Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.503 exploits
GitHub PoC
Offline Docker Hub PAT evidence checker for CVE-2026-105445. Supplied evidence only; no token collection, login or API requests. JSON/CSV/HTML reports.
Docker Hub account conversion could reassign an active personal access token to another user
48RIESGO
abrir ↗GitHub PoC
Offline BeyondTrust Remote Support evidence checker for CVE-2026-102764. Remote Support version and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
100RIESGO
abrir ↗GitHub PoC
Passive Node2Shell (CVE-2026-111497) exposure checker and offline Node.js runtime assessment with branded HTML reports. Python 3.10+, no dependencies, no exploit payloads.
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-106070: Node.js: ZipFile invalid-header content substitution. One exploit per repository; implementation pending.
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after th
28RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-105483: TLS fullwidth-IP hostname validation bypass. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a con
41RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-106072: TLS noncanonical-IP DNS SAN acceptance. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when
33RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-106071: Permission Model wildcard path over-grant. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allo
28RIESGO
abrir ↗GitHub PoC
Research brief on Log4Shell (CVE-2021-44228) for an internal security awareness session. Every claim is backed by linked primary sources.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC★ 7
Node.js Brotli Decoder OOB Write to RCE
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC★ 1
AdapptOnAzure/cve-2026-111497-mitigation
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC
PHP 7.4.33 (Windows, NTS, x64, VC15) rebuilt from the official php-src backport branch PHP-7.4-CVE-2026-109618-109619 (commit 712e60f9), which fixes CVE-2026-109618 and CVE-2026-109619.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Production-grade defensive CLI to audit, patch, and hunt PHP2Shell (CVE-2026-109618/19) memory-safety exploits without downtime.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 4
Unofficial rebuild of PHP 7.4 for EL7 (CentOS/RHEL 7) with the php2shell fix (CVE-2026-109618/109619). A stopgap for EOL stacks — upgrading is the real fix.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Quick vulnerability checker for CVE-2026-109618 & CVE-2026-109619 (PHP2Shell) — detection only, no exploit
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
CVE-2026-104935 — Ivanti Connect Secure / Pulse Secure RCE Exploit
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb
100RIESGO
abrir ↗GitHub PoC
PoC and verification material for CVE-2026-63077 (JetBrains TeamCity agent-polling deserialization RCE)
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RIESGO
abrir ↗GitHub PoC
Security advisory and PoC for CVE-2026-107079 affecting Systrome Validation & Certification 1.0.
An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parame
33RIESGO
abrir ↗VulnCheck XDB
initial-access
Laravel TokenGuard authentication bypass through non-string API credentials
63RIESGO
abrir ↗GitHub PoC
Passive, non-exploiting checker that inventories PHP version disclosure across a list of websites and assesses patch status for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell).
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
One-shot RCE proof of concept for the PHP session.upload_progress use-after-free vulnerabilities (CVE-2026-109618 / CVE-2026-109619).
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Security Ways for AI coding agents. First member audits Node.js repos for the Oct 21, 2026 security release (CVE-2026-111497 Brotli RCE) and opens a patch PR only if affected.
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-110264: GitLab pre-auth RCE via Onigmo integer overflow in org-ruby. Docker-based validation, admin check script, attack surface analysis.
Integer Overflow or Wraparound in GitLab
48RIESGO
abrir ↗GitHub PoC
Fast, concurrent, non-intrusive exposure auditor in Go for the GitLab CE/EE unauthenticated RCE (CVE-2026-110264, CVSS 10.0). For defensive use.
Integer Overflow or Wraparound in GitLab
48RIESGO
abrir ↗GitHub PoC★ 3
Reproducible Docker lab + PoC: Keycloak manage-users -> realm-admin escalation via composite roles (CVE-2026-94000 variant). Validated on 26.8.1.
Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership
33RIESGO
abrir ↗GitHub PoC
Chrome extension for Blue Teams: passively identify a site's PHP version and PHP2Shell (CVE-2026-109618/109619) exposure.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Vulnerabilidad CVE-2018-7600,injection command
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.