Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.794exploits catalogados

36.057CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientes populares riesgo

14.316 exploits

GitHub PoC★ 2

CVE-2026-23744 is an unauthenticated command injection in MCPJam Inspector ≤1.4.2 via /api/mcp/connect. This POC exploits it by sending a crafted JSON payload to execute arbitrary commands, granting a reverse shell with PTY.

CVE-2026-23744CRITICAL10 ago 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

GitHub PoC

The poc of CVE-2025-59528

CVE-2025-59528CRITICAL10 ago 2026

Flowise has Remote Code Execution vulnerability

85RIESGO

GitHub PoC★ 1

IamDremig/CVE-2026-14802

CVE-2026-14802MEDIUM10 ago 2026

react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection

33RIESGO

GitHub PoC★ 1

CVE-2026-43499 (GhostLock) research on HUAWEI MatePad Pro 11 GOT-W29

CVE-2026-43499HIGH10 ago 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC★ 2

独立 APK：CVE-2026-43499 GhostLock 提权 + Shizuku shell 身份执行

CVE-2026-43499HIGH10 ago 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC★ 4

GhostLock-X200 v1.0 - temporary root toolchain for vivo X200 (PD2415 / b57 kernel) based on CVE-2026-43499. For authorized security research only.

CVE-2026-43499HIGH10 ago 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC★ 2

A rewritten Proof-of-Concept / Local Privilege Escalation (LPE) exploit targeting CVE-2019-2215, a Use-After-Free vulnerability in the Android Binder driver.

CVE-2019-2215HIGHbajo ataque10 ago 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

98RIESGO

GitHub PoC

CVE-2026-43499 GhostLock APK 骨架 — 仅验证空项目能编译通过

CVE-2026-43499HIGH10 ago 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC

CVE-2026-19264 - Critical unauthenticated path traversal to full instance takeover in Postiz (< 2.22.1). Technical writeup: decode-order bypass, JWT_SECRET escalation, and analysis of the upstream fix.

CVE-2026-19264CRITICAL10 ago 2026

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

48RIESGO

GitHub PoC★ 24

CVE-2026-53361 AF_UNIX GC vs MSG_PEEK use-after-free container escape

CVE-2026-53361HIGH10 ago 2026

af_unix: Set gc_in_progress to true in unix_gc().

41RIESGO

GitHub PoC★ 1

CVE-2026-64824 — Home Assistant backup-restore symlink path traversal → root RCE. First working PoC, verified on real HA 2026.5.4 (sitecustomize.py overwrite). GHSA-cwh8-w64c-4j5h

CVE-2026-64824CRITICAL10 ago 2026

Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

48RIESGO

GitHub PoC★ 1

Tracking SCTPhantom (CVE-2026-64564), the Linux kernel SCTP ASCONF transport use-after-free

CVE-2026-64564CRITICAL10 ago 2026

sctp: don't free the ASCONF's own transport in DEL-IP processing

48RIESGO

GitHub PoC★ 1

IamDremig/CVE-2026-65591

CVE-2026-65591HIGH10 ago 2026

n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

41RIESGO

GitHub PoC

CVE-2026-65891 PoC — Joomla Content Editor file rename vulnerability (auth required, fixed in JCE 2.20.2)

CVE-2026-65891MEDIUM10 ago 2026

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.10

33RIESGO

GitHub PoC★ 1

CVE-2026-64747 AGXG14P count-bitmask OOB trigger probe (A15/iOS 26.5.2)

CVE-2026-64747HIGH10 ago 2026

A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iO

41RIESGO

GitHub PoC

CVE-2026-43499 GhostLock APK 骨架 — 从零开始，仅空项目编译验证

CVE-2026-43499HIGH10 ago 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC

Procjevt/CVE-2026-9198

CVE-2026-9198CRITICALbajo ataque10 ago 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

98RIESGO

GitHub PoC

spring retry 1.3.x fix with niche toolkit for CVE-2026-41710

CVE-2026-41710MEDIUM10 ago 2026

Cache Exhaustion in Stateful Retries leads to Denial of Service

33RIESGO

GitHub PoC★ 2

Community-maintained fork of image-size with fixes for CVE-2025-71329 and CVE-2025-71330

CVE-2025-71329HIGH10 ago 2026

image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser

41RIESGO

GitHub PoC

Authorized Kali–Metasploitable2 lab using Python and Nmap NSE to validate CVE-2011-2523 in vsFTPd 2.3.4.

CVE-2011-2523—10 ago 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

GitHub PoC

my poc for CVE-2026-53787

CVE-2026-53787CRITICAL10 ago 2026

Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload

63RIESGO

GitHub PoC★ 18

ThrottleStop.sys Arbitrary Physical Memory R/W

CVE-2025-7771HIGH10 ago 2026

Code Execution / Escalation of Privileges in ThrottleStop

41RIESGO

GitHub PoC

The poc of CVE-2026-23744

CVE-2026-23744CRITICAL10 ago 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

GitHub PoC★ 1

CVE-2026-69084/69085 — SiYuan arbitrary SQL execution via searchEmbedBlock + searchDocs SQLi (CVSS 9.9). Verified on v3.7.2, rejected on v3.7.3.

CVE-2026-69084CRITICAL09 ago 2026

SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

63RIESGO

GitHub PoC

KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499

CVE-2026-43499HIGH09 ago 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC

PoC for CVE-2025-59528 used to achieve remote code execution on the Silentium machine at HTB

CVE-2025-59528CRITICAL09 ago 2026

Flowise has Remote Code Execution vulnerability

85RIESGO

GitHub PoC

Exploiting the .lnk vulnerability and operating system handling mechanisms regarding explorer.exe and USB drives.

CVE-2017-8464HIGHbajo ataque09 ago 2026

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 201

100RIESGO

GitHub PoC

Emaar1x/CVE-2021-41773

CVE-2021-41773HIGHbajo ataqueransomware09 ago 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

GitHub PoC★ 1

PoC for CVE-2025-3248: unauthenticated RCE in Langflow < 1.3.0 via /api/v1/validate/code.

CVE-2025-3248CRITICALbajo ataqueransomware09 ago 2026

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RIESGO

GitHub PoC★ 1

A Proof-Of-Concept for the CVE-2021-44228 vulnerability.

CVE-2021-44228CRITICALbajo ataqueransomware09 ago 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.