Skip to contentVulnerabilities with public exploits
- abacre retail point of saleAbacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS)...CVE-2025-67263Public exploit6.1 Medium
- abacre retail point of saleAbacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The...CVE-2025-67261Public exploit6.5 Medium
- opensagres xdocreportXDocReport affected by an XML External Entity (XXE) vulnerabilityCVE-2025-65482Public exploitFix available9.8 Critical
- opensagres xdocreportXDocReport affected by a Server-Side Template Injection (SSTI) vulnerabilityCVE-2025-64087Public exploitFix available9.8 Critical
- dabeaz ply, red hat fence agents remediation operator, migration toolkit for containers +25 more +27 moreAn undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code...CVE-2025-56005Public exploitFix availableDisputedEPSS 18.8%9.8 Critical
- iptime a1004 firmware, a1004ns firmware, a1004v firmware +160 more +162 moreipTIME routers A2003NS-MU 10.00.6 to 12.16.2 , N600 10.00.8 to 12.16.2, A604-V3 10.01.6 to 10.07...CVE-2025-55423Public exploit9.8 Critical
- alchemy-cms alchemy cmsAlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelperCVE-2026-23885Public exploitFix available6.4 Medium
- chatterbotChatterBot has Denial of Service via Database Connection Pool ExhaustionCVE-2026-23842Public exploitFix available7.5 High
- kozea weasyprint, red hat ansible automation platform 2 +1 moreWeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP RedirectCVE-2025-68616Public exploitFix available7.5 High
- axllent mailpitMailpit has SMTP Header Injection via Regex BypassCVE-2026-23829Public exploitFix available5.3 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter work_info.jsp sql injectionCVE-2026-1122Public exploit6.9 Medium
- nodejs node, node.js +1 moreA flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass...CVE-2026-21636Public exploitFix available5.8 Medium
- publiccmsSanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversalCVE-2026-1111Public exploit5.1 Medium
- metagauss registrationmagic – custom registration forms, user registration, payment, and user loginRegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_orderCVE-2025-15403Public exploit9.8 Critical
- nodejs node, node.js, red hat enterprise linux 10 +6 more +8 moreA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow...CVE-2025-55130Public exploitFix available7.1 High
- kidocode crawl4aiCrawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks ParameterCVE-2026-26216Public exploitFix available10.0 Critical
- mcpjam inspectorREC in MCPJam inspector due to HTTP Endpoint exposesCVE-2026-23744Public exploitFix availableEPSS 67.5%9.8 Critical
- labredescefetrj wegiaWeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameterCVE-2026-23723Public exploit7.2 High
- amd epyc™ 8004 series processors, epyc™ 9004 series processors, epyc™ 9005 series processors +2 more +4 moreWrite what were condition within AMD CPUs may allow an admin-privileged attacker to modify the...CVE-2025-29943Public exploitFix available4.6 Medium
- apache brpcApache bRPC: Remote command injection vulnerability in heap builtin serviceCVE-2025-60021Public exploitEPSS 55.2%9.8 Critical
- chamilo lmsAn issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint...CVE-2025-69581Public exploit5.5 Medium
- steelseries nahimicSteelSeries Nahimic 3 1.10.7 allows Directory traversal.CVE-2025-68921Public exploit7.8 High
- altium enterprise server, on-prem enterprise server +1 moreStored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege EscalationCVE-2026-1010Public exploit8.0 High
- gnu glibcgetnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovlerCVE-2026-0915Public exploitFix available7.5 High
- arcaneArcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCECVE-2026-23520Public exploitFix available9.1 Critical
- glpi-project glpiGLPI has an unauthenticated SQL injection through the inventory endpointCVE-2025-66417Public exploit7.5 High
- glpi-project glpiGLPI incorrectly authorizes access to documentsCVE-2025-64516Public exploit7.5 High
- google keras, red hat openshift ai (rhoai), openshift ai 2.25 +2 more +4 moreDenial of Service in Keras via Excessive Memory Allocation in HDF5 MetadataCVE-2026-0897Public exploitFix available7.1 High
- ludashi driverA local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a...CVE-2025-67246Public exploit7.3 High
- shopwareShopware Improper Control of Generation of Code in Twig rendered viewsCVE-2026-23498Public exploitFix available7.2 High
- modular ds dsWordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerabilityCVE-2026-23550Public exploitEPSS 21.4%10.0 Critical
- vaghasia3 news and blog designer bundleNews and Blog Designer Bundle <= 1.1 - Unauthenticated Local File InclusionCVE-2025-14502Public exploit9.8 Critical
- mallsop list site contributorsList Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alphaCVE-2026-0594Public exploit6.1 Medium
- airth smart home aqi monitor bootloaderAn issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate...CVE-2025-67399Public exploit4.6 Medium
- agentfront enclaveSandbox Escape via Host Error Prototype Chain in enclave-vmCVE-2026-22686Public exploitFix available10.0 Critical
- eigentEigent Allows Arbitrary Code Execution via pull_request_target CI WorkflowCVE-2026-22869Public exploit8.9 High
- ethereum go-ethereum, go ethereum +1 morego-ethereum has a DoS via malicious p2p messageCVE-2026-22862Public exploitFix available7.1 High
- microsoft windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation), windows server 2008 service pack 2 +15 more +17 moreWindows Kerberos Information Disclosure VulnerabilityCVE-2026-20833Public exploit5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +29 more +31 moreWindows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2026-20820Public exploit7.8 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +12 more +14 moreWindows Error Reporting Service Elevation of Privilege VulnerabilityCVE-2026-20817Public exploit7.8 High
- microsoft windows, windows 10 version 1607, windows 10 version 1809 +25 more +27 moreDesktop Window Manager Information Disclosure VulnerabilityCVE-2026-20805In KEVPublic exploit5.5 Medium
- fortinet fortisiemAn improper neutralization of special elements used in an os command ('os command injection')...CVE-2025-64155Public exploitEPSS 43.9%9.4 Critical
- red hat openshift dev spaces (rhosds) 3.22, openshift dev spaces (rhosds) 3.23, openshift dev spaces (rhosds) 3.24 +2 moreGithub.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333CVE-2025-12548Public exploit9.0 Critical
- zohocorp manageengine admanager plusPath TraversalCVE-2025-9435Public exploit5.5 Medium
- ninjateam wp duplicate pageWP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post DuplicationCVE-2025-14001Public exploit5.4 Medium
- hikvision ds-2cd1xx1, ds-2cd1xxxg0(t), ds-2cd1xxxg2 +96 more +98 moreThere is a Stack overflow Vulnerability in the device Search and Discovery feature of Hikvision...CVE-2025-66177Public exploit8.8 High
- semantic-machines vedaAn issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a...CVE-2025-66698Public exploit8.6 High
- erambaA CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker...CVE-2025-55462Public exploit6.5 Medium
- anoma opencodeOpenCode's Unauthenticated HTTP Server Allows Arbitrary Command ExecutionCVE-2026-22812Public exploitFix availableEPSS 16.5%8.8 High
- termixTermix has a Stored XSS in File Manager leading to Local File Inclusion (LFI) in Electron and Session Hijacking in BrowserCVE-2026-22804Public exploit8.0 High
- Show moreLoading…