Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

26.494 exploits

Referência

CVE-2026-85030

CVE-2026-85030MEDIUM

HKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic error

33RIESGO

abrir ↗

Referência

CVE-2026-85092

CVE-2026-85092MEDIUM

LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

33RIESGO

abrir ↗

Referência

CVE-2017-6327

CVE-2017-6327HIGHbajo ataque

The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situ

83RIESGO

abrir ↗

Referência

CVE-2021-46398

CVE-2021-46398—

A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor use

23RIESGO

abrir ↗

Referência

CVE-2026-85091

CVE-2026-85091HIGH

zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate

41RIESGO

abrir ↗

Referência

CVE-2026-84886

CVE-2026-84886MEDIUM

simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption

33RIESGO

abrir ↗

Referência

CVE-2026-77794

CVE-2026-77794MEDIUM

RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity

33RIESGO

abrir ↗

Referência

CVE-2026-77793

CVE-2026-77793MEDIUM

RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field

33RIESGO

abrir ↗

Referência

CVE-2026-81198

CVE-2026-81198LOW

MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR

28RIESGO

abrir ↗

Referência

CVE-2026-108935

CVE-2026-108935MEDIUM

Edimax BR-6208AC Port Forwarding formPortFw cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-108934

CVE-2026-108934MEDIUM

Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-108933

CVE-2026-108933MEDIUM

Edimax BR-6208AC formFilter cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-109571

CVE-2026-109571LOW

Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE

28RIESGO

abrir ↗

Referência

CVE-2026-109570

CVE-2026-109570MEDIUM

Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection

33RIESGO

abrir ↗

Referência

CVE-2026-108930

CVE-2026-108930MEDIUM

Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-108928

CVE-2026-108928MEDIUM

itsourcecode Online Admission System sum.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2017-8678

CVE-2017-8678—

The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server

23RIESGO

abrir ↗

Referência

CVE-2017-8680

CVE-2017-8680—

The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server

23RIESGO

abrir ↗

Referência

CVE-2026-96680

CVE-2026-96680MEDIUM

ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization

33RIESGO

abrir ↗

Referência

CVE-2026-87777

CVE-2026-87777MEDIUM

Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute

33RIESGO

abrir ↗

Referência

CVE-2026-16542

CVE-2026-16542MEDIUM

Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar

33RIESGO

abrir ↗

Referência

CVE-2026-19751

CVE-2026-19751MEDIUM

EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-117526

CVE-2026-117526MEDIUM

reduxjs redux-devtools Remotedev Server evalAction code injection

33RIESGO

abrir ↗

Referência

CVE-2026-117516

CVE-2026-117516MEDIUM

oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2013-20008

CVE-2013-20008HIGH

Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password

41RIESGO

abrir ↗

Referência

CVE-2024-58387

CVE-2024-58387HIGH

Inspur HCM Cloud Arbitrary File Read via file/download Endpoint

41RIESGO

abrir ↗

Referência

CVE-2026-100192

CVE-2026-100192MEDIUM

X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint

33RIESGO

abrir ↗

Referência

CVE-2026-102846

CVE-2026-102846MEDIUM

gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization

33RIESGO

abrir ↗

Referência

CVE-2026-93964

CVE-2026-93964MEDIUM

NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication

33RIESGO

abrir ↗

Referência

CVE-2026-96676

CVE-2026-96676MEDIUM

Fast FAC1900R uhttpd get_alias_name stack-based overflow

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.