Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.402exploits catalogados
39.049CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.184Exploit-DB 24.485GitHub PoC 16.124VulnCheck XDB 9617Nuclei 4473Metasploit 3519✓ solo verificadosrecientespopularesriesgo
15.955 exploits
GitHub PoC
Telegram CVE-2026-107181
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
41RIESGO
abrir ↗GitHub PoC
AppleFDEKeyStore poc
A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27. A local atta
48RIESGO
abrir ↗GitHub PoC★ 1
荣耀 90 GT (MAG-AN00) 提权尝试全记录：CVE-2026-64560 移植、堆喷射原语穷举与漏洞判定方法论
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RIESGO
abrir ↗GitHub PoC★ 2
Write-up for CVE-2026-88776
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
41RIESGO
abrir ↗GitHub PoC★ 2
ILIAS ≤ 9.21 / 10.9 / 11.2 — Unauthenticated PHP Object Injection (RCE)
ILIAS PHP Object Injection via Shibboleth Logout
48RIESGO
abrir ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
48RIESGO
abrir ↗GitHub PoC
Atlassian Arbitrary File Read
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RIESGO
abrir ↗GitHub PoC
ApexBreach/CVE-2026-107406-Poc
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
48RIESGO
abrir ↗GitHub PoC
Atlassian Data Center Multiple Products - Arbitrary File Access (Path Traversal)
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-21589 — Atlassian DC pre-auth arbitrary file read (CVSS 4.0 9.3). PoCbit PoC: atlassian-plugins-webresource ..:: traversal on /download/resources/ for Jira, Confluence, Bitbucket. check + exploit (WEB-INF/web.xml, crowd.properties). Batch JSONL, hits.txt. Not RCE. https://pocbit.org/pocs/cve-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RIESGO
abrir ↗GitHub PoC★ 1
Defensive security checker for Citrix NetScaler ADC & Gateway — CVE-2026-88771 through CVE-2026-88778
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RIESGO
abrir ↗GitHub PoC
PoC for keycloak 1.26 vulnerability
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RIESGO
abrir ↗GitHub PoC
CVE-2026-91940: arbitrary file write in crawl4ai <=0.9.2 via the untrusted-config gate (PDFContentScrapingStrategy image_save_dir). Analysis, reproduction harness and verified 0.9.2 vs 0.9.3 boundary.
crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy
41RIESGO
abrir ↗GitHub PoC
hardeep-sudo/Keycloak-CVE-2026-18963-Exploit
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RIESGO
abrir ↗GitHub PoC
Laboratory proof of concept and research notes for CVE-2026-67279 on MikroTik RouterOS 6.42.
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
63RIESGO
abrir ↗GitHub PoC
a challenge for a CVE-2026-49881
In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the
41RIESGO
abrir ↗GitHub PoC
theendofabbys/CVE-2026-61424
Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2
48RIESGO
abrir ↗GitHub PoC
CVE-2026-21589 is a critical (CVSS 9.3) arbitrary file access vulnerability affecting all versions of eight Atlassian Data Center products, including Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, Fisheye, and Jira Service Management.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RIESGO
abrir ↗GitHub PoC
CVE-2026-105192 is a critical (CVSS 9.8) vulnerability in LMCache, an open-source distributed key-value cache for LLM inference engines like vLLM.
LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization
48RIESGO
abrir ↗GitHub PoC
Detection PoC for CVE-2026-5430 — unauthenticated JWT algorithm bypass (CVSS 10.0) affecting WSO2 API Manager 4.1.0–4.6.0. Read-only assessment tool with patch confirmation and WAF detection. Authorized use only.
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
78RIESGO
abrir ↗GitHub PoC
Уязвимая лаборатория WSO2 API Manager 4.5.0 в Docker, сканер и эксплойт для CVE-2026-5430 (обход аутентификации через поддельный HS256 JWT)
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
78RIESGO
abrir ↗GitHub PoC
CVE-2026-92555 Exploit
Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel
48RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-105844 — Payload CMS @payloadcms/plugin-import-export <3.88.0 unauth prototype pollution (CWE-1321, CVSS 4.0 9.3). PoCbit PoC: POST /api/exports/export-preview fields __proto__.overrideAccess → ACL bypass / data leak. check/exploit/mass. Fix 3.88.0+. https://pocbit.org/pocs/cve-2026-105844
Payload: Prototype pollution in Payload Import Export plugin
48RIESGO
abrir ↗GitHub PoC★ 1
Privilege Escalation vulnerability
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
41RIESGO
abrir ↗GitHub PoC★ 2
Smarty is vulnerable to code injection through template inheritance. Crafted assigned data can inject a forged SmartyNocache marker into regenerated PHP cache files, potentially allowing attackers to execute arbitrary PHP code. The issue affects Smarty 4.5.7 and earlier, and 5.8.4 and earlier.
Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
48RIESGO
abrir ↗GitHub PoC
cve-2026-87902 lab
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RIESGO
abrir ↗GitHub PoC★ 4
Independent PoC and reproducible lab for CVE-2026-97332 — User Private Files < 2.2.0 unauthenticated private file disclosure on WordPress Multisite.
User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
33RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-102782 — OrdaSoft Joomla Simple Membership <7.4.0 unauth SQLi (CWE-89, CVSS 4.0 9.3). PoCbit PoC: checkLoginPass + login param extractvalue error leak. check/exploit/mass, hits.txt & exploited.txt. Fix 7.4.0+. https://pocbit.org/pocs/cve-2026-102782
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0
48RIESGO
abrir ↗GitHub PoC
Benign, offline reproduction of CVE-2026-93355 — LiteLLM unverified-email JWT account takeover (runs LiteLLM's real code)
LiteLLM Weak JWT Authentication via Email-Based User Lookup
41RIESGO
abrir ↗GitHub PoC
Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce
Undisclosed RCE in Zammad v6.3 and higher
71RIESGO
abrir ↗página 1 / 532siguiente →
Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.