Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.200 exploits

GitHub PoC

PoC reproducer for CVE-2026-56139 (Apache Camel camel-undertow Rest DSL): the Rest DSL binding hard-codes muteException=false, so a configured muteException=true is ignored and an uncaught exception's full stack trace is returned to the client (CWE-209). Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-56139MEDIUM22 jul 2026

Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients

33RIESGO

GitHub PoC

CVE-2026-50522

CVE-2026-50522CRITICALbajo ataque22 jul 2026

Microsoft SharePoint Remote Code Execution Vulnerability

78RIESGO

GitHub PoC★ 1

ThorVG NULL pointer dereference via malformed SVG — AFL++ fuzzing writeup

CVE-2026-45729MEDIUM22 jul 2026

ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input

33RIESGO

GitHub PoC★ 1

Scan Windows Domain Controllers for CVE-2026-41089 to detect unauthenticated remote code execution vulnerabilities in the Netlogon service.

CVE-2026-41089CRITICAL22 jul 2026

Windows Netlogon Remote Code Execution Vulnerability

48RIESGO

GitHub PoC

full javascript reproduction of CVE-2026-63030 (author_exclude, author__not_in and misalignment between validations and matches)

CVE-2026-63030CRITICALbajo ataque22 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC★ 12

CVE-2026-46331 and CVE-2026-43503

CVE-2026-46331HIGH22 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

GitHub PoC

PoC reproducer for CVE-2026-55993 (Apache Camel camel-atmosphere-websocket): the WebSocket consumer copies connection query parameters onto the Exchange unfiltered, so an injected CamelHttpUri drives a server-side request (SSRF) and leaks resolved property placeholders. Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-55993HIGH22 jul 2026

Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling influencing internal behaviour

41RIESGO

GitHub PoC

Local web app for conducting a Check Point Trusted Access Review. This scanner is built specifically to look for configuration issues around CVE-2026-16232, CVE-2026-62144 , and CVE-2026-62145. This tool is not created or supported by Check Point and should be used at your own risk.

CVE-2026-16232CRITICALbajo ataque22 jul 2026

Authentication Bypass in the SmartConsole Login Process Using an Application Token

100RIESGO

GitHub PoC

Full ML-KEM-1024 key recovery from a partial Fujisaki-Okamoto comparison in wolfSSL (CVE-2026-6330 NEON, CVE-2026-10097 AVX2)

CVE-2026-6330MEDIUM22 jul 2026

ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

33RIESGO

GitHub PoC★ 4

CVE-2026-14266 - XZ Heap Buffer Overflow PoC Generator for 7-Zip

CVE-2026-14266HIGH22 jul 2026

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

41RIESGO

GitHub PoC

PoC reproducer for CVE-2026-55994 (Apache Camel camel-iggy): the consumer copies an Iggy message's user-headers onto the Exchange unfiltered, so an injected CamelHttpUri drives a server-side request (SSRF) and leaks resolved property placeholders. Fixed in 4.18.3/4.21.0.

CVE-2026-55994HIGH22 jul 2026

Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviour

41RIESGO

GitHub PoC★ 1

CVE-2026-16540 — Simply Schedule Appointments < 1.6.12.6 Unauthenticated Appointment Data Disclosure and Mass Deletion

CVE-2026-16540HIGH22 jul 2026

Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

41RIESGO

GitHub PoC★ 21

CVE-2026-64600

CVE-2026-64600HIGH22 jul 2026

xfs: resample the data fork mapping after cycling ILOCK

41RIESGO

GitHub PoC★ 17

CVE-2026-43499 PoC Scanner

CVE-2026-43499HIGH22 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC

CVE-2026-58138 - Conductor (3.21.21..<3.30.2) unauthenticated RCE via INLINE GraalVM evaluator

CVE-2026-58138CRITICAL22 jul 2026

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

68RIESGO

GitHub PoC★ 15

Pre-auth RCE PoC for WordPress core — chains CVE-2026-63030 (REST /batch/v1 route-confusion desync) with CVE-2026-60137 (author__not_in SQLi) into an unauthenticated shell. Authorized testing only.

CVE-2026-63030CRITICALbajo ataque22 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC★ 1

CVE-2026-52813 (Gogs Path Traversal → Git Hooks RCE) defensive writeup: root-cause & patch analysis, Sigma/SIEM detection rules, IOCs, non-intrusive version scanner. No weaponized PoC.

CVE-2026-52813CRITICAL21 jul 2026

Gogs: Path Traversal in organization name results in RCE through Git hooks

48RIESGO

GitHub PoC

Mofarthim/CVE-2026-50369

CVE-2026-50369HIGH21 jul 2026

Windows Remote Desktop Services Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC

PoC detector & safe validator for the WP2Shell WordPress vulnerability chain: CVE-2026-63030 (REST batch-route confusion) + CVE-2026-60137 (author__not_in SQL injection). For authorized security testing only.

CVE-2026-63030CRITICALbajo ataque21 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

WhatsWrongAndWhy/CVE-2018-18955

CVE-2018-18955—21 jul 2026

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat

38RIESGO

GitHub PoC★ 1

PoC for CVE-2026-57588 - SQL injection in Nessus 10.12.0 XML import. Generates malicious .nessus files to enumerate databases, exfiltrate credentials, and test time-based blind injection. For authorized security research. Author: Sudeepa Wanigarathna. Patched in 10.12.1.

CVE-2026-57588LOW21 jul 2026

SQL Injection in Nessus via Malicious Scan Result File Import

28RIESGO

GitHub PoC

my exploit for GLPI

CVE-2022-35914CRITICALbajo ataque21 jul 2026

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

100RIESGO

GitHub PoC

CVE-2026-13233 (Drupal OpenAI Provider, SA-CONTRIB-2026-053): response-URL SSRF / local file read. Untrusted upstream, not the prompt. Safe reproducer + detections. Fixed in 1.1.1/1.2.2.

CVE-2026-13233LOW21 jul 2026

OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053

28RIESGO

GitHub PoC

WhatsWrongAndWhy/CVE-2017-7308

CVE-2017-7308—21 jul 2026

The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer

43RIESGO

GitHub PoC

PoC reproducer for CVE-2026-49099 (Apache Camel camel-salesforce): the non-Camel-prefixed sObjectQuery header escapes the HTTP header filter and overrides the producer's configured SOQL (SOQL injection / broken access control). Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-49099MEDIUM21 jul 2026

Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour

33RIESGO

GitHub PoC

PoC reproducer for CVE-2026-49365 (Apache Camel camel-netty-http / camel-undertow): muteException defaults to false, so an uncaught exception's full Java stack trace is returned to the HTTP client (CWE-209). Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-49365MEDIUM21 jul 2026

Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients

33RIESGO

GitHub PoC★ 1

PoC reproducer for CVE-2026-53913 (Apache Camel camel-keycloak): KeycloakSecurityPolicy fails open in the Basic Setup — with no required roles/permissions the token is never verified, so any forged/garbage bearer token bypasses authentication (unauthenticated RCE). Fixed in 4.18.3/4.21.0.

CVE-2026-53913CRITICAL21 jul 2026

Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted

48RIESGO

GitHub PoC★ 1

CVE-2026-6875

CVE-2026-6875CRITICAL21 jul 2026

Sandbox Escape in ServiceNow AI Platform

63RIESGO

GitHub PoC

Tracking the nginx CVE-2026-42533 map/regex capture-clobbering heap overflow

CVE-2026-42533CRITICAL21 jul 2026

NGINX Map directive and Regex matching vulnerability

48RIESGO

GitHub PoC★ 6

jaf0rk/CVE-2026-9973-exploit

CVE-2026-9973HIGH21 jul 2026

Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code i

41RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.