Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.200 exploits

GitHub PoC

Tproot es una máquina de nivel Muy Fácil de DockerLabs centrada en la explotación manual del servicio vsftpd 2.3.4 (CVE-2011-2523).

CVE-2011-2523—23 jul 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

abrir ↗

GitHub PoC★ 15

DavidCarliez/CVE-2026-66804-CrossDevice-LPE

CVE-2026-66804HIGH23 jul 2026

Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC

GitHub Actions workflow sandbox (CVE-2026-48546 reproduction)

CVE-2026-48546HIGH23 jul 2026

KanaDojo < 0.1.18 Sandbox Escape RCE via messages.cjs

21RIESGO

abrir ↗

GitHub PoC

CVE Reproduction: cve-2026-63030_60137-wordpress_rce_reproduction

CVE-2026-63030CRITICALbajo ataque23 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

abrir ↗

GitHub PoC

0xdak/CVE-2026-63766_exploit

CVE-2026-63766CRITICAL23 jul 2026

GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-64600 - Draft - Check todo

CVE-2026-64600HIGH23 jul 2026

xfs: resample the data fork mapping after cycling ILOCK

41RIESGO

abrir ↗

GitHub PoC★ 5

CVE-2026-43499 exploit configuration for realme RMX3888 (Android 16) - 20 verified kernel offsets

CVE-2026-43499HIGH23 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

Proof-of-concept and offensive security research analyzing CVE-2026-23744 (MCPJam Inspector Unauthenticated RCE, Patched in v1.4.3+).

CVE-2026-23744CRITICAL23 jul 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

GitHub PoC

Legacy HPE iMC vuln

CVE-2019-5392—23 jul 2026

A disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than ve

23RIESGO

abrir ↗

GitHub PoC★ 1

0xdak/CVE-2026-56121_exploit

CVE-2026-56121CRITICAL23 jul 2026

Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-41940 cPanel & WHM Auth Bypass

CVE-2026-41940CRITICALbajo ataqueransomware23 jul 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

GitHub PoC★ 28

YellowKey free tool for the CVE-2026-45585 BitLocker bypass vulnerability on Windows 10/11. Covered on Tom's Hardware: extract recovery keys, apply remediation, test bypass mitigation and manage BitLocker encryption state. Download YellowKey

CVE-2026-45585MEDIUM23 jul 2026

Windows BitLocker Security Feature Bypass Vulnerability

33RIESGO

abrir ↗

GitHub PoC★ 5

soralis0912/CVE-2026-43499-aristotle-apk

CVE-2026-43499HIGH23 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC★ 4

soralis0912/CVE-2026-43499-aristotle

CVE-2026-43499HIGH23 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

Initialized & connected PostgreSQL to Metasploit. Reconnoitered 10.1.16.0/24 with Nmap and imported results. Enumerated hosts/services using SYN, SMB & LDAP scanners. Exploited DC10 via ZeroLogon (CVE-2020-1472), dumped AD NTLM hashes with Impacket, performed Pass-the-Hash, then gained a Meterpreter reverse shell.

CVE-2020-1472MEDIUMbajo ataqueransomware23 jul 2026

Netlogon Elevation of Privilege Vulnerability

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2021-41773 Apache

CVE-2021-41773HIGHbajo ataqueransomware23 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC

GitHub Actions workflow sandbox for CVE-2026-45132 reproduction

CVE-2026-45132CRITICAL23 jul 2026

CloudPirates Open Source Helm Charts: GitHub Actions workflow leaks PAT and SSH signing key via unsafe credential handling

48RIESGO

abrir ↗

GitHub PoC

theeomega/CVE-2025-32432-POC

CVE-2025-32432CRITICALbajo ataque23 jul 2026

Craft CMS Allows Remote Code Execution

100RIESGO

abrir ↗

GitHub PoC

CVE Reproduction: cve-2024-4577-phpcgi_rce_reproduction

CVE-2024-4577CRITICALbajo ataqueransomware23 jul 2026

Argument Injection in PHP-CGI

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-66374: Knot Resolver 6.3.0 DNS-over-QUIC heap overflow (RCE)

CVE-2026-66374HIGH23 jul 2026

Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) rece

41RIESGO

abrir ↗

GitHub PoC

ghostpels/CVE-2026-13001

CVE-2026-13001CRITICAL23 jul 2026

Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

63RIESGO

abrir ↗

GitHub PoC★ 1

CVE Reproduction: cve-2026-41940-cpanel_authbypass_reproduction

CVE-2026-41940CRITICALbajo ataqueransomware23 jul 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

GitHub PoC

Security analysis and report of CVE-2024-6387 OpenSSH vulnerability, including vulnerability details, CVSS evaluation, and mitigation recommendations.

CVE-2024-6387HIGH23 jul 2026

Openssh: regresshion - race condition in ssh allows rce/dos

63RIESGO

abrir ↗

GitHub PoC

CVE Reproduction: cve-2025-2783-chrome_sandbox_escape_reproduction

CVE-2025-2783HIGHbajo ataque23 jul 2026

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allow

71RIESGO

abrir ↗

GitHub PoC★ 332

Certighost POC

CVE-2026-54121HIGH23 jul 2026

Active Directory Certificate Services Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC★ 21

CVE-2026-64600

CVE-2026-64600HIGH22 jul 2026

xfs: resample the data fork mapping after cycling ILOCK

41RIESGO

abrir ↗

GitHub PoC

Full ML-KEM-1024 key recovery from a partial Fujisaki-Okamoto comparison in wolfSSL (CVE-2026-6330 NEON, CVE-2026-10097 AVX2)

CVE-2026-6330MEDIUM22 jul 2026

ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

33RIESGO

abrir ↗

GitHub PoC

PoC reproducer for CVE-2026-55994 (Apache Camel camel-iggy): the consumer copies an Iggy message's user-headers onto the Exchange unfiltered, so an injected CamelHttpUri drives a server-side request (SSRF) and leaks resolved property placeholders. Fixed in 4.18.3/4.21.0.

CVE-2026-55994HIGH22 jul 2026

Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviour

41RIESGO

abrir ↗

GitHub PoC★ 17

CVE-2026-43499 PoC Scanner

CVE-2026-43499HIGH22 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

Scan WordPress installations for wp2shell vulnerabilities (CVE-2026-63030 + CVE-2026-60137). Identifies full RCE and SQL injection risks across multiple sites with severity classification and CSV reporting.

CVE-2026-63030CRITICALbajo ataque22 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.