Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados

36.206CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientes populares riesgo

14.316 exploits

GitHub PoC

solmin111/OpenSMTPD-CVE-2020-7247-

CVE-2020-7247CRITICALbajo ataque28 jun 2026

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to

100RIESGO

abrir ↗

GitHub PoC

Unauthenticated RCE PoC for CVE-2026-48908 SP Page Builder (Joomla) arbitrary file upload and remote code execution exploit with mass scaning support.

CVE-2026-48908CRITICAL28 jun 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

85RIESGO

abrir ↗

GitHub PoC

Why-Shell/CVE-2026-38751

CVE-2026-38751HIGH28 jun 2026

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionali

41RIESGO

abrir ↗

GitHub PoC

Double-free in Apache httpd mod_http2 stream cleanup leading to pre-auth RCE

CVE-2026-23918HIGH28 jun 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

abrir ↗

GitHub PoC

React2Shell: CVE-2025-55182 exploit from tryhackme‼️

CVE-2025-55182CRITICALbajo ataqueransomware28 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-49048 — JoomCCK 6.4.0 Unauthenticated SQL Injection (CVSS 9.8)

CVE-2026-49048HIGH28 jun 2026

Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1

41RIESGO

abrir ↗

GitHub PoC★ 3

DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503

CVE-2026-43503HIGH28 jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

41RIESGO

abrir ↗

GitHub PoC★ 148

CVE-2026-43499 PoC

CVE-2026-43499HIGH27 jun 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

patched ffmpeg-tools for jellyfin to patch CVE-2026-8461 aka PixelSmash

CVE-2026-8461HIGH27 jun 2026

Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-48907 is a CVSS 10.0 pre-auth RCE in Joomla Content Editor affecting all versions ≤ 2.9.99.4. The Grayxploit team breaks down the 3-weakness chain — missing auth, no extension validation, and an unsafe upload flag — that lets attackers pop a shell in 3 HTTP requests.

CVE-2026-48907CRITICALbajo ataque27 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-46331 - Draft

CVE-2026-46331HIGH27 jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2026-0073-Android-ADBD-bypass-POC汉化版

CVE-2026-0073HIGH27 jun 2026

In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic err

41RIESGO

abrir ↗

GitHub PoC

SugiB3o/CVE-2026-31431

CVE-2026-31431HIGHbajo ataque27 jun 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

abrir ↗

GitHub PoC★ 57

cve-2026-48907 scanner

CVE-2026-48907CRITICALbajo ataque27 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

abrir ↗

GitHub PoC

kyukazamiqq/CVE-2026-24061

CVE-2026-24061CRITICALbajo ataque27 jun 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC

Hack The Box - Orion (Easy) | CVE-2025-32432 & CVE-2026-24061

CVE-2025-32432CRITICALbajo ataque27 jun 2026

Craft CMS Allows Remote Code Execution

100RIESGO

abrir ↗

GitHub PoC

Hunt-Benito/traefik-stripprefix-auth-bypass-cve-2026-48020-path-normalization

CVE-2026-48020HIGH27 jun 2026

Traefik StripPrefix Route-Level Auth Bypass via Path Normalization

41RIESGO

abrir ↗

GitHub PoC★ 1

WP Full Stripe Free <= 8.4.3 - Missing Authorization

CVE-2026-12432MEDIUM27 jun 2026

Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter

33RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2026-5366: git argument injection in Prefect's GitRepository leading to RCE on the worker.

CVE-2026-5366CRITICAL27 jun 2026

Git Argument Injection in prefecthq/prefect

48RIESGO

abrir ↗

GitHub PoC

Defensive analysis and non-weaponized validation of CVE-2016-5195 (Dirty COW), including root-cause research, patch analysis, and reproducible evidence.

CVE-2016-5195HIGHbajo ataque27 jun 2026

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RIESGO

abrir ↗

GitHub PoC★ 2

Educational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only — no exploit code. TLP:CLEAR.

CVE-2026-43503HIGH27 jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

41RIESGO

abrir ↗

GitHub PoC

Hack The Box - Orion (Easy) | CVE-2025-32432 & CVE-2026-24061

CVE-2026-24061CRITICALbajo ataque27 jun 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC★ 8

OpenSTAManager-RCE-Exploit-CVE-2026-38751

CVE-2026-38751HIGH27 jun 2026

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionali

41RIESGO

abrir ↗

GitHub PoC★ 3

SQL Injection at Cacti

CVE-2026-40083HIGH27 jun 2026

Cacti: SQL Injection in managers.php

41RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2026-0073-Android-ADBD-bypass-POC汉化版

CVE-2026-0073HIGH27 jun 2026

In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic err

41RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-8932

CVE-2026-8932HIGH26 jun 2026

incomplete mTLS config matching in conn reuse

41RIESGO

abrir ↗

GitHub PoC

fevar54/CVE-2026-20253-Splunk-Enterprise-Pre-Auth-RCE-

CVE-2026-20253CRITICALbajo ataque26 jun 2026

Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

100RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2026-20251 — Splunk Secure Gateway jsonpickle deserialization RCE (CVSS 8.8) | ReactiveZero Security Research

CVE-2026-20251HIGH26 jun 2026

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

46RIESGO

abrir ↗

GitHub PoC

Full Metasploit exploitation walkthrough against Metasploitable2 — vsftpd backdoor, Samba CVE-2007-2447, UnrealIRCd backdoor, Netcat exfiltration, and credential cracking prep.

CVE-2007-2447—26 jun 2026

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RIESGO

abrir ↗

GitHub PoC★ 17

mooder1/dirtyclone-CVE-2026-43503

CVE-2026-43503HIGH26 jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.