Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.464 exploits
VulnCheck XDB
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
41RIESGO
abrir ↗GitHub PoC
CVE-2026-98260 temporary-root runner
exec: Cleanup POSIX timers right after de_thread()
41RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗VulnCheck XDB
initial-access
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
100RIESGO
abrir ↗VulnCheck XDB
initial-access
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by
100RIESGO
abrir ↗VulnCheck XDB
initial-access
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attac
50RIESGO
abrir ↗VulnCheck XDB
initial-access
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26
53RIESGO
abrir ↗VulnCheck XDB
initial-access
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability i
100RIESGO
abrir ↗GitHub PoC
CVE-2026-98432 firewall mitigation for unpatched Linux OS.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
This is the script to update
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
Docker config that patches/builds kernel w/ CVE_2026_98432 fix
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
PHP2Shell (CVE-2026-109618) upload-progress bug as a minimal Rust/Verus model, without a bug-specific property
RCE via OOM corruption
100RIESGO
abrir ↗VulnCheck XDB
initial-access
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `sys
33RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
Redis Lua Use-After-Free may lead to remote code execution
85RIESGO
abrir ↗GitHub PoC
Lab, privilege-escalation check and detection for LiteLLM CVE-2026-114612 (internal user to proxy admin).
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
48RIESGO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
Detection-only local triage for Zyxel GS1900 CVE-2026-107441 (exploited zero-day): grades model + firmware against Zyxel's .3 fix table and catches the .2 trap
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 cou
41RIESGO
abrir ↗GitHub PoC★ 1
redfishrouge/CVE-2026-58868-PoC
In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This cou
48RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-119977 – WordPress Core Upgrade-Window RCE (CVSS 8.1) | Red/Blue Team Toolkit. Predictable staging dir takeover, wp-config.php promotion, Bait MySQL proof, WAF origin discovery, rate-limited race oracle, admin shell deploy, version triage. Async, CI-tested. Only ethical & authorized use, stay legal.
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
71RIESGO
abrir ↗GitHub PoC★ 1
Element2023H/CVE-2026-120232-RUST-POC
Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption
48RIESGO
abrir ↗GitHub PoC★ 1
Original write up for CVE-2026-58868 Android critical severity cve
In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This cou
48RIESGO
abrir ↗GitHub PoC
PoC for CVE-2026-115290 (Elasticsearch unauthenticated DoS via the remote cluster server port, CWE-674, ESA-2026-201): validated node kill in a containerized A/B lab (8.19.23 vs 8.19.24)
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
41RIESGO
abrir ↗GitHub PoC
Detection-only local triage scanner for CVE-2026-119977 (CISA KEV 2026-11-03) in WordPress Core: grades versions 4.7-7.1.3 against per-branch fixes (7.1.4 and backports) and flags wp-content/upgrade exposure. No payloads, no remote probing.
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
71RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-58115: Siemens SIMATIC IoT2050 Node-RED unauthenticated root RCE. PoC, scanner, PCAP, detection rules.
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running In
48RIESGO
abrir ↗GitHub PoC
saretawa/CVE-2026-86583
Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields
41RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.