Skip to contentVulnerabilities with public exploits
- icewhale casaosCasaOS <= 0.4.15 Unauthenticated File and Debug Data ExposureCVE-2025-34171Public exploit6.9 Medium
- wpmudev branda – white label & branding, free login page customizerBranda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account TakeoverCVE-2025-14998Public exploit9.8 Critical
- vatilon pa4 firmwareAn issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files...CVE-2025-67160Public exploit7.5 High
- vatilon pa4 firmwareVatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.CVE-2025-67159Public exploit7.5 High
- revotech i6032w-fhw firmwareAn authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 -...CVE-2025-67158Public exploit7.5 High
- vanderbilt redcapREDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between...CVE-2024-55374Public exploit5.3 Medium
- getsol eopkgeopkg vulnerable to package file list integrity bypassCVE-2026-21437Public exploit2.0 Low
- getsol eopkgeopkg has Path Traversal: '../filedir' vulnerabilityCVE-2026-21436Public exploit5.8 Medium
- signalk signal k server, signalk-server +1 moreSignal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)CVE-2025-66398Public exploitFix availableEPSS 19.9%9.7 Critical
- google androidIn key-based pairing, there is a possible ID due to a logic error in the code. This could lead to...CVE-2025-36911Public exploitFix available7.1 High
- infiniflow ragflowRAGFlow has Predictable Token Generation Leading to Authentication Bypass VulnerabilityCVE-2025-69286Public exploit8.9 High
- moxa nport 6100-g2/6200-g2 seriesThe NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026)...CVE-2025-2026Public exploit7.1 High
- fontforgeFontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution VulnerabilityCVE-2025-15276Public exploit7.8 High
- smub easy digital downloads – ecommerce payments and subscriptions made easyEasy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirectCVE-2025-14783Public exploit4.3 Medium
- facturascriptsFacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File UploadCVE-2025-69210Public exploitFix available1.2 Low
- serverlessserverless MCP Server vulnerable to command injection in list-projects toolCVE-2025-69256Public exploitFix available7.5 High
- rustfsRustFS has a gRPC Hardcoded Token Authentication BypassCVE-2025-68926Public exploitFix availableEPSS 32.1%9.8 Critical
- automattic crowdsignal formsWordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerabilityCVE-2025-69015Public exploit3.8 Low
- inmusicbrands engine dj desktopinMusic Brands Engine DJ 4.3.0 suffers from Insecure Permissions due to exposed HTTP service in...CVE-2025-66723Public exploit7.5 High
- zeroheightAn issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. A legacy user creation API...CVE-2025-65925Public exploit6.5 Medium
- mobile builder builderWordPress Mobile builder plugin <= 1.4.2 - Broken Authentication vulnerabilityCVE-2025-68860Public exploit9.8 Critical
- tp-link systems inc. tl-wr820n v2.8, tp-link tl-wr820n firmware +1 moreWeak Algorithm Support in SSH Server on TL-WR820NCVE-2025-14175Public exploit6.0 Medium
- smartertools smartermailUpload Arbitrary FilesCVE-2025-52691In KEVPublic exploitEPSS 85.7%10.0 Critical
- xxyopen novelDOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote...CVE-2025-65442Public exploit6.1 Medium
- antimof uxplayUxPlay 1.72 contains a double free vulnerability in its RTSP request handling. A specially...CVE-2025-60458Public exploitFix available6.5 Medium
- machsol machpanelReflected Cross site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute...CVE-2025-57462Public exploit6.1 Medium
- machsol machpanelFile upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell.CVE-2025-57460Public exploit9.8 Critical
- xspeeder sxzosXspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python...CVE-2025-54322Public exploitEPSS 15.3%10.0 Critical
- krishanmurariji student management systemSQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class...CVE-2025-66947Public exploit6.5 Medium
- forgejoForgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server...CVE-2025-68937Public exploit9.5 Critical
- coollabs coolifyCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database BackupCVE-2025-66209Public exploit10.0 Critical
- langchain-ai langchain, langchain core +1 moreLangChain serialization injection vulnerability enables secret extraction in dumps/loads APIsCVE-2025-68664Public exploitFix availableEPSS 42.9%9.3 Critical
- eaton xcomfort eci, xcomfort ethernet communication interface +1 moreImproper input validation at one of the endpoints of Eaton xComfort ECI's
web interface, could...CVE-2025-59886Public exploit8.8 High
- puneethreddyhc event managementImproper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management...CVE-2025-65354Public exploit9.8 Critical
- ruoyiSQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute...CVE-2024-57521Public exploit10.0 Critical
- netbt consulting services inc. e-faturaUnquoted Service Path in NetBT Consultancy's e-FaturaCVE-2025-14018Public exploit7.3 High
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite +1 moreA Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra...CVE-2025-68645In KEVPublic exploitEPSS 50.6%8.8 High
- xiongmaitech xm530v200 x6-weq 8m firmwareAn issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624...CVE-2025-65857Public exploit7.5 High
- xiongmaitech xm530v200 x6-weq 8m firmwareAuthentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8...CVE-2025-65856Public exploit9.8 Critical
- lsc smart connect indoor ip camera firmwareLSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh.CVE-2025-65817Public exploit8.8 High
- realtimelogic fuguhubA reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files...CVE-2025-65790Public exploit6.1 Medium
- clincapture captivate electronic data captureReflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an...CVE-2025-65270Public exploit6.1 Medium
- brainstormforce sureforms – contact form, payment form & other custom form builderSureForms <= 2.2.0 - Unauthenticated Stored Cross-Site ScriptingCVE-2025-14855Public exploit7.2 High
- phpInformation Leak of Memory in getimagesizeCVE-2025-14177Public exploitFix available6.3 Medium
- n8nn8n Vulnerable to Remote Code Execution via Expression InjectionCVE-2025-68613In KEVPublic exploitFix availableEPSS 99.0%10.0 Critical
- world wide broadcast network avideoAVideo < 20.1 Unauthenticated RCE via Predictable Installation SaltCVE-2025-34433Public exploit9.3 Critical
- mongodb, mongodb and mongodb server, mongodb inc. server +1 more +3 moreZlib compressed protocol header length confusion may allow memory readCVE-2025-14847In KEVPublic exploitFix availableEPSS 83.2%8.7 High
- watchguard firebox, fireware, fireware os +2 moreWatchGuard Firebox iked Out of Bounds Write VulnerabilityCVE-2025-14733In KEVPublic exploitEPSS 29.4%9.3 Critical
- linuxnet/sched: sch_cake: Fix incorrect qlen reduction in cake_dropCVE-2025-68325Public exploitFix available6.8 Medium
- sonicwall sma1000, sma1000 appliance, sma6200 firmware +4 more +6 moreA local privilege escalation vulnerability due to insufficient authorization in the SonicWall...CVE-2025-40602In KEVPublic exploit6.6 Medium
- Show moreLoading…