Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.899exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.899 exploits
VulnCheck XDB
initial-access
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
60RIESGO
abrir ↗VulnCheck XDB
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RIESGO
abrir ↗VulnCheck XDB
initial-access
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗GitHub PoC★ 1
Unauthenticated remote code execution in Ivanti Connect Secure (CWE-290, CVSS 8.6)
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb
100RIESGO
abrir ↗GitHub PoC★ 8
CVE-2026-76268 PoC: Splunk Enterprise SHC Patroni REST unauth RCE — PATCH /config archive_command + POST /restart. Check + mass exploit, OOB POCBIT-76268-OK, CVSS 9.8. https://pocbit.org/pocs/cve-2026-76268
Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
63RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE
Integer Overflow or Wraparound in GitLab
100RIESGO
abrir ↗GitHub PoC
Análisis de vulnerabilidades y el desarrollo de exploits
FreeFloat FTP Server NOOP Command buffer overflow
38RIESGO
abrir ↗GitHub PoC★ 5
CVE-2026-85097 – Bricksforge WordPress Plugin Unauth File Upload to RCE Toolkit (CVSS 10.0) | Red/Blue Team suite for Bricksforge Pro Forms < 3.1.8.9. 2 tools: Full Exploit (polyglot upload, web shell, mass scan, OPSEC, SQLite/JSON output) + SafeChecker (version detect, non-intrusive audit). Ethical & educational use only.
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
63RIESGO
abrir ↗Metasploit400
GitLab CI/CD RegExp Integer Overflow Remote Code Execution
Integer Overflow or Wraparound in GitLab
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RIESGO
abrir ↗VulnCheck XDB
local
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon A
71RIESGO
abrir ↗GitHub PoC
Independent reconstruction, lab validation, and PoC for CVE-2026-9198, the Langflow unauthenticated RCE (fixed in 1.10.1)
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RIESGO
abrir ↗GitHub PoC
CVE-2026-91136 Divi Plus <= 2.4.0 unauthenticated arbitrary file read (mass scanner + exploit)
Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
56RIESGO
abrir ↗GitHub PoC★ 1
Proof of concept and isolated Docker lab for CVE-2026-103889, an unauthenticated RCE vulnerability in Expivi 3D Product Configurator for WooCommerce ≤ 2.16.2.
3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
48RIESGO
abrir ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern
48RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-84411 root cause notes and a non-destructive probe (RouterOS before 7.24)
MikroTik RouterOS Integer Underflow
48RIESGO
abrir ↗GitHub PoC
CVE-2026-102255 - Draft or TODO
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern
48RIESGO
abrir ↗GitHub PoC
AraxyAI/CVE-2026-92956__vm2__test__20261012
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
48RIESGO
abrir ↗GitHub PoC★ 8
CVE-2026-91737 Chrome renderer RCE PoC (PDFium)
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside
41RIESGO
abrir ↗GitHub PoC★ 3
0xad3m/CVE-2026-13078-POC
Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.