Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.899exploits catalogados

40.763CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientes populares riesgo

87.899 exploits

GitHub PoC★ 1

Passive internet-wide discovery + responsible-disclosure helper for CVE-2026-74580 (Linux vhost metadata-cache bug) — queries existing scan data (Sonar/Shodan/Censys), triages exposure, and drafts (never auto-sends) notices to owners.

CVE-2026-74580HIGH17 oct 2026

vhost: reset the vring metadata cache on vring reconfiguration

41RIESGO

GitHub PoC★ 3

cve-2026-99999-audit script (PwnEscape)

CVE-2026-99999CRITICAL17 oct 2026

ipv4: validate checksum_start before completing checksum

48RIESGO

GitHub PoC

Vulnerability analysis, exploitation, and multi-layered defense hardening for Apache Struts 2 (CVE-2017-5638) & Windows Print Spooler / PrintNightmare (CVE-2021-34527) with ELK SIEM monitoring and Windows Event Log auditing.

CVE-2017-5638CRITICALbajo ataqueransomware17 oct 2026

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RIESGO

GitHub PoC★ 2

CVE-2026-64560 temporary-root exploit for realme RMX6699 (Snapdragon 8 Elite, kernel 6.6.118, Android 17/COOS17)

CVE-2026-64560HIGH17 oct 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RIESGO

GitHub PoC

songzzzz/CVE-2026-8933

CVE-2026-8933HIGH17 oct 2026

snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup

41RIESGO

GitHub PoC★ 2

Lab PoC for CVE-2026-96889: Next.js Image Optimization SVG typed as AVIF reaches librsvg UAF (RUSTSEC-2026-0305). Unauthenticated RCE on glibc Linux.

CVE-2026-96889HIGH16 oct 2026

Librsvg: use-after-free when xml includes have duplicated entities

41RIESGO

GitHub PoC

Security advisory — SQL Injection leading to RCE in Vedo Suite (Bottinelli Informatica). Responsible disclosure.

CVE-2026-51366CRITICAL16 oct 2026

SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary c

48RIESGO

GitHub PoC★ 8

CVE-2026-89079 — WordPress Theme My Login multisite unauth password overwrite PoC (check, verify, exploit). Not version-only: requires MS + tml_user_passwords.

CVE-2026-89079CRITICAL16 oct 2026

Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter

63RIESGO

VulnCheck XDB

initial-access

CVE-2026-89079CRITICAL16 oct 2026

Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter

63RIESGO

VulnCheck XDB

initial-access

CVE-2024-2961HIGH16 oct 2026

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4

78RIESGO

GitHub PoC

Wheels SQL injection on MySQL/MariaDB with backslash escaping enabled

CVE-2026-111444CRITICAL16 oct 2026

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent)

48RIESGO

VulnCheck XDB

client-side

CVE-2021-22204MEDIUMbajo ataque16 oct 2026

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RIESGO

GitHub PoC

azqzazq1/CVE-2026-110896

CVE-2026-110896MEDIUM16 oct 2026

WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability

33RIESGO

GitHub PoC★ 1

Reproducer for CVE-2026-79983 (Apache Camel camel-ftp): the consumer builds the remote path from the server's directory listing without containment, escaping the polled directory — Camel Spring Boot + Camel Quarkus

CVE-2026-79983HIGH16 oct 2026

Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside

41RIESGO

GitHub PoC

Reproducer for CVE-2026-78163 (Apache Camel camel-docling): unvalidated String body input source enables SSRF and local file disclosure in DoclingProducer — Camel Spring Boot + Camel Quarkus

CVE-2026-78163MEDIUM16 oct 2026

Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure

33RIESGO

GitHub PoC

Reproducer for CVE-2026-79986 (Apache Camel camel-azure-files): the consumer builds the remote path from the share listing without containment (author-only; see CVE-2026-79983/79984 for the runnable mechanism) — Camel Spring Boot + Camel Quarkus

CVE-2026-79986HIGH16 oct 2026

Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside

41RIESGO

GitHub PoC

Reproducer for CVE-2026-78165 (Apache Camel camel-spring-redis): default JdkSerializationRedisSerializer deserializes Redis PUBLISH payloads with no ObjectInputFilter (RCE) — Camel Spring Boot + Camel Quarkus

CVE-2026-78165HIGH16 oct 2026

Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads

41RIESGO

GitHub PoC

cPanel & WHM Authentication Bypass via CVE-2026-41940 explotation

CVE-2026-41940CRITICALbajo ataqueransomware16 oct 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-97229CRITICALbajo ataque16 oct 2026

Integer Overflow or Wraparound in GitLab

100RIESGO

GitHub PoC

A read-only, passive scanner that checks a REDCap host for exposure to and compromise by **CVE-2026-90817** — the unauthenticated survey-endpoint remote-code-execution flaw abused by the XMRig cryptomining campaign documented by Palo Alto Unit 42

CVE-2026-90817CRITICAL16 oct 2026

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce

63RIESGO

GitHub PoC★ 3

Restricted eBPF TC ingress guard, CO-RE detector, verified loader, and C11 VMM launch supervisor for CVE-2026-99999

CVE-2026-99999CRITICAL16 oct 2026

ipv4: validate checksum_start before completing checksum

48RIESGO

GitHub PoC

Reproducer for CVE-2026-79985 (Apache Camel camel-smb): the SMB consumer builds the remote path from the share listing without containment (author-only; see CVE-2026-79983/79984 for the runnable mechanism) — Camel Spring Boot + Camel Quarkus

CVE-2026-79985HIGH16 oct 2026

Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside

41RIESGO

GitHub PoC★ 4

CVE-2026-102764 BeyondTrust Remote Support unauthenticated file write / RCE proof of concept

CVE-2026-102764CRITICALbajo ataque16 oct 2026

Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

100RIESGO

GitHub PoC

Reproducer for CVE-2026-78164 (Apache Camel HTTP producers): property placeholders resolved on the message-supplied CamelHttpUri/CamelRestHttpUri headers leak secrets into the outbound request — Camel Spring Boot + Camel Quarkus

CVE-2026-78164HIGH16 oct 2026

Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers

41RIESGO

GitHub PoC

BIBILZERODAY/CVE-2026-61979-miniOrange-SAML-Auth-Bypass-Exploit

CVE-2026-61979HIGH16 oct 2026

WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

21RIESGO

GitHub PoC

CVE-2026-92209

CVE-2026-92209HIGH16 oct 2026

NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability

41RIESGO

GitHub PoC

CVE-2026-92208

CVE-2026-92208HIGH16 oct 2026

NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability

41RIESGO

GitHub PoC

Frappe HRMS missing input validation SQL injection vulnerability

CVE-2026-111389HIGH16 oct 2026

Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation

41RIESGO

GitHub PoC

CVE-2026-104745 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0.

CVE-2026-104745HIGH16 oct 2026

Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter

41RIESGO

GitHub PoC

ExifTool Exploit CVE-2021-22204 \\ Arbitrary Code Execution

CVE-2021-22204MEDIUMbajo ataque16 oct 2026

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.