Skip to contentVulnerabilities with public exploits
- algernon project algernonAlgernon Cross-Site Scripting vulnerabilityCVE-2025-65754Public exploitFix available6.1 Medium
- jxlindia jxl 9 inch car android double din player firmwareAn issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0...CVE-2025-63895Public exploit7.5 High
- aliasrobotics cai, cybersecurity ai +1 moreCybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent toolCVE-2025-67511Public exploit9.7 Critical
- sangoma freepbx, flarum framework +1 moreFreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth HeaderCVE-2025-66039Public exploit9.3 Critical
- microsoft windows, windows 10 version 1809, windows 10 version 21h2 +18 more +20 moreWindows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityCVE-2025-62221In KEVPublic exploit7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +30 more +32 morePowerShell Remote Code Execution VulnerabilityCVE-2025-54100Public exploit7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +30 more +32 moreWindows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2025-62470Public exploit7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +17 more +19 moreWindows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityCVE-2025-62454Public exploit7.8 High
- fortinet fortios, fortiproxy, fortiswitchmanager +3 more +5 moreA improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0...CVE-2025-59718In KEVPublic exploitEPSS 68.1%9.1 Critical
- zauberzeug niceguiNiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File ReadingCVE-2025-66645Public exploitFix available7.5 High
- ronald huereca highlight and shareWordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerabilityCVE-2025-67586Public exploit4.7 Medium
- mozilla firefox, thunderbird +1 moreJIT miscompilation in the JavaScript Engine: JIT componentCVE-2025-14325Public exploitFix available7.3 High
- mozilla firefox, thunderbird +1 moreUse-after-free in the WebRTC: Signaling componentCVE-2025-14321Public exploitFix available9.8 Critical
- sublimetext sublime text 3Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could...CVE-2025-65741Public exploit9.8 Critical
- coohomA stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion...CVE-2025-65300Public exploit5.4 Medium
- wbce cmsWBCE CMS allows brute-force protection bypass using X-Forwarded-For headerCVE-2025-66204Public exploit6.3 Medium
- zitadelZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 LoginCVE-2025-67494Public exploitFix available9.3 Critical
- zauberzeug niceguiNiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG contentCVE-2025-66470Public exploitFix available6.1 Medium
- n8nn8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit HookCVE-2025-65964Public exploitFix available9.4 Critical
- oretnom23 banking system, sourcecodester online banking system +1 moreSourceCodester Online Banking System page cross site scriptingCVE-2025-14221Public exploit5.1 Medium
- azuriomClient-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user...CVE-2025-65271Public exploit8.8 High
- linux, siemens ruggedcom rst2428p +1 morefs/proc: fix uaf in proc_readdir_de()CVE-2025-40271Public exploitFix available7.8 High
- garidium g-ffl cockpitg-FFL Cockpit <= 1.7.1 - Improper Authorization to Unauthenticated Product DeletionCVE-2025-12720Public exploit5.3 Medium
- ajitdas flex qr code generatorFlex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File UploadCVE-2025-12673Public exploit9.8 Critical
- garidium g-ffl cockpitg-FFL Cockpit <= 1.7.1 - Missing Authorization to Unauthenticated Information ExposureCVE-2025-12721Public exploit5.3 Medium
- langflowLangflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCECVE-2025-34291In KEVPublic exploitFix availableEPSS 93.2%9.4 Critical
- apache http serverApache HTTP Server: Server Side Includes adds query string to #exec cmd=...CVE-2025-58098Public exploitFix available8.3 High
- breadbutter bread & butter: ai-powered lead intelligence, bread \& butter +1 moreBread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File UploadCVE-2025-12189Public exploit4.3 Medium
- omnipressteam omnipressOmnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site ScriptingCVE-2025-12163Public exploit6.4 Medium
- watchguard mobile vpn with ssl clientWatchGuard Mobile VPN with SSL Local Privilege Escalation via Update PackageCVE-2025-1910Public exploit6.3 Medium
- rtowebsites postgalleryPostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File UploadCVE-2025-13543Public exploit8.8 High
- ni labviewRelative Path Traversal Vulnerability in NI System Web ServerCVE-2025-12097Public exploit8.7 High
- auth0 node-jwsauth0/node-jws improper HMAC signature verification vulnerabilityCVE-2025-65945Public exploitFix available7.5 High
- difuse kalmiaKalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth...CVE-2025-65900Public exploit6.5 Medium
- difuse kalmiaKalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication...CVE-2025-65899Public exploit5.3 Medium
- turbopuffer logrusLogrus is vulnerable to DoS when using Entry.Writer()CVE-2025-65637Public exploitFix available7.5 High
- alexusmai laravel file manageralexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionalityCVE-2025-65346Public exploit9.1 Critical
- alinto sogoAlinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.CVE-2025-63499Public exploitFix available6.1 Medium
- edupluscampusAn Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student...CVE-2025-61148Public exploit6.5 Medium
- romm.app rommRomM Chained XSS and CSRF Vulnerabilities Enable Admin Account TakeoverCVE-2025-65027Public exploit7.6 High
- splunk, splunk cloud platform, enterprise +2 moreUnauthenticated Log Injection in Splunk EnterpriseCVE-2025-20384Public exploit5.3 Medium
- facebook react, meta react server components, react-server-dom-parcel +3 more +5 moreReact Server Components are Vulnerable to RCECVE-2025-55182In KEVPublic exploitFix availableEPSS 99.7%10.0 Critical
- optimizingmatters autoptimizeAutoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2025-13401Public exploit6.4 Medium
- listingthemes wp directory kitWP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account TakeoverCVE-2025-13390Public exploit10.0 Critical
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options UpdateCVE-2025-13342Public exploit9.8 Critical
- the webkitgtk team webkitgtk, red hat enterprise linux 6, enterprise linux 7 +15 more +17 moreWebkit: webkitgtk: remote user-assisted information disclosure via file drag-and-dropCVE-2025-13947Public exploitFix available7.4 High
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +2 moreAbrt: command-injection in abrt leading to local privilege escalationCVE-2025-12744Public exploitFix available8.8 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_formCVE-2025-13486Public exploitEPSS 68.6%9.8 Critical
- mxchat – ai chatbot & content generation for wordpressMxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information ExposureCVE-2025-12585Public exploit5.3 Medium
- alexusmai laravel file manageralexusmai laravel-file-manager is vulnerable to Directory TraversalCVE-2025-65345Public exploit6.5 Medium
- Show moreLoading…