Skip to contentVulnerabilities with public exploits
- abacre restaurant point of saleAbacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of...CVE-2025-65320Public exploit7.5 High
- avtech dgm1104 firmwareAVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an...CVE-2025-57199Public exploit8.8 High
- smallbasicBuffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit...CVE-2025-50361Public exploit5.1 Medium
- dannyvankooten pepperA heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit...CVE-2025-50360Public exploit8.4 High
- janeczku calibre-webCalibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User CreationCVE-2025-65858Public exploit3.5 Low
- dlink r15 firmwareA vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the...CVE-2025-60854Public exploit9.8 Critical
- anisha online medicine guidecode-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the...CVE-2025-60736Public exploit9.8 Critical
- getgrav gravGrav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actionsCVE-2025-66301Public exploitFix available8.6 High
- getgrav gravGrav is vulnerable to RCE via SSTI through Twig Sandbox BypassCVE-2025-66294Public exploitFix available8.7 High
- avast antivirusInteger Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalationCVE-2025-3500Public exploit9.0 Critical
- arm 5th gen gpu architecture kernel driver, valhall gpu kernel driver +1 moreMali GPU Kernel Driver allows improper GPU processing operationsCVE-2025-8045Public exploitFix available4.0 Medium
- shirt-pocket superduper\!An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the...CVE-2025-61229Public exploit7.8 High
- shirt-pocket superduper\!An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute...CVE-2025-61228Public exploit7.8 High
- shirt-pocket superduper\!Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows...CVE-2025-57489Public exploit8.1 High
- google androidIn multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due...CVE-2025-48583Public exploitFix available7.8 High
- deco-cx appsdeco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgeryCVE-2025-13796Public exploit5.3 Medium
- orangehrmOrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter InjectionCVE-2025-66224Public exploit9.0 Critical
- fonttoolsfontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLibCVE-2025-66034Public exploitFix available6.3 Medium
- validator project validatorValidator is Vulnerable to Incomplete Filtering of One or More Instances of Special ElementsCVE-2025-12758Public exploitFix available8.7 High
- anyscale rayRay is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding AttackCVE-2025-62593In KEVPublic exploitFix availableEPSS 60.2%9.4 Critical
- apache druidApache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.CVE-2025-59390Public exploitFix available9.8 Critical
- edly tutorOverhang Tutor Discloses Sensitive Information due to Improper Cache-ControlCVE-2025-65681Public exploit3.3 Low
- classroomioStored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated...CVE-2025-65676Public exploit5.4 Medium
- classroomioStored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated...CVE-2025-65675Public exploit5.4 Medium
- classroomioInsecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and...CVE-2025-65672Public exploit7.5 High
- classroomioAn Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access...CVE-2025-65670Public exploit4.3 Medium
- classroomioAn issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from...CVE-2025-65669Public exploit9.1 Critical
- monnit imonnitAn issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary user accounts.CVE-2025-50433Public exploit9.8 Critical
- soportecibeles ai feedsAI Feeds <= 1.0.11 - Unauthenticated Arbitrary File UploadCVE-2025-13597Public exploit9.8 Critical
- soportecibeles cibeles aiCIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File UploadCVE-2025-13595Public exploit9.8 Critical
- geoserverGeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap featureCVE-2025-58360In KEVPublic exploitFix availableEPSS 61.2%8.2 High
- liquidthemes ai engine for wordpress: chatgpt, gpt content generatorAI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File ReadCVE-2025-13380Public exploit6.5 Medium
- sneeit frameworkSneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callbackCVE-2025-6389Public exploitEPSS 76.2%9.8 Critical
- ruckuswireless ruckus unleashedA reflected Cross site scripting (XSS) vulnerability in Ruckus Unleashed 200.13.6.1.319 via the...CVE-2025-63735Public exploit6.1 Medium
- syrotech sy-gpon-1110-wdont firmwareAn issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers...CVE-2025-63729Public exploit9.0 Critical
- libpngLIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`CVE-2025-65018Public exploitFix available7.1 High
- libpngLIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplicationCVE-2025-64720Public exploitFix available7.1 High
- cinnamon kotaemonAn issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs...CVE-2025-63914Public exploit6.5 Medium
- alinto sogo, debian linux +1 morealinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.CVE-2025-63498Public exploitFix available6.1 Medium
- amd kria™ som, zynq™ ultrascale+™ mpsocs, zynq™ ultrascale+™ rfsocs +2 moreThe security state of the calling processor into Arm® Trusted Firmware (TF-A) is not used and...CVE-2025-48507Public exploit8.6 High
- oc3dots s2b ai assistant – chatbot, ai agents, chatgpt api, image generatorS2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator <= 1.7.8 - Authenticated (Editor+) Arbitrary File UploadCVE-2025-12973Public exploit7.2 High
- grafana, grafana enterprise +1 moreIncorrect privilege assignmentCVE-2025-41115Public exploitFix availableEPSS 17.5%10.0 Critical
- appsbd vitepos – point of sale (pos) for woocommerceVitepos – Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code ExecutionCVE-2025-13156Public exploit8.8 High
- zhengdon 简数采集器简数采集器 <= 2.6.3 - Authenticated (Admin+) Arbitrary File ReadCVE-2025-11973Public exploit4.9 Medium
- beycanpress cryptocurrency (token), launchpad (presale), ico & ido, airdrop by tokenicoCryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authentication to Unauthenticated Presale UpdateCVE-2025-11771Public exploit5.3 Medium
- flothemesplugins flo forms – easy drag & drop form builderFlo Forms – Easy Drag & Drop Form Builder <= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG UploadCVE-2025-13159Public exploit7.1 High
- iqonicdesign wpbookitWPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site ScriptingCVE-2025-12135Public exploit7.2 High
- google osv-scalibrDenial of Service in OSV-SCALIBRCVE-2025-13425Public exploitFix available1.9 Low
- snipeitapp snipe-itSnipe-IT has Cross-site Scripting vulnerability in CSV import workflowCVE-2025-64027Public exploitDisputed6.1 Medium
- thinkphpThe read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24...CVE-2025-63888Public exploit9.8 Critical
- Show moreLoading…