Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.463 exploits
GitHub PoC
saretawa/CVE-2026-86583
Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields
41RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-98260 adb runner with Termux one-tap root
exec: Cleanup POSIX timers right after de_thread()
41RIESGO
abrir ↗GitHub PoC
Script that applies the Ubuntu-published nftables mitigation for CVE-2026-98432 (Linux kernel IPv4 TCP use-after-free).
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
Certbn/CVE-2026-97229-GitLab-CI-CD
Integer Overflow or Wraparound in GitLab
100RIESGO
abrir ↗GitHub PoC
CVE-2026-97798
Windows Error Reporting Service Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC
Certbn/CVE-2026-98432-Linux-IPv4-TCP-IP-Use-After-Free
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
Python-based PoC for CVE-2026-98432, probing anomalous IPv4 TCP option behavior associated with a Linux kernel use-after-free race condition.
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
t0ge-kun/CVE-2026-98432-check
ipv4: free inet_opt and ireq_opt after an RCU grace period
48RIESGO
abrir ↗GitHub PoC
Read-only audit for CVE-2026-109518: APT HTTP backend hard-link reuse lets an on-path attacker swap a verified package (Debian/Ubuntu)
APT RCE via hard link reuse
41RIESGO
abrir ↗VulnCheck XDB
initial-access
Totolink A7000R cstecgi.cgi setUpgradeFW command injection
33RIESGO
abrir ↗VulnCheck XDB
initial-access
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running In
48RIESGO
abrir ↗GitHub PoC★ 2
php2shell (CVE-2026-109618 / CVE-2026-109619) — deliberately vulnerable PHP 8.4.26 lab with a patched 8.4.27 control and a working proof-of-concept that lands a shell as www-data.
RCE via OOM corruption
100RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
48RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
71RIESGO
abrir ↗VulnCheck XDB
initial-access
Adobe ColdFusion Improper Access Control Arbitrary code execution
100RIESGO
abrir ↗GitHub PoC
Säkerhetsvägledning för GIS-miljöer om Broccoli2Shell (CVE-2026-111497).
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC
sam00/Node2Shell-CVE-2026-111497-POC
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC
Read-only scanner for Node2Shell / CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗VulnCheck XDB
info-leak
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RIESGO
abrir ↗GitHub PoC
Research writeup: php2shell (CVE-2026-109618/109619) vs the Cloudflare PHP CTF — complete local chain, WAF lock analysis, original findings
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) 분석과 패치 기준 확인 예제
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
High-level notes for CVE-2026-109618 in PHP mod_php. Exploit code is not included.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Unauthenticated RCE exploit for PHP-FPM 8.4.26 via php2shell (CVE-2026-109618 / CVE-2026-109619) - phpMyAdmin 5.2.3, pure-HTTP PoC, defeats ASLR in-band.
RCE via OOM corruption
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.