Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2015-8257
CVE-2015-8257—
The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell
28RIESGO
abrir ↗
Referência
CVE-2014-0038
CVE-2014-0038—
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo
50RIESGO
abrir ↗
Referência
CVE-2026-19996
CVE-2026-19996MEDIUM
Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management
33RIESGO
abrir ↗
Referência
CVE-2016-3139
CVE-2016-3139—
The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate
23RIESGO
abrir ↗
Referência
CVE-2026-16630
CVE-2026-16630MEDIUM
syncfusion ej2-javascript-ui-controls package.json child_process.exec os command injection
33RIESGO
abrir ↗
Referência
CVE-2016-5847
CVE-2016-5847—
SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain privileges via a hard l
23RIESGO
abrir ↗
Referência
CVE-2019-15107
CVE-2019-15107CRITICALbajo ataqueransomware
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RIESGO
abrir ↗
Referência
CVE-2026-19844
CVE-2026-19844HIGH
TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2026-107449
CVE-2026-107449LOW
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enha
28RIESGO
abrir ↗
Referência
CVE-2026-8987
CVE-2026-8987CRITICAL
Authenticated Heap Overflow
48RIESGO
abrir ↗
Referência✓ VexDay Proof
Acunetix WVS 4.0 20060717 - HTTP Sniffer Component Remote Denial of Service
CVE-2007-0120—doswindows
Acunetix Web Vulnerability Scanner (WVS) 4.0 Build 20060717 and earlier allows remote attackers to cause a denial of ser
23RIESGO
abrir ↗
Referência
CVE-2016-0173
CVE-2016-0173—
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
23RIESGO
abrir ↗
Referência
CVE-2016-6602
CVE-2016-6602—
ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependen
50RIESGO
abrir ↗
Referência
CVE-2016-4669
CVE-2016-4669—
An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS b
38RIESGO
abrir ↗
Referência
CVE-2016-2107
CVE-2016-2107—
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
45RIESGO
abrir ↗
Referência
CVE-2026-17016
CVE-2026-17016LOW
Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment
28RIESGO
abrir ↗
Referência
CVE-2019-1653
CVE-2019-1653HIGHbajo ataque
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RIESGO
abrir ↗
Referência
CVE-2026-16289
CVE-2026-16289MEDIUM
ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group
33RIESGO
abrir ↗
Referência
CVE-2026-16130
CVE-2026-16130MEDIUM
nearai ironclaw write_file path_utils.rs validate_path link following
33RIESGO
abrir ↗
Referência
CVE-2026-16129
CVE-2026-16129MEDIUM
princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist
33RIESGO
abrir ↗
Referência
CVE-2026-18775
CVE-2026-18775MEDIUM
NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-18686
CVE-2026-18686CRITICAL
GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection
48RIESGO
abrir ↗
Referência
CVE-2026-102906
CVE-2026-102906MEDIUM
0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection
33RIESGO
abrir ↗
Referência
CVE-2021-20837
CVE-2021-20837—
Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movab
60RIESGO
abrir ↗
Referência
CVE-2026-62240
CVE-2026-62240HIGH
CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools
41RIESGO
abrir ↗
Referência
CVE-2017-8488
CVE-2017-8488—
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,
23RIESGO
abrir ↗
Referência
CVE-2021-2109
CVE-2021-2109HIGH
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
63RIESGO
abrir ↗
Referência
CVE-2026-18784
CVE-2026-18784MEDIUM
o6 open62541 ua_client_highlevel.c UA_Client_readNodeClassAttribute heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2016-6854
CVE-2016-6854—
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline
23RIESGO
abrir ↗
Referência
CVE-2026-102874
CVE-2026-102874MEDIUM
HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection
33RIESGO
abrir ↗
← anteriorpágina 831 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.