Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.899exploits catalogados

40.763CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientes populares riesgo

87.899 exploits

GitHub PoC

POC for CVE-2026-12118

CVE-2026-12118CRITICAL15 oct 2026

IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data

48RIESGO

VulnCheck XDB

local

CVE-2026-43284HIGH15 oct 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALbajo ataqueransomware15 oct 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

CVE-2026-64507 — PoC: IBPB flush on BPF JIT allocation

CVE-2026-64507—15 oct 2026

x86/bugs: Enable IBPB flush on BPF JIT allocation

23RIESGO

GitHub PoC

CVE-2026-0322

CVE-2026-0322HIGHbajo ataque15 oct 2026

PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

71RIESGO

GitHub PoC

Unauthenticated RCE via Velocity Template Language (VTL) injection in Floci API Gateway mapping templates (versions 1.1.0–2.2.0). CVSS 9.8 Critical.

CVE-2026-108598CRITICAL15 oct 2026

Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

48RIESGO

GitHub PoC

shlln/CVE-2026-110958

CVE-2026-110958CRITICAL15 oct 2026

Wavlink WN530HG4B api.cgi heap-based overflow

48RIESGO

GitHub PoC★ 1

Detection-only check for the Ivanti Connect Secure authentication bypass (CVE-2026-104935)

CVE-2026-104935HIGHbajo ataque15 oct 2026

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb

100RIESGO

GitHub PoC★ 1

CVE-2026-85097 — Bricksforge <= 3.1.8.9 unauth file upload to RCE. GIF/PHP polyglot + temporaryFileUploads.url mismatch. python3 exploit.py --url http://TARGET

CVE-2026-85097CRITICAL15 oct 2026

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

63RIESGO

GitHub PoC★ 2

CVE-2026-110912

CVE-2026-110912HIGH15 oct 2026

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.

41RIESGO

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALbajo ataqueransomware15 oct 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

Proof of concept and vulnerability checker for CVE-2026-18963, an unauthenticated account takeover in the Keycloak reset-credentials flow. Single-file Python, optional Playwright browser component.

CVE-2026-18963CRITICAL15 oct 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RIESGO

GitHub PoC

CVE-2026-104715: cifs-utils credentials-file option injection (local root)

CVE-2026-104715HIGH15 oct 2026

Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

41RIESGO

VulnCheck XDB

initial-access

CVE-2026-18963CRITICAL15 oct 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RIESGO

VulnCheck XDB

remote-with-credentials

CVE-2026-44825HIGH15 oct 2026

Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users

56RIESGO

VulnCheck XDB

initial-access

CVE-2025-41450HIGH15 oct 2026

Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2

41RIESGO

GitHub PoC

sohel160/Webfig-jsproxy-unauthenticated-file-read-CVE-2026-67281-

CVE-2026-67281HIGH14 oct 2026

Unauthenticated file read in Mikrotik RouterOS

41RIESGO

GitHub PoC

Autonomous submission for "Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability" (MSRC / GitHub Security Advisory)

CVE-2026-96230HIGH14 oct 2026

ASP.NET Core Remote Code Execution Vulnerability

41RIESGO

GitHub PoC★ 46

wkpwn/CVE-2026-83834

CVE-2026-83834HIGH14 oct 2026

Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC

CVE-2021-4034 (PwnKit) - Python PoC

CVE-2021-4034HIGHbajo ataqueransomware14 oct 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

GitHub PoC

EndlssNightmare/CVE-2026-18116

CVE-2026-18116HIGH14 oct 2026

Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications

41RIESGO

GitHub PoC★ 2

ABC00012345/CVE-2026-74580

CVE-2026-74580HIGH14 oct 2026

vhost: reset the vring metadata cache on vring reconfiguration

41RIESGO

GitHub PoC

V8 inlined Array.prototype.sort elements-kind confusion - PoC + addrof (N-day research)

CVE-2026-85046HIGHbajo ataque14 oct 2026

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

71RIESGO

GitHub PoC★ 2

Exploit para explotar la vulnerabilidad CVE-2020-25213 en WPFileManager < 6.9

CVE-2020-25213CRITICALbajo ataque14 oct 2026

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra

100RIESGO

GitHub PoC

Tarangj07/Wordpress-Lab-CVE-2026-85097

CVE-2026-85097CRITICAL14 oct 2026

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

63RIESGO

VulnCheck XDB

initial-access

CVE-2026-105133MEDIUMbajo ataque14 oct 2026

Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

100RIESGO

GitHub PoC★ 1

Heartbleed (CVE-2014-0160) reproduction and analysis —CSP Application Security project

CVE-2014-0160HIGHbajo ataque14 oct 2026

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC

Penetration test report for the DC-1 VulnHub machine: Drupalgeddon2 (CVE-2018-7600) RCE, credential discovery, and SUID privilege escalation to root. Includes CVSS-rated findings and a remediation roadmap.

CVE-2018-7600CRITICALbajo ataqueransomware14 oct 2026

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RIESGO

GitHub PoC

DirtyFrag (CVE-2026-43284) pro Galaxy A57 5G (SM-A576B, A576BXXS6AZI2): gatilho libbase pro One UI 8.5 + dfroot.ko compilado exato pro 6.12.38-android16-5 do aparelho

CVE-2026-43284HIGH14 oct 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

GitHub PoC★ 3

Unauthenticated privilege escalation in SimpleForm WordPress plugin <= 3.10.0. Registers an administrator account without authentication

CVE-2026-104748CRITICAL14 oct 2026

SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register

48RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.