Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

80.095exploits catalogados
36.945CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.476Referência 23.442GitHub PoC 15.312VulnCheck XDB 8970Nuclei 4393Metasploit 3502✓ solo verificadosrecientespopularesriesgo
80.095 exploits
GitHub PoC★ 2
Python POC, Exploit for CVE-2026-33017
CVE-2026-33017CRITICALbajo ataque02 jul 2026
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RIESGO
abrir ↗
GitHub PoC
CVE-2026-13768: Privileged iothubowner IoT Hub credential — fleet enumeration, device RCE, home-network pivot — Gardyn (ICSA-26-183-03)
CVE-2026-13768CRITICAL02 jul 2026
Gardyn IoT Hub Use of Hard-coded Credentials
48RIESGO
abrir ↗
GitHub PoC
kaleth4/CVE-2026-55200
CVE-2026-55200CRITICAL02 jul 2026
libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
48RIESGO
abrir ↗
GitHub PoC
CVE-2026-55726: Publicly Listable Azure Blob Storage Container (device logs) - Gardyn (ICSA-26-183-03)
CVE-2026-55726MEDIUM02 jul 2026
Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere
33RIESGO
abrir ↗
GitHub PoC
Gorse < 0.5.10 contains an authentication bypass caused by empty admin_api_key in /api/dump and /api/restore endpoints, letting unauthenticated remote attackers access and modify protected data, exploit requires default empty admin_api_key configuration.
CVE-2026-56782CRITICAL02 jul 2026
Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints
63RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-48558CRITICAL02 jul 2026
SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
75RIESGO
abrir ↗
GitHub PoC
motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read
CVE-2026-55488HIGH01 jul 2026
motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read
21RIESGO
abrir ↗
GitHub PoC
O F5 BIG-IP é uma plataforma de entrega e segurança de aplicações amplamente utilizada em ambientes corporativos. A CVE-2020-5902 é uma vulnerabilidade crítica no TMUI que, em versões não corrigidas, pode permitir acesso não autorizado e execução remota de código, reforçando a necessidade de atualização e gestão contínua de vulnerabilidades.
CVE-2020-5902CRITICALbajo ataqueransomware01 jul 2026
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RIESGO
abrir ↗
GitHub PoC★ 1
Safari 跨域信息读取
CVE-2026-43735HIGH01 jul 2026
The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS
41RIESGO
abrir ↗
VulnCheck XDB
client-side
CVE-2026-56011HIGH01 jul 2026
WordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerability
41RIESGO
abrir ↗
VulnCheck XDB
denial-of-service
CVE-2026-42945CRITICAL01 jul 2026
NGINX ngx_http_rewrite_module vulnerability
60RIESGO
abrir ↗
GitHub PoC★ 8
CVE-2026-6307 PoC: Longinus - 2 Boundaries in One Bug https://nebusec.ai/research/v8-cve-2026-6307-writeup/)
CVE-2026-6307HIGH01 jul 2026
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code
41RIESGO
abrir ↗
GitHub PoC★ 48
Google Chrome CVE-2026-6307 PoC
CVE-2026-6307HIGH01 jul 2026
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code
41RIESGO
abrir ↗
GitHub PoC★ 1
OpenSTAManager RCE Exploit (CVE-2026-38751)
CVE-2026-38751HIGH01 jul 2026
OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionali
41RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2025-57819CRITICALbajo ataque01 jul 2026
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗
GitHub PoC★ 1
pedit COW
CVE-2026-46331HIGH01 jul 2026
net/sched: fix pedit partial COW leading to page cache corruption
41RIESGO
abrir ↗
GitHub PoC
Blue-team lab: detecting & mitigating CVE-2025-24054 (Windows NTLM hash disclosure) with Sysmon, Wazuh SIEM, and Group Policy
CVE-2025-24054MEDIUMbajo ataque01 jul 2026
NTLM Hash Disclosure Spoofing Vulnerability
75RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2026-10520CRITICAL01 jul 2026
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote
85RIESGO
abrir ↗
GitHub PoC
do4choo/CVE-2026-53694-NoMachine-LPE
CVE-2026-53694HIGH01 jul 2026
Potential local privileges escalation through argument injection in the nxchmod.sh script
41RIESGO
abrir ↗
GitHub PoC★ 1
A flaw was found in NGINX, specifically within the ngx_http_rewrite_module. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests under specific rewrite configurations. This can lead to a heap buffer overflow in the NGINX worker process, which may result in arbitrary code execution
CVE-2026-42945CRITICAL01 jul 2026
NGINX ngx_http_rewrite_module vulnerability
60RIESGO
abrir ↗
GitHub PoC
rootdirective-sec/CVE-2026-56011-Lab
CVE-2026-56011HIGH01 jul 2026
WordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerability
41RIESGO
abrir ↗
GitHub PoC
Its1Zero/cve-2025-57819-exploit
CVE-2025-57819CRITICALbajo ataque01 jul 2026
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗
GitHub PoC
emilliewatson96/spryCVE-2026-10520
CVE-2026-10520CRITICAL01 jul 2026
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote
85RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2020-5902CRITICALbajo ataqueransomware01 jul 2026
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RIESGO
abrir ↗
GitHub PoC
CVE-2026-48907 PoC
CVE-2026-48907CRITICALbajo ataque01 jul 2026
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗
GitHub PoC
CyberDefenders JetBrains Lab
CVE-2024-27198CRITICALbajo ataqueransomware01 jul 2026
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RIESGO
abrir ↗
GitHub PoC
Pivotal CRM's patch for an initial deserialization vulnerability was incomplete. The fix switched from BinaryFormatter to JSON.NET but left TypeNameHandling set to 4 without implementing SerializationBinder, allowing attackers to execute arbitrary code through malicious $type payloads. Fixed in 6.6.5.10 and Patch_CWE502_20260316.zip
CVE-2026-51947CRITICAL01 jul 2026
An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 a
48RIESGO
abrir ↗
GitHub PoC★ 1
🛡️ CVE Proof-of-Concept Hub — 21 security advisories · 80+ vulnerabilities · 19 CVEs under review · 1 PUBLISHED (CVE-2026-66412)
CVE-2026-66412HIGH01 jul 2026
Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC
21RIESGO
abrir ↗
GitHub PoC
CVE-2026-46817 - Draft
CVE-2026-46817CRITICALbajo ataque30 jun 2026
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi
83RIESGO
abrir ↗
GitHub PoC
Defensive validation of CVE-2026-46331 / pedit COW with auditd, AppArmor, mitigation comparison and detection logic.
CVE-2026-46331HIGH30 jun 2026
net/sched: fix pedit partial COW leading to page cache corruption
41RIESGO
abrir ↗
← anteriorpágina 79 / 2670siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.