Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.780exploits catalogados

39.319CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.394Exploit-DB 24.485GitHub PoC 16.249VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.249 exploits

GitHub PoC

WhatsWrongAndWhy/CVE-2015-1328

CVE-2015-1328—15 jul 2026

The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no

50RIESGO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-46585: Apache Camel camel-lucene QUERY header injection enabling authorization bypass / index data exfiltration (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-46585HIGH15 jul 2026

Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-15410 - More: https://github.com/HORKimhab/poc-cve-collection

CVE-2026-15410HIGHbajo ataqueransomware15 jul 2026

Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the S

76RIESGO

abrir ↗

GitHub PoC★ 10

CvE-2026-43499偏移量计算

CVE-2026-43499HIGH15 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC★ 1

ctn-Qvo/CVE-2026-43499-so-build

CVE-2026-43499HIGH15 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

Kanak-CypherX/cve-2024-4577-lab

CVE-2024-4577CRITICALbajo ataqueransomware15 jul 2026

Argument Injection in PHP-CGI

100RIESGO

abrir ↗

GitHub PoC★ 21

PoC for CVE-2026-3891 — Unauthenticated Arbitrary File Upload leading to Remote Code Execution in Pix for WooCommerce <= 1.5.0

CVE-2026-3891CRITICAL15 jul 2026

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

68RIESGO

abrir ↗

GitHub PoC★ 1

Samsung libimagecodec.quram.so OOB Write PoC

CVE-2026-21045HIGH15 jul 2026

Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote

41RIESGO

abrir ↗

GitHub PoC★ 1

罗技云掌机 · GhostLock CVE-2026-43499 root 尝试

CVE-2026-43499HIGH15 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC★ 47

Xiaomi K70e (duchamp) one-click root via CVE-2026-43499 (IonStack) + KernelSU integration

CVE-2026-43499HIGH15 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

WhatsWrongAndWhy/CVE-2016-8655

CVE-2016-8655—15 jul 2026

Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau

43RIESGO

abrir ↗

GitHub PoC

Cxyofficial/x200-cve-2026-43499

CVE-2026-43499HIGH15 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

ctnBobong32/CVE-2026-43499-so-build

CVE-2026-43499HIGH15 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

seqra/cve-2026-58138

CVE-2026-58138CRITICAL15 jul 2026

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

68RIESGO

abrir ↗

GitHub PoC

CVE-2025-60357- NoSQL(MongoDB) Injection POC

CVE-2025-60357HIGH15 jul 2026

AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEv

41RIESGO

abrir ↗

GitHub PoC★ 28

This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlang protocol expected by localhost:1050 and tunneling it through the websocket for file r/w and arbitrary code execution via RPC calls.

CVE-2026-15409CRITICALbajo ataqueransomware15 jul 2026

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

93RIESGO

abrir ↗

GitHub PoC★ 2

Raimu0x19/CVE-2026-13001

CVE-2026-13001CRITICAL15 jul 2026

Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

63RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2026-15409

CVE-2026-15409CRITICALbajo ataqueransomware15 jul 2026

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

93RIESGO

abrir ↗

GitHub PoC

Intentionally vulnerable VM-hosted Java shop — Log4Shell (CVE-2021-44228) workshop lab (EC2 / Azure VM / GCE)

CVE-2021-44228CRITICALbajo ataqueransomware14 jul 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

JohannesLks/CVE-2026-50338

CVE-2026-50338HIGH14 jul 2026

Azure Spring Apps Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC★ 8

Bartixxx32/CVE-2026-43499-OnePlus15

CVE-2026-43499HIGH14 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

Defensive single-target self-check for Langflow CVE-2025-3248 exposure

CVE-2025-3248CRITICALbajo ataqueransomware14 jul 2026

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RIESGO

abrir ↗

GitHub PoC★ 65

Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only.

CVE-2026-43499HIGH14 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

本次个人漏洞研究进展成果

CVE-2026-43499HIGH14 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC★ 2

will be published

CVE-2026-15706CRITICAL14 jul 2026

Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

48RIESGO

abrir ↗

GitHub PoC★ 15

Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only.

CVE-2026-43499HIGH14 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-46584: Apache Camel camel-mail mail.smtp.* header injection enabling credential theft via on-path SOCKS interception (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-46584LOW14 jul 2026

Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters

28RIESGO

abrir ↗

GitHub PoC

CVE-2026-8181 — Burst Statistics WordPress plugin Authentication Bypass (CVSS 9.8) to Admin Account Takeover. Mass scanner with FOFA/Shodan integration and modern GUI.

CVE-2026-8181CRITICAL14 jul 2026

Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover

63RIESGO

abrir ↗

GitHub PoC★ 7

A proof-of-concept exploit for CVE-2026-23744 - MCPJam Inspector Remote Code Execution (RCE) vulnerability. This tool demonstrates the security flaw in versions <=1.4.2 and helps security researchers verify patches. For authorized testing and educational purposes only. Includes multiple payload options, command execution, and session management.

CVE-2026-23744CRITICAL14 jul 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2026-0740

CVE-2026-0740CRITICAL14 jul 2026

Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

75RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.