Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
78.343exploits catalogados
36.057CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.721GitHub PoC 14.496VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientespopularesriesgo
14.316 exploits
GitHub PoC
pimpamebanihah/cve-2026-43499-app.s0
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC★ 272
A cPanel and WHM authentication bypassing tool
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RIESGO
abrir ↗GitHub PoC
nullwhisper/CVE-2026-14840
YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing
33RIESGO
abrir ↗GitHub PoC
josephfarah-ciso/CVE-2026-9999-exploit
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execu
41RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-56292 - AcyMailing for Joomla unauthenticated SQL injection scanner
Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1
48RIESGO
abrir ↗GitHub PoC
WordPress Core <= 7.0.3 - Authenticated (Author+) Remote Code Execution via Malicious File Upload
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level
41RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-43499 futex PI stack UAF ???????? - Android GKI 6.1~6.12 ??????? pselect() + futex PI ????????????,??? root ??? SELinux??? OPPO Find X8?OnePlus ??????
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
针对CVE-2026-41940漏洞的临时缓解措施
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-33017: Langflow Unauthenticated RCE PoC
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RIESGO
abrir ↗GitHub PoC★ 1
GoDAM WordPress plugin <= 1.12.2 unauthenticated file upload RCE (CVE-2026-14282)
GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field
48RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-68820 - Draft or TODO
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
71RIESGO
abrir ↗GitHub PoC
pimpamebanihah/cve-2026-43499-app.so
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC★ 24
CVE-2026-66804 Windows Cross Device virtual camera EoP - Standard user to SYSTEM
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC
sonalisarkar-2003/FTP-vsFTPD-CVE-2011-2523-VAPT-Report
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RIESGO
abrir ↗GitHub PoC★ 1
PoC funcional de CVE-2026-17106 (CopyEscape): carrera TOCTOU en docker cp que permite escritura arbitraria en el host Docker. Laboratorio Docker + monitor inotify + LD_PRELOAD. Variante macOS inocua y Linux destructiva.
Tar extraction in moby/go-archive can write outside the destination directory via link following
41RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-41452 — Krayin CRM unauth installer bypass (X-Requested-With) → admin takeover. Verified: overwrite + login on 2.2.4, blocked on 2.2.5
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
48RIESGO
abrir ↗GitHub PoC
Technical analysis of CVE-2025-55182 (React2Shell), covering vulnerability mechanics, root cause, controlled PoC testing, impact, and mitigation strategies.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC★ 4
vivo/iQOO 临时 root 工具箱 (免解锁临时root, CVE-2026-43499) - 源码与脚本
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
CVE-2026-54984 / ZDI-26-543: Windows ICC file parsing out-of-bounds write (CWE-122, CVSS 7.8)
Windows Imaging Component Remote Code Execution Vulnerability
41RIESGO
abrir ↗GitHub PoC
Public vulnerability advisory and supporting evidence for CVE-2026-67846 affecting the BOOM v3/v4 NBDTLB implementation.
Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect priv
41RIESGO
abrir ↗GitHub PoC
Leeyoonjoo/CVE-2026-42533
NGINX Map directive and Regex matching vulnerability
48RIESGO
abrir ↗GitHub PoC★ 1
MCP environment-variable blocklist bypass leads to unauthenticated RCE in Flowise 3.1.1
Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
41RIESGO
abrir ↗GitHub PoC★ 8
CVE-2026-0075 — Android ContactsProvider information disclosure via JSON error side-channel, including PoC, root-cause analysis, and patch details.
In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead t
41RIESGO
abrir ↗GitHub PoC★ 1
ZildanZ/CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
56RIESGO
abrir ↗GitHub PoC★ 2
Passive security checker for CVE-2026-48908 affecting SP Page Builder.
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
85RIESGO
abrir ↗GitHub PoC
CVE-2025-55182 — Next.js Flight Deserialization RCE exploit with interactive shell, single-command execution and multi-payload reverse shell chain. For authorized penetration testing only.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC★ 3
SM-F9360 (Galaxy Z Fold4, q4q) locked-bootloader KernelSU root — CVE-2026-43499 temp root → LD_PRELOAD DEFEX bypass → no-LTO clang-12 kernelsu.ko. Device-verified 2026-08-12.
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
CVE-2026-50656, CVE-2026-69414
Microsoft Defender Elevation of Privilege Vulnerability
46RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.