Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.899exploits catalogados

40.763CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientes populares riesgo

87.899 exploits

GitHub PoC

Linux penetration testing lab: reverse shell, SUID privilege escalation, NFS misconfiguration, writable /etc/passwd, PATH hijacking, and PwnKit (CVE-2021-4034), with evidence and remediation.

CVE-2021-4034HIGHbajo ataqueransomware20 oct 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

GitHub PoC★ 1

Read-only Linux check for Plex2Shell (CVE-2026-96652/-96654/-96655/-96656) exploitation and the XMRig/proxy payloads seen in the wild

CVE-2026-96652MEDIUMbajo ataque20 oct 2026

Plex Media Server SSRF

83RIESGO

GitHub PoC★ 1

cve-2026-62911-exploit

CVE-2026-62911HIGH20 oct 2026

Microsoft Exchange Server Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC★ 13

A poc for https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6

CVE-2026-114509CRITICAL20 oct 2026

Laravel TokenGuard authentication bypass through non-string API credentials

63RIESGO

GitHub PoC

Reproducer for CVE-2026-85313 — Apache Camel camel-jetty enableCORS credentialed any-origin CORS (CWE-942). Camel Spring Boot.

CVE-2026-85313MEDIUM20 oct 2026

Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set

33RIESGO

GitHub PoC

Laboratorio de análisis y explotación de la vulnerabilidad CVE-2025-5548

CVE-2025-5548MEDIUM20 oct 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RIESGO

GitHub PoC

CVE-2026-108097

CVE-2026-108097HIGH20 oct 2026

Drupal core - Critical - Remote code execution - SA-CORE-2026-014

41RIESGO

GitHub PoC

MARIMO RCE & NKABUSE EXPLOIT FRAMEWORK (CVE-2026-39987) - RE-WEAPONIZED - This framework exploits CVE-2026-39987, a critical Remote Code Execution (RCE) vulnerability in Marimo, a popular Python-based data visualization tool. Attackers actively exploit this flaw to deploy NKAbuse, a blockchain-based botnet malware.

CVE-2026-39987CRITICALbajo ataque20 oct 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

GitHub PoC

Exploit and writeup for CVE-2026-87690

CVE-2026-87690HIGH20 oct 2026

Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution

41RIESGO

GitHub PoC★ 2

CVE-2026-106173

CVE-2026-106173CRITICAL20 oct 2026

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5

48RIESGO

GitHub PoC

CVE-2026-99999 Educational Analysis — attack chain simulation of Linux kernel csum_start bug (CVSS 9.3). See also: CVE-2026-99999-exploit (Working PoC).

CVE-2026-99999CRITICAL20 oct 2026

ipv4: validate checksum_start before completing checksum

48RIESGO

GitHub PoC★ 2

CVE-2026-106173

CVE-2026-106173CRITICAL20 oct 2026

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5

48RIESGO

GitHub PoC

Reproducer for CVE-2026-85314 — Apache Camel camel-mail MimeMultipart mail.smtp header injection (CWE-20). Camel Spring Boot + Camel Quarkus.

CVE-2026-85314MEDIUM20 oct 2026

Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)

33RIESGO

GitHub PoC★ 2

CVE-2026-106173

CVE-2026-106173CRITICAL20 oct 2026

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5

48RIESGO

GitHub PoC

Reproducer for CVE-2026-85300 — Apache Camel camel-pqc private key written with permissive file permissions (CWE-276); Spring Boot + Quarkus, affected vs fixed

CVE-2026-85300MEDIUM20 oct 2026

Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

33RIESGO

GitHub PoC

Work 1 — secure Flask REST API with CI/CD (bandit, pip-audit) and a CVE-2021-41773 analysis

CVE-2021-41773HIGHbajo ataqueransomware20 oct 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

VulnCheck XDB

initial-access

CVE-2021-41773HIGHbajo ataqueransomware20 oct 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

GitHub PoC

Secure REST API with CI/CD and CVE-2021-41773 analysis

CVE-2021-41773HIGHbajo ataqueransomware20 oct 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

GitHub PoC

利用CVE-2019-2215给小米5获取临时root（比较通用？）

CVE-2019-2215HIGHbajo ataque20 oct 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RIESGO

GitHub PoC★ 10

Proof of concept for CVE-2026-102578, a Moodle question-bank SQL injection

CVE-2026-102578MEDIUM20 oct 2026

Moodle: sql injection in question bank web service

33RIESGO

GitHub PoC

Reproducer for CVE-2026-85301 — Apache Camel camel-keycloak issuer validation bypass (CWE-287). Camel Spring Boot + Camel Quarkus.

CVE-2026-85301MEDIUM20 oct 2026

Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim

33RIESGO

GitHub PoC

Exploit and writeup for CVE-2026-87690

CVE-2026-87690HIGH20 oct 2026

Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution

41RIESGO

GitHub PoC★ 56

OnePlus 16 (PYB110) jailbreak: CVE-2026-98260 + KernelSU / KernelSU Next / BakaSU / SukiSU Ultra LKM

CVE-2026-98260HIGH20 oct 2026

exec: Cleanup POSIX timers right after de_thread()

41RIESGO

GitHub PoC

Research attribution and coordinated disclosure status for CVE-2026-105484.

CVE-2026-105484CRITICAL20 oct 2026

TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

48RIESGO

GitHub PoC

Reproducer for CVE-2026-85254 — Apache Camel camel-platform-http request-header echo suppression bypass (CWE-178); Spring Boot + Quarkus, affected vs fixed

CVE-2026-85254MEDIUM19 oct 2026

Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing

33RIESGO

GitHub PoC

Lewis1766/CVE-2023-54391-POC

CVE-2023-54391CRITICAL19 oct 2026

Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter

63RIESGO

GitHub PoC★ 2

CVE-2026-99999 (PwnEscape) reproduction: IPv4 csum_start validation bug — IHL rewrite and 32-byte kernel heap disclosure

CVE-2026-99999CRITICAL19 oct 2026

ipv4: validate checksum_start before completing checksum

48RIESGO

GitHub PoC★ 2

kpatch livepatch build and load test for CVE-2026-99999 on Rocky Linux 8.10 (4.18.0-553.144.1.el8_10)

CVE-2026-99999CRITICAL19 oct 2026

ipv4: validate checksum_start before completing checksum

48RIESGO

GitHub PoC

shizuku198411/CVE-2026-99999-KVM-checksum-metadata-non-destructive-PoC

CVE-2026-99999CRITICAL19 oct 2026

ipv4: validate checksum_start before completing checksum

48RIESGO

GitHub PoC

Reproducer for CVE-2026-80344 (Apache Camel camel-as2): asynchronous MDN SSRF + credential disclosure — the receiver delivers the MDN to the sender-chosen Receipt-Delivery-Option, presenting its credentials to an attacker-chosen host — Camel Spring Boot + Camel Quarkus

CVE-2026-80344HIGH19 oct 2026

Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address

41RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.