Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

79.107exploits catalogados

36.322CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8846Nuclei 4361Metasploit 3490✓ solo verificadosrecientes populares riesgo

4361 exploits

Nucleicritical

Progress ShareFile Storage Zones Controller - Authentication Bypass

CVE-2026-2699CRITICAL

EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)

75RIESGO

abrir ↗

Nucleicritical

MajorDoMo - Unauthenticated RCE

CVE-2026-27174CRITICAL

MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval

63RIESGO

abrir ↗

Nucleimedium

MajorDoMo - Cross-Site Scripting

CVE-2026-27176MEDIUM

MajorDoMo Reflected Cross-Site Scripting in command.php

28RIESGO

abrir ↗

Nucleihigh

MindsDB - Remote Code Execution

CVE-2026-27483HIGH

MindsDB has Path Traversal in /api/files Leading to Remote Code Execution

61RIESGO

abrir ↗

Nucleicritical

WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation

CVE-2026-27542CRITICAL

WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability

63RIESGO

abrir ↗

Nucleimedium

Changedetection.io RSS Single Watch - Cross-Site Scripting

CVE-2026-27645MEDIUM

changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response

28RIESGO

abrir ↗

Nucleihigh

OpenCATS - Command Injection

CVE-2026-27760CRITICAL

OpenCATS PHP Code Injection via installer AJAX endpoint

75RIESGO

abrir ↗

Nucleihigh

Gitea Container Registry - Unauthorized Private Image Access

CVE-2026-27771HIGH

Gitea Composer package source links use insufficient permission checks

56RIESGO

abrir ↗

Nucleimedium

Homarr < 1.54.0 - Information Disclosure

CVE-2026-27796MEDIUM

Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)

28RIESGO

abrir ↗

Nucleihigh

mcp-atlassian < 0.17.0 - Server-Side Request Forgery

CVE-2026-27826HIGH

MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers

41RIESGO

abrir ↗

Nucleihigh

Piwigo < 16.3.0 - Unauthenticated Information Disclosure via History API

CVE-2026-27833HIGH

Piwigo: Unauthenticated Information Disclosure via pwg.history.search API

36RIESGO

abrir ↗

Nucleicritical

Nginx UI < 2.3.3 - Information Disclosure

CVE-2026-27944CRITICAL

Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

68RIESGO

abrir ↗

Nucleicritical

Qwik - Unauthenticated RCE via server$ Deserialization

CVE-2026-27971CRITICAL

Qwik affected by unauthenticated RCE via server$ Deserialization

63RIESGO

abrir ↗

Nucleimedium

Dify User Enumeration via Observable Response Discrepancy

CVE-2026-28288MEDIUM

Dify has a user enumeration issue

28RIESGO

abrir ↗

Nucleimedium

NocoDB - User Enumeration

CVE-2026-28358LOW

NocoDB: User Enumeration via Password Reset Endpoint

23RIESGO

abrir ↗

Nucleicritical

WeGIA <= 3.6.4 - Remote Code Execution

CVE-2026-28409CRITICAL

WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection

43RIESGO

abrir ↗

Nucleihigh

Gradio - Absolute Path Traversal

CVE-2026-28414HIGH

Gradio has Absolute Path Traversal on Windows with Python 3.13+

36RIESGO

abrir ↗

Nucleicritical

FOSSBilling - Server-Side Template Injection

CVE-2026-28496CRITICAL

FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

63RIESGO

abrir ↗

Nucleicritical

MetInfo CMS <= 8.1 - Remote Code Execution

CVE-2026-29014CRITICAL

MetInfo CMS Unauthenticated PHP Code Injection RCE

75RIESGO

abrir ↗

Nucleicritical

Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal

CVE-2026-29059MEDIUM

Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly

48RIESGO

abrir ↗

Nucleimedium

TinaCMS - Path Traversal

CVE-2026-29066MEDIUM

Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI

28RIESGO

abrir ↗

Nucleimedium

SiYuan Note - Cross-Site Scripting

CVE-2026-29183CRITICAL

SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution

43RIESGO

abrir ↗

Nucleimedium

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

CVE-2026-3001MEDIUM

Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter

28RIESGO

abrir ↗

Nucleihigh

WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection

CVE-2026-3018HIGH

Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter

36RIESGO

abrir ↗

Nucleicritical

Citrix NetScaler SAML IDP - Memory Overread

CVE-2026-3055CRITICALbajo ataque

Insufficient input validation leading to memory overread

95RIESGO

abrir ↗

Nucleihigh

LiteLLM 1.18.10 - Command Injection

CVE-2026-30623CRITICAL

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application

63RIESGO

abrir ↗

Nucleihigh

Flowise - NVIDIA NIM Endpoints Missing Authentication

CVE-2026-30824HIGH

Flowise: Missing Authentication on NVIDIA NIM Endpoints

48RIESGO

abrir ↗

Nucleihigh

Glances - Information Disclosure

CVE-2026-30928HIGH

Glances Exposes Unauthenticated Configuration Secrets

36RIESGO

abrir ↗

Nucleihigh

OneUptime < 10.0.21 - Path Traversal

CVE-2026-30958HIGH

OneUptime: Path Traversal — Arbitrary File Read (No Auth)

36RIESGO

abrir ↗

Nucleicritical

Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration

CVE-2026-30965CRITICAL

Parse Server session token exfiltration via `redirectClassNameForKey` query parameter

43RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.