Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.780exploits catalogados

39.319CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.394Exploit-DB 24.485GitHub PoC 16.249VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.249 exploits

GitHub PoC★ 3

CVE-2026-48908 — PoC exploit for unauthenticated RCE in SP Page Builder (Joomla) via arbitrary file upload. Multi‑threaded, case‑bypass, shell verification. For authorized security testing only.

CVE-2026-48908CRITICALbajo ataque07 jul 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

100RIESGO

GitHub PoC★ 1

Stored Cross-Site Scripting (XSS) in osTicket via Vulnerable Bootstrap Tooltip Component

CVE-2026-36214MEDIUM07 jul 2026

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable

33RIESGO

GitHub PoC

CVE-2026-14191 - Draft

CVE-2026-14191HIGH07 jul 2026

WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader

41RIESGO

GitHub PoC★ 1

Exploitability PoC for CVE-2026-49352 (9router Hardcoded JWT Secret Authentication Bypass)

CVE-2026-49352CRITICAL06 jul 2026

9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

48RIESGO

GitHub PoC

CVE-2012-2122 - MySQL Authentication Bypass

CVE-2012-2122—06 jul 2026

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor

60RIESGO

GitHub PoC

Reproducer for CVE-2026-40022: Apache Camel camel-platform-http-main authentication bypass on non-root context paths

CVE-2026-40022HIGH06 jul 2026

Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime

41RIESGO

GitHub PoC

CVE-2026-24061-PoC

CVE-2026-24061CRITICALbajo ataque06 jul 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC★ 4

Early Attestation Considered Very Harmful (CVE-2026-100833 of CVSS 9.6, CVE-2026-108265 of CVSS 9.1, CVE-2026-108266 of CVSS 9.1, CVE-2026-108267 of CVSS 9.1, CVE-2026-108268 of CVSS 9.1, CVE-2026-108269 of CVSS 9.1, CVE-2026-100835 of CVSS 9.1, CVE-2026-92701 of CVSS 9.1, CVE-2026-92702 of CVSS 9.1, CVE-2026-33697 of CVSS 7.5, and more to come)

CVE-2026-100833HIGH06 jul 2026

Contrast before 1.23.1 Image Substitution via Policy Generation

41RIESGO

GitHub PoC

HTB "Abducted" write-up. Exploit CVE-2026-4480 (Samba RCE) → SMB wide links → systemd → root. Full methodology and flags.

CVE-2026-4480CRITICAL06 jul 2026

Samba: samba: remote code execution in printing subsystem via unescaped job description

68RIESGO

GitHub PoC

Next.js / RSC - Unauthenticated RCE (React2Shell) (CVE-2025-55182)

CVE-2025-55182CRITICALbajo ataqueransomware06 jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC★ 24

imbas007/CVE-2026-48282

CVE-2026-48282CRITICALbajo ataque06 jul 2026

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

100RIESGO

GitHub PoC

OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value.

CVE-2026-25555CRITICAL06 jul 2026

OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header

63RIESGO

GitHub PoC★ 3

Early Attestation Considered Very Harmful (CVE-2026-92701, CVE-2026-92702, CVE-2026-33697, and more to come)

CVE-2026-92701CRITICAL06 jul 2026

Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path

28RIESGO

GitHub PoC

Exploit for Authenticated Remote Code Execution (RCE) in Krayin CRM v2.2.x (CVE-2026-38526)

CVE-2026-38526CRITICAL06 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

GitHub PoC

Reproducer for CVE-2026-27172: Apache Camel camel-consul ConsulRegistry Java deserialization (RCE)

CVE-2026-27172HIGH06 jul 2026

Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

41RIESGO

GitHub PoC

AF_ALG/splice 기반 Linux Page Cache 변조 취약점 분석 및 대응 실습

CVE-2026-31431HIGHbajo ataque06 jul 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

GitHub PoC★ 7

jaf0rk/CVE-2026-14382

CVE-2026-14382CRITICAL06 jul 2026

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to

48RIESGO

GitHub PoC

Rust-based DLL hijacking loader for MobaXterm (CVE-2026-6421) with persistence

CVE-2026-6421HIGH06 jul 2026

Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path

41RIESGO

GitHub PoC★ 1

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution

CVE-2024-39024HIGH06 jul 2026

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.

41RIESGO

GitHub PoC★ 1

Reproducer for CVE-2026-33454: Apache Camel camel-mail header injection to RCE via camel-exec

CVE-2026-33454CRITICAL06 jul 2026

Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)

48RIESGO

GitHub PoC

HTB_Nexus Penetration Test Report – Comprehensive security assessment documenting credential leakage from Gitea, CVE-2026-38526 exploitation in Krayin CRM, and privilege escalation via Gitea template sync directory traversal. Mapped to MITRE ATT&CK and NSA D3FEND frameworks with actionable remediation roadmap and full evidence appendix.

CVE-2026-38526CRITICAL06 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

GitHub PoC

Reproducer for CVE-2026-33453: Apache Camel camel-coap header injection to RCE via camel-exec

CVE-2026-33453CRITICAL06 jul 2026

Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution

63RIESGO

GitHub PoC

tammin86/4thProject_Team1-CVE-2025-55182-

CVE-2025-55182CRITICALbajo ataqueransomware06 jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

MESLIMOHAMEDM22005188/path-traversal-CVE-2026-14628

CVE-2026-14628MEDIUM05 jul 2026

NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal

33RIESGO

GitHub PoC★ 1

CVE-2018-10933 - libssh Authentication Bypass

CVE-2018-10933CRITICAL05 jul 2026

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul

85RIESGO

GitHub PoC

Research and hands-on PoC of Spectre Variant 2 (CVE-2017-5715), a hardware side-channel vulnerability exploiting CPU speculative execution and branch prediction. Includes lab setup, vulnerability identification, exploit walkthrough, cache-timing analysis, demo video, and mitigation strategies.

CVE-2017-5715MEDIUM05 jul 2026

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized discl

55RIESGO

GitHub PoC★ 6

Public PoC and detector for CVE-2026-20896 ("Gitea Docker: One Header, Any User")

CVE-2026-20896CRITICAL05 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RIESGO

GitHub PoC

 CVE-2026-49049 - Unauthenticated File Deletion, Arbitrary Write & XSS Injection for Helix3 Joomla Extension

CVE-2026-49049HIGH05 jul 2026

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

56RIESGO

GitHub PoC★ 2

Pre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0)

CVE-2026-48939CRITICALbajo ataque05 jul 2026

Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15

98RIESGO

GitHub PoC★ 6

Epson Printer RAW Protocol Exploit Framework

CVE-2026-39047HIGH05 jul 2026

Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Prin

21RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.