Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.655exploits catalogados
39.248CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.347Exploit-DB 24.485GitHub PoC 16.178VulnCheck XDB 9644Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
16.178 exploits
GitHub PoC
CVE-2026-74943, Use after free in Firefox RasterImage (sec-high)
Use-after-free in the Graphics: ImageLib component
48RIESGO
abrir ↗GitHub PoC
CVE-2026-74970, Fission site isolation bypass in Firefox WebRender
Site isolation issue in the Graphics component
33RIESGO
abrir ↗GitHub PoC
CVE-2026-74945, Uninitialized heap disclosure via a crafted web font (sec-high)
Information disclosure in the Graphics: Text component
33RIESGO
abrir ↗GitHub PoC★ 29
Linux Binder binder_free_transaction() process-lifetime use-after-free (CVE-2026-64468): unprivileged PoC + x86_64 LPE. Authorised security research.
binder: fix UAF in binder_free_transaction()
41RIESGO
abrir ↗GitHub PoC★ 1
ZendTo unauthenticated ClamAV CVE-2026-20217 RCE and default-profile root escalation reproduction
ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerability
41RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-71518 — Typemill <2.26.0 unauthenticated authorization bypass in media file download (path-equivalent URL variants). Advisory + PoC.
Typemill < 2.26.0 Authorization Bypass via Media File Download Route
41RIESGO
abrir ↗GitHub PoC
CVE-2026-33017, vuln in langflow.
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
98RIESGO
abrir ↗GitHub PoC
iPad 8 iPadOS 26.3 AVE toolchain research (CVE-2026-64747 class)
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iO
41RIESGO
abrir ↗GitHub PoC★ 6
A poc and write-up for CVE-2026-40345
deepmerge-ts: Stack exhaustion when merging recursive object graphs
41RIESGO
abrir ↗GitHub PoC
golang.org/x/text v0.33.0 backport of CVE-2026-56852 (GO-2026-5970) for Go 1.24
Infinite loop on invalid input in golang.org/x/text
41RIESGO
abrir ↗GitHub PoC
CVE-2026-68138 Linux Local Privilege Escalation Exploit
net/sched: serialize qdisc_rtab_list against concurrent get/put
41RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-62737 ExecutionContext.sys arbitrary kernel-call PoC
Windows Kernel Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC★ 1
Rce In synaptikcms
synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload
33RIESGO
abrir ↗GitHub PoC
katranSefa/CVE-2026-13714
Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
48RIESGO
abrir ↗GitHub PoC
POC for CVE-2026-41042
Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter
63RIESGO
abrir ↗GitHub PoC
I3IT/CVE-2026-18322
Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
41RIESGO
abrir ↗GitHub PoC★ 9
Kernel root exploit (CVE-2026-43499) for some 5.X devices (mostly Amazon)
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
Unauthenticated SQL Injection via Attribute Filter in Phoca Cart - CVSS 9.3
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6
48RIESGO
abrir ↗GitHub PoC
CVE-2026-15826, CVE-2026-15748
User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
63RIESGO
abrir ↗GitHub PoC
Tracking CVE-2026-68138, the Linux kernel net/sched qdisc rate-table use-after-free
net/sched: serialize qdisc_rtab_list against concurrent get/put
41RIESGO
abrir ↗GitHub PoC★ 5
One-Day POC | GeoServer Unauthenticated SQL injection to complete RCE
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
63RIESGO
abrir ↗GitHub PoC★ 2
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
48RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-73678 — MindsDB Minds Platform unauthenticated RCE via scratchpad exec (CVSS 10.0). Verified end-to-end with real LLM
MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()
48RIESGO
abrir ↗GitHub PoC
PoC for CVE-2026-73519 - WolfStack hardcoded cluster secret leads to unauthenticated RCE (CVSS 9.8)
WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret
48RIESGO
abrir ↗GitHub PoC★ 3
Using CVE-2026-43499 to root your Galaxy S24 Ultra(SM-S9280 ,(China / Hong Kong SAR / Taiwan))
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
CVE-2026-73633（S2-072）概念验证代码
Apache Struts: Unbounded read of a JSON request body
41RIESGO
abrir ↗GitHub PoC
React2Shell(CVE-2025-55182) 취약점 기반 침해 시나리오를 재현하고, Wazuh/Sysmon/Coraza WAF 로그로 침해사고를 분석·대응한 DFIR 프로젝트
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
PoC: changedetection.io settings blind-merge mass assignment (CVE-2026-71204, Medium 6.3)
changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement
33RIESGO
abrir ↗GitHub PoC
a-mansilla/CVE-2020-6418
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corru
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.