Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.464 exploits
GitHub PoC
Offline Node.js evidence checker for CVE-2026-106073: Permission Model realpathSync read bypass. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissio
28RIESGO
abrir ↗GitHub PoC
Offline Docker Hub PAT evidence checker for CVE-2026-105445. Supplied evidence only; no token collection, login or API requests. JSON/CSV/HTML reports.
Docker Hub account conversion could reassign an active personal access token to another user
48RIESGO
abrir ↗GitHub PoC
duytien241/nodejs-CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC
PHP2Shell lab (CVE-2026-109618 / -109619): reach the OOM, read the previous request's stale session state, then measure an attacker-chosen length and an out-of-bounds read. Ships the instrumented-build recipe, not just the conclusion.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Free read-only self-check scripts for PHP2Shell (CVE-2026-109618), the LiteLLM 1.107.0 compromise and the eMudhra CA keys. Runs on your machine; nothing leaves your network.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-105483: TLS fullwidth-IP hostname validation bypass. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a con
41RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-106072: TLS noncanonical-IP DNS SAN acceptance. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when
33RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-106071: Permission Model wildcard path over-grant. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allo
28RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-106074: Crypto entropy cache duplication in snapshots. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, an
33RIESGO
abrir ↗GitHub PoC
CVE-2026-94300: This analysis and PoC were produced substantially with AI assistance ("AI patchwork"). Every code, diff and measurement claim should be verified against the cited sources before being relied upon.
Concurrent GSS-TSIG messages corrupt memory
41RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-106069: TLS leading-zero IPv4 resolver mismatch. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addres
41RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-102826: simple-git configuration include command injection. One exploit per repository; implementation pending.
simple-git allows command execution through unblocked Git configuration includes
41RIESGO
abrir ↗GitHub PoC
nurlanchip/PHP2SHELL-POC-Lab-CVE-2026-109618-CVE-2026-109619
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-102258: SonicWall SMA1000 (6210, 7210, 8200v): AMC stored cross-site scripting. One exploit per repository; implementation pending.
Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Managem
33RIESGO
abrir ↗GitHub PoC
Patched PHP 7.3 RPMs for EL8 / Rocky Linux 8 (Remi php73-php-*) fixing CVE-2026-109618 / CVE-2026-109619, with an installer that detects the server's PHP, upgrades it and can roll back.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-102257: SonicWall SMA1000 (6210, 7210, 8200v): AMC archive path traversal. One exploit per repository; implementation pending.
A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extrac
41RIESGO
abrir ↗GitHub PoC
CVE-2026-76504 — Cisco Catalyst SD-WAN Manager Auth Bypass Exploit
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
90RIESGO
abrir ↗GitHub PoC★ 1
Nuclei template for CVE-2026-76504 — Cisco vManage authentication bypass
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
90RIESGO
abrir ↗GitHub PoC
Defensive checker, preventer & log scanner for the PHP2Shell RCE flaws (CVE-2026-109618 / CVE-2026-109619). Zero dependencies, stdlib-only, no remote probing.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-102256: SonicWall SMA1000 (6210, 7210, 8200v): Authenticated remote code execution. One exploit per repository; implementation pending.
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi
41RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58041: SQLite cached iterator write replay. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to cont
33RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58045: zlib synchronous API spoofed TypedArray crash. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:z
33RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58044: HTTP header-limit request smuggling. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild ou
28RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-58039: Node.js: Permission Model process-report filesystem bypass. One exploit per repository; implementation pending.
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-wr
28RIESGO
abrir ↗GitHub PoC
Offline evidence checker for NetScaler DTLS CVE-2026-88772. Per-vserver configuration and firmware assessment; standalone Python; no exploit payloads.
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
100RIESGO
abrir ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88771. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.