Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.900exploits catalogados

40.763CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

87.900 exploits

GitHub PoC

webserverdude/f5_CVE-2026-21589_mitigation

CVE-2026-21589CRITICALbajo ataque10 oct 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RIESGO

abrir ↗

GitHub PoC★ 1

Bricksforge <= 3.1.8.9 Unauthenticated Arbitrary File Upload

CVE-2026-85097CRITICAL10 oct 2026

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

63RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-85097CRITICAL10 oct 2026

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

63RIESGO

abrir ↗

GitHub PoC

Zombify <= 1.7.7 Unauthenticated Arbitrary File Upload

CVE-2026-94503CRITICAL10 oct 2026

WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

48RIESGO

abrir ↗

GitHub PoC

FortiMail CVE-2026-104286 (CVSS 9.8) 점검·대응 도구 (버전 확인, IoC 점검, 완화·패치 체크리스트)

CVE-2026-104286CRITICALbajo ataque10 oct 2026

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.

78RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2020-1938CRITICALbajo ataque10 oct 2026

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RIESGO

abrir ↗

GitHub PoC

KyrieKlay/CVE-2026-37107

CVE-2026-37107CRITICAL10 oct 2026

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php com

48RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2018-14667CRITICALbajo ataque10 oct 2026

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-23744CRITICAL10 oct 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

GitHub PoC

CVE-2026-102428 PoC: OrdaSoft Joomla OS CCK (com_os_cck) <=8.3.15 unauth SQLi — order_field/order_direction ORDER BY injection on public listings. Check + mass exploit, POCBIT-102428-OK marker, CVSS 9.3. https://pocbit.org/pocs/cve-2026-102428

CVE-2026-102428CRITICAL10 oct 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16

48RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-85706CRITICALbajo ataque10 oct 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

100RIESGO

abrir ↗

GitHub PoC★ 12

Reproducible macOS automountd research and lab PoCs for CVE-2026-84568 and CVE-2026-84570: fstype path traversal, NFS payload delivery, Gatekeeper behavior, and root code execution.

CVE-2026-84568HIGH10 oct 2026

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS S

41RIESGO

abrir ↗

GitHub PoC

Docker lab to test proof of concepts for CVE-2024-4367. A high-severity type confusion and remote code execution flaw in Firefox PDF.js font handling due to missing type checks (affecting Firefox < 126, Firefox ESR < 115.11, and PDF.js < 4.2.67).

CVE-2024-4367MEDIUM10 oct 2026

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RIESGO

abrir ↗

GitHub PoC

Synthetic-data billing portal pinned to next@14.2.24 (CVE-2025-29927) — test customer for oopsie

CVE-2025-29927CRITICAL10 oct 2026

Authorization Bypass in Next.js Middleware

85RIESGO

abrir ↗

GitHub PoC

**CVE-2026-69414** is an elevation of privilege vulnerability in the **Microsoft Malware Protection Engine** (part of Windows Defender / Microsoft Defender Antivirus), publicly referred to as **"RoguePlanet"**. It represents a **patch bypass** of the original vulnerability **CVE-2026-50656**.

CVE-2026-69414HIGH10 oct 2026

Microsoft Defender Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC★ 1

AppleFDEKeyStore poc

CVE-2026-84520CRITICAL10 oct 2026

A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27. A local atta

48RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-94503CRITICAL10 oct 2026

WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

48RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-106445 — Handlebars 4.0.0–4.7.9 RCE via Function.prototype.constructor bypass (GHSA-p8wg-vrv2-v86f). PoCbit PoC + Docker lab (4.7.9), check/exploit HTTP client, GHSA template chain. Fixed 4.7.10. https://pocbit.org/pocs/cve-2026-106445

CVE-2026-106445CRITICAL10 oct 2026

Handlebars: JavaScript Injection via Own Property Check Bypass

48RIESGO

abrir ↗

GitHub PoC★ 1

PoC: OrdaSoft Joomla OS CCK (com_os_cck) 8.3.15 unauth SQLi —mass+exploit+dork

CVE-2026-102428CRITICAL10 oct 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16

48RIESGO

abrir ↗

GitHub PoC

Technical analysis of Log4Shell (CVE-2021-44228) for CS50 Cybersecurity.

CVE-2021-44228CRITICALbajo ataqueransomware10 oct 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC★ 7

CVE-2026-107806 — nginx-ui 2.3.8–2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET /api/backup, tamper app.ini, POST /api/restore, POST /api/nginx/test. check/exploit, batch url|JWT. Fixed 2.5.0. https://pocbit.org/pocs/cve-2026-107806

CVE-2026-107806CRITICAL10 oct 2026

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

48RIESGO

abrir ↗

GitHub PoC

AmalJafarzade/CVE-2026-104586

CVE-2026-104586CRITICAL09 oct 2026

AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.

48RIESGO

abrir ↗

GitHub PoC

AmalJafarzade/CVE-2026-104585

CVE-2026-104585CRITICAL09 oct 2026

Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic An

48RIESGO

abrir ↗

GitHub PoC

AmalJafarzade/CVE-2026-104587

CVE-2026-104587MEDIUM09 oct 2026

blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses te

33RIESGO

abrir ↗

GitHub PoC

Penetration test of Apache Tomcat — Ghostcat, CVE-2017-12615 and Struts2/OGNL exploitation with MITRE ATT&CK mapping

CVE-2017-12615HIGHbajo ataqueransomware09 oct 2026

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati

100RIESGO

abrir ↗

GitHub PoC★ 2

ILIAS ≤ 9.21 / 10.9 / 11.2 — Unauthenticated PHP Object Injection (RCE)

CVE-2026-80428CRITICAL09 oct 2026

ILIAS PHP Object Injection via Shibboleth Logout

48RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-22965CRITICALbajo ataque09 oct 2026

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

abrir ↗

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-107406CRITICAL09 oct 2026

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

48RIESGO

abrir ↗

GitHub PoC

ApexBreach/CVE-2026-107406-Poc

CVE-2026-107406CRITICAL09 oct 2026

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

48RIESGO

abrir ↗

GitHub PoC★ 1

Atlassian Arbitrary File Read

CVE-2026-21589CRITICALbajo ataque09 oct 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.