Skip to contentVulnerabilities with public exploits
- appsmithAccount Takeover Vulnerability in AppsmithCVE-2026-22794Public exploitFix available9.7 Critical
- servicenow now assist ai agents, virtual agent api +1 moreUnauthenticated Privilege Escalation in ServiceNow AI PlatformCVE-2025-12420Public exploitEPSS 53.2%9.3 Critical
- orvalorval MCP client is vulnerable to a code injection attack.CVE-2026-22785Public exploitFix available9.3 Critical
- enhancesoft osticketosTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File ReadCVE-2026-22200Public exploitEPSS 73.6%8.7 High
- mindsdbMindsDB has improper sanitation of filepath that leads to information disclosure and DOSCVE-2025-68472Public exploitFix availableEPSS 20.3%8.1 High
- advantech iot edge linux docker, iot edge windows, iotsuite and iot edge products +3 more +5 moreExecution of arbitrary SQL commandsCVE-2025-52694Public exploitEPSS 39.9%10.0 Critical
- abhishekmali21 gym management systemMultiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the ...CVE-2025-67146Public exploit9.4 Critical
- covid-19 contact tracing system project contact tracing systemSourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution)....CVE-2025-66802Public exploit9.8 Critical
- ddsn cm3 acora cmsA static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7...CVE-2025-63314Public exploit10.0 Critical
- webkul qloappsA CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin...CVE-2021-41074Public exploit5.4 Medium
- apache struts, red hat enterprise linux 8, fuse 7 +2 more +4 moreApache Struts, Apache Struts: XXE vulnerability in outdated XWork componentCVE-2025-68493Public exploitFix availableEPSS 50.4%8.1 High
- flycatcher toys smart sketcherFlycatcher Toys smART Sketcher Bluetooth Low Energy missing authenticationCVE-2026-0842Public exploit5.3 Medium
- comfy comfyui-managerComfyUI-Manager is Vulnerable to CRLF Injection in Configuration HandlerCVE-2026-22777Public exploitFix available7.5 High
- haxtheweb issues, psu haxcms-nodejs +1 moreHAXcms Has Stored XSS Vulnerability that May Lead to Account TakeoverCVE-2026-22704Public exploitFix available8.1 High
- nasa cryptolibCryptoLib Memory Leak in KMC Encrypt Function Leads to Resource ExhaustionCVE-2026-22024Public exploit6.3 Medium
- angular, siemens ruggedcom rst2428p, sidis prime +2 moreAngular has XSS Vulnerability via Unsanitized SVG Script AttributesCVE-2026-22610Public exploitFix available8.5 High
- biggidroid simple php cmsBiggiDroid Simple PHP CMS editsite.php unrestricted uploadCVE-2025-15495Public exploit5.1 Medium
- bees software solutions bet eportal, cloudilyaerp bet e-portal +1 moreCVE-2025-14598CVE-2025-14598Public exploit9.8 Critical
- infosatech wp page permalink extensionWP Page Permalink Extension <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules FlushCVE-2025-14172Public exploit6.5 Medium
- indiewebIndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' ParameterCVE-2025-14893Public exploit6.4 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form FieldCVE-2025-14736Public exploit9.8 Critical
- No product listedA vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an...CVE-2025-67070Public exploit8.2 High
- ghostGhost has Staff 2FA bypassCVE-2026-22594Public exploitFix available8.1 High
- @tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 moreReact Router has Path Traversal in File Session StorageCVE-2025-61686Public exploitFix availableEPSS 17.3%9.1 Critical
- @tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 moreReact Router has XSS VulnerabilityCVE-2025-59057Public exploitFix available7.6 High
- veeam backup and recovery, backup \& replication +1 moreThis vulnerability allows a Backup Operator to perform remote code execution (RCE) as the...CVE-2025-59470Public exploit9.0 Critical
- gunet openeclassOpen eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)CVE-2026-22241Public exploit7.3 High
- coreruleset, owasp modsecurity core rule set +1 moreOWASP CRS has multipart bypass using multiple content-type partsCVE-2026-21876Public exploitFix availableEPSS 17.3%9.3 Critical
- webkul qloappsUnrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows...CVE-2025-67325Public exploit9.8 Critical
- dlink dir-605l firmwareAn issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6...CVE-2025-65731Public exploit6.8 Medium
- webpros plesk obsidian, red hat openshift dev spaces +1 morePlesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS)...CVE-2025-65518Public exploit7.5 High
- indieka900 online shopping systemindieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action...CVE-2025-61246Public exploit9.8 Critical
- open microscopy environment bio-formatsBio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache FilesCVE-2026-22187Public exploit6.8 Medium
- n8nn8n Vulnerable to Unauthenticated File Access via Improper Webhook Request HandlingCVE-2026-21858Public exploitFix availableEPSS 78.2%10.0 Critical
- rustfsRustFS Path Traversal VulnerabilityCVE-2025-68705Public exploitFix available8.8 High
- janstudio geckoWordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerabilityCVE-2025-69080Public exploit8.1 High
- airesvsg acf to rest apiACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option ModificationCVE-2025-12030Public exploit4.3 Medium
- auntyfey smart combination lockAuntyFey Smart Combination Lock BLE Connection Flood DoSCVE-2025-15474Public exploit5.3 Medium
- gnu wget2Wget2: arbitrary file write via metalink path traversal in gnu wget2CVE-2025-69194Public exploitFix available8.8 High
- softwareag arisIn Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate...CVE-2025-66838Public exploit6.5 Medium
- softwareag arisA file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code...CVE-2025-66837Public exploit6.8 Medium
- google chromeInsufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed...CVE-2026-0628Public exploitFix availableEPSS 20.9%8.8 High
- n8nn8n is vulnerable to Remote Code Execution via Arbitrary File WriteCVE-2026-21877Public exploitFix available10.0 Critical
- fsylum fs registration passwordFS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account TakeoverCVE-2025-15001Public exploit9.8 Critical
- coollabs coolifyColify has command injection vulnerability in project git sourceCVE-2025-64424Public exploit9.4 Critical
- redaxoRedaxo has Path Traversal in Backup Addon Leading to Arbitrary File ReadCVE-2026-21857Public exploitFix available8.3 High
- parall jspdf, red hat advanced cluster security 4, advanced cluster security 4.8 +1 more +3 morejsPDF has Local File Inclusion/Path Traversal vulnerabilityCVE-2025-68428Public exploitFix available9.2 Critical
- radiustheme teamTeam < 5.0.11 - Unauthenticated SQLiCVE-2025-14124Public exploit8.6 High
- comfy comfyui-managerDuplicate Advisory: ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)CVE-2025-67303Public exploitFix available7.5 High
- adonisjs coreAdonisJS Path Traversal in Multipart File HandlingCVE-2026-21440Public exploitFix available9.2 Critical
- Show moreLoading…