Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.464exploits catalogados

40.695CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientes populares riesgo

87.168 exploits

GitHub PoC★ 1

Bash toolkit that finds and fixes PHP CVEs — PHP2Shell (CVE-2026-109618/109619), CVE-2026-115560, CVE-2024-4577, CVE-2019-11043 — on Linux and macOS. Detects runtimes, audits config, applies source patches, hardens php.ini / FPM / nginx / Apache, hunts compromise, rolls back cleanly. MIT.

CVE-2019-11043HIGHbajo ataqueransomware31 oct 2026

Underflow in PHP-FPM can lead to RCE

100RIESGO

GitHub PoC★ 1

Bash toolkit that finds and fixes PHP CVEs — PHP2Shell (CVE-2026-109618/109619), CVE-2026-115560, CVE-2024-4577, CVE-2019-11043 — on Linux and macOS. Detects runtimes, audits config, applies source patches, hardens php.ini / FPM / nginx / Apache, hunts compromise, rolls back cleanly. MIT.

CVE-2024-4577CRITICALbajo ataqueransomware31 oct 2026

Argument Injection in PHP-CGI

100RIESGO

GitHub PoC

GStreamer RTP Depayloader Memory Exhaustion Analysis

CVE-2026-18649HIGH31 oct 2026

Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

41RIESGO

GitHub PoC★ 1

by yora cve-2020-5902

CVE-2020-5902CRITICALbajo ataqueransomware31 oct 2026

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RIESGO

GitHub PoC★ 5

PoC for CVE-2026-98432 (Linux kernel IPv4 TCP inet_opt/ireq_opt use-after-free, CVSS 9.8): KASAN-verified UAF reproduction in inet_csk_route_req with A/B fixed-kernel control

CVE-2026-98432CRITICAL31 oct 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

GitHub PoC

saretawa/CVE-2026-77396

CVE-2026-77396MEDIUM31 oct 2026

PJSIP: Heap buffer overflow in the AVI parser

33RIESGO

GitHub PoC★ 2

Interim nftables mitigation for Linux kernel CVE-2026-98432 (IPv4-options UAF in tcp_v4_syn_recv_sock) as a reproducible agent skill

CVE-2026-98432CRITICAL31 oct 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

GitHub PoC★ 1

Stopgap firewall mitigation for CVE-2026-98432 on Ubuntu 16.04/24.04

CVE-2026-98432CRITICAL31 oct 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

GitHub PoC

IPv4 SYN with IP options, one lab target per run, for CVE-2026-98432 research. Header-offset parser, regression tests, and a postmortem of a broken auto-exploiter.

CVE-2026-98432CRITICAL31 oct 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

GitHub PoC★ 3

Tiny Shizuku app that clears stuck 'SMS of Death' (CVE-2026-58882) WAP Push messages. Material 3 Expressive.

CVE-2026-58882—31 oct 2026

In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could le

23RIESGO

GitHub PoC★ 1

woshigenm/CVE-2026-89633

CVE-2026-89633CRITICAL31 oct 2026

smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

48RIESGO

GitHub PoC

Audit statique de l'exposition d'une application Quarkus au décodeur Brotli vulnérable (CVE-2026-111497). Généré avec Claude Code.

CVE-2026-111497CRITICAL31 oct 2026

Out-of-Bounds Write in Google Brotli Decoder

70RIESGO

GitHub PoC

CVE-2026-54523 Kyverno cross-namespace resource generation PoC and exploit

CVE-2026-54523CRITICAL31 oct 2026

Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

48RIESGO

GitHub PoC

Check an Ubuntu host for CVE-2026-98432 and, after you confirm, apply the interim Red Hat RHSB-2026-016 mitigation. Ubuntu 20.04 to 26.10.

CVE-2026-98432CRITICAL31 oct 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

VulnCheck XDB

info-leak

CVE-2026-101767CRITICAL31 oct 2026

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported

48RIESGO

GitHub PoC

Detector and local lab for CVE-2026-98432 (IPv4 TCP UAF in inet_opt/ireq_opt): static analysis, kprobes, the tcp2kaslr trigger vector, and remote-risk evidence. Not an exploit; no RCE.

CVE-2026-98432CRITICAL31 oct 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

GitHub PoC★ 16

macOS revisiond local privilege escalation to root (CVE-2026-112487)

CVE-2026-112487HIGH31 oct 2026

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequo

41RIESGO

GitHub PoC

Temporary mitigation for CVE-2026-98432 on AlmaLinux 8/9/10 and Ubuntu. Not a kernel fix.

CVE-2026-98432CRITICAL31 oct 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

GitHub PoC

Grafana alerting contact point authorization bypass via schema downgrade (CVSS 7.7) — containerized lab, full PoC, plus 2 unreported findings reproducible on 13.2.5

CVE-2026-100105HIGH31 oct 2026

Alerting contact point authorization bypass via schema downgrade

41RIESGO

GitHub PoC★ 5

CVE-2026-111585 — TeamViewer Remote-Control Screen Decompression Integer Overflow → Heap Buffer Overflow (PoC, fixed in 15.83, CVSS 8.8). Containerized lab + one-command repro with vulnerable/fixed differential evidence.

CVE-2026-111585HIGH31 oct 2026

Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow

41RIESGO

GitHub PoC

CVE-2026-119712 (CVSS 8.5 High) — PipesHub < 0.10.0 SSRF via image URLs in indexed documents (CWE-918). Verified PoC.

CVE-2026-119712MEDIUM31 oct 2026

PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents

33RIESGO

GitHub PoC

⛩️☀️ Zero-cost Cloudflare Edge Defense (CVE-2026-109618) + HTTP x402 AI Crawler Monetization. Earn 20% USDC. Landauer Thermodynamics on Base L2.

CVE-2026-109618CRITICALbajo ataque31 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

PHP 7.4.33 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libraries. Documented builds, source and patch checksums, focused regression tests, Trivy reports, and non-root defaults. Linux amd64. UNVERIFIED development preview; independent mysqlnd review remains incomplete.

CVE-2026-109618CRITICALbajo ataque31 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

Analisa e corrige as vulnerabilidades php2shell do PHP (CVE-2026-109618 e CVE-2026-109619) no Ubuntu

CVE-2026-109618CRITICALbajo ataque31 oct 2026

RCE via OOM corruption

100RIESGO

GitHub PoC

CVE-2026-63686 demo

CVE-2026-63686HIGH31 oct 2026

Apache HTTP Server: mod_xml2enc crash on charset conversion failure

41RIESGO

GitHub PoC★ 4

Detect CVE-2026-98432 on the running Linux kernel and apply the official fixed kernel only on verified distributions (Debian 12/13, Amazon Linux 2/2023). Ubuntu/RHEL detect-only; Rocky/Alma/Oracle/Fedora/SUSE/Arch/Alpine identified but not auto-fixed.

CVE-2026-98432CRITICAL31 oct 2026

ipv4: free inet_opt and ireq_opt after an RCU grace period

48RIESGO

GitHub PoC★ 2

PoC for CVE-2026-116366 — ClickHouse Server unauthenticated RCE (brotli v1.2.0 decoder out-of-bounds write): differential detector, weaponized DoS, containerized vulnerable-vs-fixed lab, root-cause analysis

CVE-2026-116366CRITICAL31 oct 2026

Unauthenticated RCE vulnerability against ClickHouse Server

63RIESGO

GitHub PoC★ 4

woshigenm/CVE-2026-98937

CVE-2026-98937—31 oct 2026

perf/core: Check kernel access when kernel callchains are requested

23RIESGO

GitHub PoC★ 1

CVE-2026-120218: bilingual TypeMill stored XSS analysis and safe SVG/XSLT PoC

CVE-2026-120218MEDIUM31 oct 2026

Typemill SvgSanitizer.php saveImage cross site scripting

33RIESGO

GitHub PoC★ 1

CVE-2026-103039: Gravity Forms <= 3.1.2 PHP object injection to RCE. PoC by NOXCRYPT (noxcrypt-x). gen_payload.php is not included.

CVE-2026-103039CRITICAL31 oct 2026

Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

48RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.