Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.200 exploits

GitHub PoC★ 4

CVE-2026-49176 WalletService LPE — standalone PoC + Cobalt Strike BOF (SYSTEM command on interactive session)

CVE-2026-49176HIGH29 jul 2026

Windows WalletService Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC

Nuclio Dashboard (NOP mode) accepts unauthenticated POST /api/functions. The spec.handler field isn't path-validated, so ../../../../tmp/x.txt:handler escapes the build tempdir via path.Join, letting an attacker write arbitrary content to any path as root. (CVE-2026-52832, ≤1.15.27)

CVE-2026-52832MEDIUM29 jul 2026

Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

33RIESGO

abrir ↗

GitHub PoC

manfredgabriel/cve-2021-41773-lab

CVE-2021-41773HIGHbajo ataqueransomware29 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC★ 1

Pravin761/CVE-2026-54107

CVE-2026-54107HIGH29 jul 2026

Windows Win32k Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC

CamilleGR/CVE-2026-73292

CVE-2026-73292HIGH29 jul 2026

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

41RIESGO

abrir ↗

GitHub PoC

Agent skill that audits a Rails codebase for CVE-2026-66066 (KindaRails2Shell) — Active Storage + libvips arbitrary file read / RCE, checking Rails and libvips versions and block-untrusted mitigations

CVE-2026-66066CRITICAL29 jul 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

68RIESGO

abrir ↗

GitHub PoC

CVE-2026-2586 — Eclipse GlassFish EL injection to RCE

CVE-2026-2586CRITICAL29 jul 2026

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user

48RIESGO

abrir ↗

GitHub PoC★ 6

CVE-2026-61511 – vBulletin Pre-Auth RCE (CVSS 9.8). Vuln 5.x/6.x (unpatched). Multi-exploit via Endpoint Pool, AJAX, PHPFuck WAF bypass. Full toolkit: reverse shell, proxy, persistence, webshell, database operations, firewall control, log management, mass scanning. 2 versions: multi-exploit & safe-check. Python 3.8+ Use Ethically, Stay Legal.

CVE-2026-61511CRITICAL29 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

63RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-45746, CVE-2026-45750, CVE-2026-53547 — three critical vulnerabilities in Termix: cross-tenant session hijacking, OS command injection, and account takeover

CVE-2026-45746CRITICAL29 jul 2026

Termix Vulnerable to Arbitrary Command Execution via Session Hijacking

48RIESGO

abrir ↗

GitHub PoC

Tracking OVSwrap (CVE-2026-64531), the Open vSwitch datapath netlink overflow

CVE-2026-64531HIGH29 jul 2026

net: openvswitch: reject oversized nested action attrs

41RIESGO

abrir ↗

GitHub PoC

Public technical advisory and reproduction evidence for CVE-2026-52134 affecting GOOSE replay handling in libiec61850 v1.6.

CVE-2026-52134CRITICAL29 jul 2026

An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass au

48RIESGO

abrir ↗

GitHub PoC

webshellseo8/CVE-2026-61511-POC

CVE-2026-61511CRITICAL29 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

63RIESGO

abrir ↗

GitHub PoC★ 1

A PoC for CVE-2026-64725

CVE-2026-64725HIGH28 jul 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS

41RIESGO

abrir ↗

GitHub PoC

0xdak/CVE-2025-71389_exploit

CVE-2025-71389CRITICAL28 jul 2026

Cal.com before 5.9.9 Remote Code Execution via RSC

48RIESGO

abrir ↗

GitHub PoC★ 1

IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution [RCE]

CVE-2026-9198CRITICALbajo ataque28 jul 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

98RIESGO

abrir ↗

GitHub PoC★ 1

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

CVE-2026-54121HIGH28 jul 2026

Active Directory Certificate Services Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-14856 TastyIgniter v4.3.0

CVE-2026-14856MEDIUM28 jul 2026

Stored Cross-Site Scripting (XSS) in TastyIgniter Media Manager

33RIESGO

abrir ↗

GitHub PoC

Microsoft SharePoint CVE-2026-50522

CVE-2026-50522CRITICALbajo ataque28 jul 2026

Microsoft SharePoint Remote Code Execution Vulnerability

78RIESGO

abrir ↗

GitHub PoC★ 4

Fastjson 1.2.83 RCE 靶场环境 (CVE-2026-16723)

CVE-2026-16723CRITICAL28 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

abrir ↗

GitHub PoC★ 3

cve-2026-61511

CVE-2026-61511CRITICAL28 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

63RIESGO

abrir ↗

GitHub PoC

CVE-2026-61511 - Draft or Todo

CVE-2026-61511CRITICAL28 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

63RIESGO

abrir ↗

GitHub PoC

Isolated regression and security-control lab for CVE-2026-59891 in @sigstore/oci

CVE-2026-59891CRITICAL28 jul 2026

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

48RIESGO

abrir ↗

GitHub PoC★ 4

KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499

CVE-2026-43499HIGH28 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC★ 3

Exploit code for CVE-2026-55040, it can create auth header for any validate account.

CVE-2026-55040CRITICALbajo ataque28 jul 2026

Microsoft SharePoint Server Security Feature Bypass Vulnerability

100RIESGO

abrir ↗

GitHub PoC

bha-vin/CVE-2026-64600-Exploit

CVE-2026-64600HIGH28 jul 2026

xfs: resample the data fork mapping after cycling ILOCK

41RIESGO

abrir ↗

GitHub PoC

letsr00t/RefluxFS_CVE-2026-64600

CVE-2026-64600HIGH28 jul 2026

xfs: resample the data fork mapping after cycling ILOCK

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-14856 TastyIgniter v4.3.0

CVE-2026-14856MEDIUM28 jul 2026

Stored Cross-Site Scripting (XSS) in TastyIgniter Media Manager

33RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-8206: Kirki Customizer Framework - Unauthenticated Account Takeover (CVSS 9.8)

CVE-2026-8206CRITICAL28 jul 2026

Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

48RIESGO

abrir ↗

GitHub PoC

IoT Security research conducted during my internship at IIIT Allahabad, leading to CVE-2026-65893, CVE-2026-65894, and the CERT-In Vulnerability Note CIVN-2026-0380.

CVE-2026-65893HIGH28 jul 2026

Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera

41RIESGO

abrir ↗

GitHub PoC

CyberVinner/CP-PLUS-EZ-P21-CVE-2026-65893-65894

CVE-2026-65893HIGH28 jul 2026

Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.