Skip to contentVulnerabilities with public exploits
- kraft plugins demo importer plusDemo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege EscalationCVE-2025-14364Public exploit8.8 High
- bulwarkmail webmailRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS)...CVE-2025-68461In KEVPublic exploitFix availableEPSS 27.4%7.2 High
- opensourcepos open source point of sale, opensourcepos +1 moreopensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator CreationCVE-2025-68434Public exploit8.8 High
- opensourcepos open source point of sale, opensourcepos +1 moreopensourcepos has a Cross-site Scripting vulnerabilityCVE-2025-68147Public exploit8.1 High
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.phpCVE-2025-68400Public exploit9.3 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to RCE with database restore functionalityCVE-2025-68109Public exploit9.1 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored XSS in Group Role Name Leading to Admin Session HijackingCVE-2025-67876Public exploit9.3 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session HijackingCVE-2025-67875Public exploit8.5 High
- apple ipados, macos, safari +6 more +8 moreA use-after-free issue was addressed with improved memory management. This issue is fixed in...CVE-2025-43529In KEVPublic exploitFix availableEPSS 25.7%8.8 High
- apple ipados, macos, safari +3 more +5 moreA type confusion issue was addressed with improved state handling. This issue is fixed in Safari...CVE-2025-43541Public exploitFix availableEPSS 34.1%4.3 Medium
- world wide broadcast network avideoAVideo < 20.1 System Path Disclosure via Public APICVE-2025-34442Public exploit6.9 Medium
- world wide broadcast network avideoAVideo < 20.1 User Information Disclosure via Public APICVE-2025-34441Public exploit6.9 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM has unauthenticated RCE in its Install WizardCVE-2025-62521Public exploit10.0 Critical
- cisco asyncos, secure email, secure email and web manager +1 more +3 moreCisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution VulnerabilityCVE-2025-20393In KEVPublic exploitEPSS 32.4%10.0 Critical
- arcadia technology, llc crafty controllerImproper Neutralization of Special Elements Used in a Template Engine in Crafty ControllerCVE-2025-14700Public exploit9.9 Critical
- netun helpflash iot firmwareThe OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware...CVE-2025-65855Public exploit6.6 Medium
- google chromeUse after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to...CVE-2025-14765Public exploitFix available8.8 High
- claris filemaker serverApache Commons Text versions prior to 1.10.0 included interpolation features that could be abused...CVE-2025-46295Public exploit9.8 Critical
- nvidia isaac labNVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this...CVE-2025-33210Public exploit9.0 Critical
- error311 fileriseFileRise vulnerable to Cross-Site Scripting (XSS) in SVG File HandlingCVE-2025-68116Public exploit8.9 High
- hewlett packard enterprise (hpe) hpe oneview, oneview +1 moreA remote code execution issue exists in HPE OneView.CVE-2025-37164In KEVPublic exploitEPSS 90.2%10.0 Critical
- themefic hydra bookingWordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerabilityCVE-2025-68055Public exploit8.5 High
- dbitnet dbit n300 t1 pro firmwareAn issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version...CVE-2025-65427Public exploit6.5 Medium
- canarymail canary mailWhen using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents...CVE-2025-65318Public exploit9.1 Critical
- ays-pro fox lms – wordpress lms pluginFox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'CVE-2025-14156Public exploit9.8 Critical
- newgensoft omnidocsAn unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs...CVE-2025-65742Public exploit8.2 High
- mjmlMJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827CVE-2025-67898Public exploitFix available4.5 Medium
- d-link dir-860lb1, dir-868lb1, dlink dir-860l b1 firmware +1 more +3 moreD-Link DIR-860LB1/DIR-868LB1 DHCP command injectionCVE-2025-14659Public exploit8.7 High
- jayarsiech jay login & registerJAY Login & Register <= 2.4.01 - Authentication Bypass via CookieCVE-2025-14440Public exploit9.8 Critical
- gladinet centrestack, centrestack and triofox, triofox +2 moreGladinet CentreStack and TrioFox Hard Coded AES KeysCVE-2025-14611In KEVPublic exploitEPSS 54.5%7.1 High
- apple ipados, macos, tvos +5 more +7 moreA memory corruption issue was addressed with improved memory handling. This issue is fixed in...CVE-2025-43520In KEVPublic exploit5.5 Medium
- pcman ftp serverPCMan FTP Server 2.0 Remote Buffer Overflow via 'pwd' CommandCVE-2024-58299Public exploit9.3 Critical
- google chrome, chromium, apple ipados +7 more +9 moreOut of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a...CVE-2025-14174In KEVPublic exploitFix availableEPSS 43.3%8.8 High
- frappe learning, lms +1 moreFrappe authenticated users can execute XSS through form description fieldsCVE-2025-67730Public exploit5.1 Medium
- parse-community parse-serverParse Server GitHub CI workflow vulnerable to RCE through Improper Privilege ManagementCVE-2025-67727Public exploitFix available6.9 Medium
- spacex starlink dishSpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow...CVE-2025-67780Public exploitDisputed4.2 Medium
- vercel next.jsNext.js: null origin can bypass Server Actions CSRF checksCVE-2026-27978Public exploitFix available5.3 Medium
- vercel next.jsNext.js: Unauthenticated Remote Code Execution on windows-hosted serversCVE-2026-75604Public exploitFix available9.0 Critical
- elements xhibiter nft marketplaceXhibiter NFT Marketplace 1.10.2 SQL Injection via Collections EndpointCVE-2024-58290Public exploit9.3 Critical
- vexorian dizquetvdizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable PathCVE-2024-58286Public exploit9.3 Critical
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 moreDenial of Service Vulnerability in React Server ComponentsCVE-2025-55184Public exploitFix availableEPSS 64.4%7.5 High
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 moreSource Code Exposure Vulnerability in React Server ComponentsCVE-2025-55183Public exploitFix availableEPSS 61.9%5.3 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 moreRemote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)CVE-2025-13780Public exploitFix available9.1 Critical
- quic-goquic-go HTTP/3 QPACK Header Expansion DoSCVE-2025-64702Public exploitFix available5.3 Medium
- digitaldruid hoteldruidHotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php...CVE-2025-55816Public exploit6.1 Medium
- wbce cmsWBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] ParameterCVE-2025-65950Public exploit9.4 Critical
- imagemagickImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)CVE-2025-66628Public exploitFix available7.5 High
- gogsFile overwrite in file update API in GogsCVE-2025-8110In KEVPublic exploitEPSS 80.3%8.7 High
- hippooo hippoo mobile app for woocommerceHippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File ReadCVE-2025-13339Public exploit7.5 High
- langchain-ai langgraph, langchain langgraph-checkpoint-sqlite +1 moreLangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list methodCVE-2025-67644Public exploitFix available7.3 High
- Show moreLoading…