir ↗VulnCheck XDB
info-leak
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RIESGO
abrir ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RIESGO
abrir ↗GitHub PoC★ 15
CVE-2026-98260 在小米 17 Pro Max 的工程化利用一键 root
exec: Cleanup POSIX timers right after de_thread()
41RIESGO
abrir ↗VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RIESGO
abrir ↗GitHub PoC★ 2
真我 GT7 Pro (RMX5010) 免解BL临时Root · CVE-2026-98260 机型适配 · KernelSU 晚加载 · Temporary root for realme GT7 Pro without bootloader unlock
exec: Cleanup POSIX timers right after de_thread()
41RIESGO
abrir ↗VulnCheck XDB
initial-access
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RIESGO
abrir ↗VulnCheck XDB
initial-access
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `sys
33RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
Redis Lua Use-After-Free may lead to remote code execution
85RIESGO
abrir ↗VulnCheck XDB
initial-access
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` a
41RIESGO
abrir ↗VulnCheck XDB
initial-access
UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
41RIESGO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
Temporary nftables mitigation + installer for CVE-2026-98432 (Ubuntu)
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-102334 nginx proxy manager Exploit
Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection
48RIESGO
abrir ↗GitHub PoC
Temporary iptables mitigation for CVE-2026-98432 (CVSS 9.8) on Ubuntu Linux. Filters inbound IPv4 TCP packets containing IP options while awaiting kernel security updates. Not a kernel patch.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC★ 2
Root iQOO Z9 Turbo using CVE-2026-98260
exec: Cleanup POSIX timers right after de_thread()
41RIESGO
abrir ↗GitHub PoC
0xg33k/CVE-2026-18470
Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response
41RIESGO
abrir ↗VulnCheck XDB
initial-access
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attac
50RIESGO
abrir ↗GitHub PoC
Lab, privilege-escalation check and detection for LiteLLM CVE-2026-114612 (internal user to proxy admin).
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
48RIESGO
abrir ↗VulnCheck XDB
initial-access
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26
63RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
71RIESGO
abrir ↗GitHub PoC
PHP CVE-2026-109619 stale session state: calibrated mod_php lab reproduction, evidence, and solver
RCE via stale global state
100RIESGO
abrir ↗GitHub PoC★ 1
sam00/CVE-2026-111943-Emudhra-Ca-Compromise-POC
Distrust compromised intermediate certificates in crypto/x509
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.