Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.899exploits catalogados

40.763CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientes populares riesgo

87.899 exploits

GitHub PoC

CVE-2026-86478 - JetBrains YouTrack Helpdesk unauthenticated account takeover via self-asserted email (CVSS 9.8)

CVE-2026-86478CRITICAL21 oct 2026

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthent

48RIESGO

abrir ↗

VulnCheck XDB

client-side

CVE-2020-0601HIGHbajo ataque21 oct 2026

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c

93RIESGO

abrir ↗

GitHub PoC

Plex2Shell (CVE-2026-96652/54/55/56) IOC/IOA dossier and read-only Windows hunt script

CVE-2026-96652MEDIUMbajo ataque21 oct 2026

Plex Media Server SSRF

83RIESGO

abrir ↗

GitHub PoC★ 1

PHP2Shell · CVE-2026-109618 / CVE-2026-109619 的 PHP RCE 源码审计与补丁分析 | PHP remote code execution source audit, request lifecycle analysis and upstream patch review

CVE-2026-109618CRITICALbajo ataque21 oct 2026

RCE via OOM corruption

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2023-46604CRITICALbajo ataqueransomware21 oct 2026

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RIESGO

abrir ↗

VulnCheck XDB

local

CVE-2025-7771HIGH21 oct 2026

Code Execution / Escalation of Privileges in ThrottleStop

41RIESGO

abrir ↗

GitHub PoC★ 9

PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

CVE-2026-109618CRITICALbajo ataque21 oct 2026

RCE via OOM corruption

100RIESGO

abrir ↗

GitHub PoC

charindithjaindu/CVE-2026-109618

CVE-2026-109618CRITICALbajo ataque21 oct 2026

RCE via OOM corruption

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-41773HIGHbajo ataqueransomware20 oct 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-85300 — Apache Camel camel-pqc private key written with permissive file permissions (CWE-276); Spring Boot + Quarkus, affected vs fixed

CVE-2026-85300MEDIUM20 oct 2026

Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

33RIESGO

abrir ↗

GitHub PoC

Linux penetration testing lab: reverse shell, SUID privilege escalation, NFS misconfiguration, writable /etc/passwd, PATH hijacking, and PwnKit (CVE-2021-4034), with evidence and remediation.

CVE-2021-4034HIGHbajo ataqueransomware20 oct 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

abrir ↗

GitHub PoC

Secure REST API with CI/CD and CVE-2021-41773 analysis

CVE-2021-41773HIGHbajo ataqueransomware20 oct 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC★ 1

Proof of Concept for CVE-2026-86950

CVE-2026-86950HIGHbajo ataque20 oct 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS

76RIESGO

abrir ↗

VulnCheck XDB

local

CVE-2019-2215HIGHbajo ataque20 oct 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RIESGO

abrir ↗

GitHub PoC

Exploit and writeup for CVE-2026-87690

CVE-2026-87690HIGH20 oct 2026

Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution

41RIESGO

abrir ↗

GitHub PoC★ 1

cve-2026-62911-exploit

CVE-2026-62911HIGH20 oct 2026

Microsoft Exchange Server Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-85314 — Apache Camel camel-mail MimeMultipart mail.smtp header injection (CWE-20). Camel Spring Boot + Camel Quarkus.

CVE-2026-85314MEDIUM20 oct 2026

Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)

33RIESGO

abrir ↗

GitHub PoC

Exploit and writeup for CVE-2026-87690

CVE-2026-87690HIGH20 oct 2026

Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution

41RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-106173CRITICAL20 oct 2026

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-108097

CVE-2026-108097HIGH20 oct 2026

Drupal core - Critical - Remote code execution - SA-CORE-2026-014

41RIESGO

abrir ↗

GitHub PoC

Research attribution and coordinated disclosure status for CVE-2026-105484.

CVE-2026-105484CRITICAL20 oct 2026

TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

48RIESGO

abrir ↗

GitHub PoC

MARIMO RCE & NKABUSE EXPLOIT FRAMEWORK (CVE-2026-39987) - RE-WEAPONIZED - This framework exploits CVE-2026-39987, a critical Remote Code Execution (RCE) vulnerability in Marimo, a popular Python-based data visualization tool. Attackers actively exploit this flaw to deploy NKAbuse, a blockchain-based botnet malware.

CVE-2026-39987CRITICALbajo ataque20 oct 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

abrir ↗

GitHub PoC

Laboratorio de análisis y explotación de la vulnerabilidad CVE-2025-5548

CVE-2025-5548MEDIUM20 oct 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-106173

CVE-2026-106173CRITICAL20 oct 2026

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-99999 Educational Analysis — attack chain simulation of Linux kernel csum_start bug (CVSS 9.3). See also: CVE-2026-99999-exploit (Working PoC).

CVE-2026-99999CRITICAL20 oct 2026

ipv4: validate checksum_start before completing checksum

48RIESGO

abrir ↗

GitHub PoC

BlessingOlaniyan/cve-2017-0143-smbv1-analysis

CVE-2017-0143HIGHbajo ataqueransomware20 oct 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

abrir ↗

GitHub PoC

利用CVE-2019-2215给小米5获取临时root（比较通用？）

CVE-2019-2215HIGHbajo ataque20 oct 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RIESGO

abrir ↗

GitHub PoC

Work 1 — secure Flask REST API with CI/CD (bandit, pip-audit) and a CVE-2021-41773 analysis

CVE-2021-41773HIGHbajo ataqueransomware20 oct 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC

Log4Shell (CVE-2021-44228) audit findings and Actions smoke-test workflow

CVE-2021-44228CRITICALbajo ataqueransomware20 oct 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-99999 Working PoC — real VM escape for Linux kernel csum_start bug (CVSS 9.3). Guest-to-Host heap leak. See also: CVE-2026-99999-analysis (Educational).

CVE-2026-99999CRITICAL20 oct 2026

ipv4: validate checksum_start before completing checksum

48RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.