Vulnerabilities with public exploits

• horizon datasys reboot restore standard Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption CVE-2026-120232 Public exploit 9.3 CriticalNovember 1, 2026
• gitea Gitea archived repository release, milestone and label modification CVE-2026-116296 Public exploit No scoreNovember 1, 2026
• typemill Typemill SvgSanitizer.php saveImage cross site scripting CVE-2026-120218 Public exploit 5.1 MediumNovember 1, 2026
• google android In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer... CVE-2026-58882 Public exploitFix available No scoreNovember 1, 2026
• wedevs project manager – ai powered project management, task management, kanban board & time tracker Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection CVE-2026-116512 Public exploit 9.8 CriticalOctober 31, 2026
• libriscv libriscv: Out of bounds read vuln in the ELF parser (Denial of service) CVE-2026-62958 Public exploit 7.9 HighOctober 30, 2026
• pgadmin.org pgadmin 4 pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials CVE-2026-116244 Public exploit 7.1 HighOctober 30, 2026
• canonical lxd Improper certificate validation in the HTTPS listener in LXD CVE-2026-112816 Public exploit 10.0 CriticalOctober 30, 2026
• suse rancher Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster CVE-2026-104623 Public exploit 6.3 MediumOctober 30, 2026
• pipeshub-ai PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents CVE-2026-119712 Public exploit 5.3 MediumOctober 30, 2026
• tenda w18e CVE-2026-118238 CVE-2026-118238 Public exploit 7.2 HighOctober 30, 2026
• clickhouse, clickhouse cloud +1 more Unauthenticated RCE vulnerability against ClickHouse Server CVE-2026-116366 Public exploit 9.5 CriticalOctober 30, 2026
• gravity forms forms Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field CVE-2026-103039 Public exploit 9.8 CriticalOctober 30, 2026
• No product listed An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of... CVE-2026-117184 Public exploit No scoreOctober 30, 2026
• No product listed A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows... CVE-2026-117183 Public exploit 7.5 HighOctober 30, 2026
• No product listed An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component... CVE-2026-117182 Public exploit No scoreOctober 30, 2026
• delinea privilege manager Delinea Privilege Manager agent unauthenticated remote code execution vulnerability CVE-2026-92744 Public exploit 8.7 HighOctober 29, 2026
• digitalbazaar forge Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption CVE-2026-118776 Public exploit 3.7 LowOctober 29, 2026
• progress software ws ftp server Improper Authentication in Progress WS_FTP Server CVE-2026-84295 Public exploit 10.0 CriticalOctober 29, 2026
• ibm langflow oss, langflow +1 more Langflow OSS is affected by multiple vulnerabilities CVE-2026-93680 Public exploit 9.8 CriticalOctober 29, 2026
• ibm langflow oss, langflow +1 more Langflow OSS is affected by multiple vulnerabilities CVE-2026-107326 Public exploit 8.8 HighOctober 29, 2026
• ibm langflow oss, langflow +1 more Langflow OSS is affected by multiple vulnerabilities CVE-2026-107327 Public exploit 9.9 CriticalOctober 29, 2026
• ibm langflow oss, langflow +1 more Langflow OSS is affected by multiple vulnerabilities CVE-2026-107328 Public exploit 9.9 CriticalOctober 29, 2026
• ibm langflow oss, langflow +1 more Langflow OSS is affected by multiple vulnerabilities CVE-2026-107329 Public exploit 9.9 CriticalOctober 29, 2026
• ibm langflow oss, langflow +1 more Langflow OSS is affected by multiple vulnerabilities CVE-2026-110200 Public exploit 6.5 MediumOctober 29, 2026
• sindresorhus open, anomalyco opencode, mcpjam inspector +2 more open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows CVE-2026-119025 Public exploit 7.7 HighOctober 29, 2026
• buddypress WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability CVE-2026-115965 Public exploit 8.5 HighOctober 29, 2026
• apache software foundation camel Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name CVE-2026-71569 Public exploit 4.8 MediumOctober 29, 2026
• grafana enterprise, oss +1 more Alerting contact point authorization bypass via schema downgrade CVE-2026-100105 Public exploit 7.7 HighOctober 28, 2026
• juniper networks session smart router Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed CVE-2026-103409 Public exploit 9.8 CriticalOctober 28, 2026
• topluyo app Topluyo Desktop for Linux has an OS Command Injection issue CVE-2026-115904 Public exploit 9.6 CriticalOctober 28, 2026
• axis communications ab camera station pro, camera station 5 +1 more Database backups are vulnerable to offline attacks. Backups created using a version prior to the... CVE-2026-63286 Public exploit 7.1 HighOctober 28, 2026
• melograno the innovative form builder – ivyforms The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload CVE-2026-109384 Public exploit 8.8 HighOctober 28, 2026
• unknown checkout files upload for woocommerce Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload CVE-2026-103688 Public exploit 9.8 CriticalOctober 28, 2026
• mlflow MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules CVE-2026-116692 Public exploitFix available 9.8 CriticalOctober 27, 2026
• the epics community epics base Integer overflow or wraparound in EPICS Base CVE-2026-114595 Public exploit 9.3 CriticalOctober 27, 2026
• teamviewer full client, portable, remote control +2 more Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow CVE-2026-111585 Public exploit 8.8 HighOctober 27, 2026
• github.com/wailsapp/wails/v2 Go Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins CVE-2026-34157 Public exploitFix available 7.6 HighOctober 27, 2026
• opnsense core REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin CVE-2026-117532 Public exploit 9.3 CriticalOctober 27, 2026
• apple macos, safari, visionos +1 more +3 more An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in... CVE-2026-112621 Public exploit No scoreOctober 26, 2026
• apple macos, tvos, ios and ipados +2 more An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in... CVE-2026-112705 Public exploit No scoreOctober 26, 2026
• apple ipados, macos, ios and ipados +1 more +3 more A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS... CVE-2026-112688 Public exploit 8.8 HighOctober 26, 2026
• apple macos, ios and ipados +1 more An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in... CVE-2026-112611 Public exploit No scoreOctober 26, 2026
• apple macos A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden... CVE-2026-112487 Public exploit 7.8 HighOctober 26, 2026
• apple ipados, tvos, visionos +3 more +5 more A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2... CVE-2026-112706 Public exploit 5.5 MediumOctober 26, 2026
• hashicorp tooling Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules CVE-2026-110720 Public exploit 9.9 CriticalOctober 26, 2026
• bkwld decoy BKWLD Decoy Authorization Policy Policy.php privileges management CVE-2026-116471 Public exploit 5.3 MediumOctober 26, 2026
• zip-rs zip2 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE CVE-2026-115905 Public exploitFix available 10.0 CriticalOctober 26, 2026
• 2k games sid meier's civilization vi, 2k sid meiers civilization vi +1 more 2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion CVE-2026-116370 Public exploit 5.3 MediumOctober 26, 2026
• apache software foundation camel Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity… CVE-2026-90885 Public exploit 7.5 HighOctober 26, 2026
• Show olderLoading…