Skip to contentVulnerabilities with public exploits
- zauberzeug niceguiNiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File WriteCVE-2026-25732Public exploitFix available7.5 High
- payloadcms payloadPayload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite AdaptersCVE-2026-25544Public exploitFix available9.8 Critical
- opencloud-eu reva, heinlein opencloud reva +1 moreREVA Public Link ExploitCVE-2026-23989Public exploitFix available8.2 High
- nukegraphic cms cmsStored Cross Site Scripting(XSS) in Nukegraphic CMS V3.1.2CVE-2026-1953Public exploit8.2 High
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload APICVE-2026-25895Public exploitFix availableEPSS 12.8%9.5 Critical
- apache tomcatApache Tomcat: Security constraint bypass with HTTP/0.9CVE-2026-24733Public exploitFix available3.7 Low
- monstra cmsMonstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin....CVE-2025-69906Public exploit8.8 High
- axigen mail serverAxigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS)...CVE-2025-68723Public exploit9.0 Critical
- axigen mail serverAxigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery...CVE-2025-68722Public exploit8.8 High
- axigen mail serverAxigen Mail Server before 10.5.57 contains an improper access control vulnerability in the...CVE-2025-68721Public exploit8.1 High
- agpt autogpt platform, significant-gravitas autogpt +1 moreAutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration BlocksCVE-2026-22038Public exploit8.1 High
- group-office group office, intermesh groupoffice +1 moreGroup-Office is vulnerable to RCE due to Command Injection via TNEF Attachment HandlerCVE-2026-25512Public exploitEPSS 19.9%9.4 Critical
- waterfutures epyt-flowEPyT-Flow has unsafe JSON deserialization (__type__)CVE-2026-25632Public exploitFix available10.0 Critical
- suse rancherLocal Path Provisioner vulnerable to Path Traversal via parameters.pathPatternCVE-2025-62878Public exploitFix available9.9 Critical
- coding-solo godot-mcp, godot mcp +1 moreGodot MCP is vulnerable to Command Injection via unsanitized projectPathCVE-2026-25546Public exploitFix available7.8 High
- n8nn8n is Vulnerable to OS Command Injection in Git NodeCVE-2026-25053Public exploitFix available9.4 Critical
- n8nn8n Has an Expression Escape Vulnerability Leading to RCECVE-2026-25049Public exploitFix available9.4 Critical
- martcode software inc. delta course automationSQLi in Martcode Software's Delta Course AutomationCVE-2025-5329Public exploit9.8 Critical
- long watch studio myrewardsMyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule ModificationCVE-2025-15260Public exploit6.5 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to...CVE-2026-20980Public exploit7.0 High
- belden ppc 2k05x firmwareA stored cross-site scripting (XSS) vulnerability exists in the web management interface of the...CVE-2025-70545Public exploit6.1 Medium
- kubernetes ingress-nginxingress-nginx Admission Controller denial of serviceCVE-2026-24514Public exploitFix available6.5 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http request smuggling via malformed chunk headersCVE-2026-1801Public exploitFix available5.3 Medium
- devcode openstamanagerOpenSTAManager has an SQL Injection in the Stampe ModuleCVE-2025-69215Public exploit8.7 High
- devcode openstamanagerOpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)CVE-2025-69213Public exploit8.7 High
- facturascriptsFacturaScripts has SQL Injection vulnerability in Autocomplete ActionsCVE-2026-25514Public exploitFix available8.7 High
- facturascriptsFacturaScripts has SQL Injection vulnerability in API ORDER BY ClauseCVE-2026-25513Public exploitFix available8.3 High
- hubspot jinjavaJinJava Bypass through ForTag leads to Arbitrary Java ExecutionCVE-2026-25526Public exploitFix available9.8 Critical
- rapid7 insightvm/nexposeRapid7 Nexpose Insecure Java Keystore Password GenerationCVE-2026-1814Public exploit6.8 Medium
- emit informatics and communication technologies industry and trade ltd. co. digita efficiency management systemSQLi in Emit Informatics' DIGITA Efficiency Management SystemCVE-2025-5319Public exploit9.8 Critical
- djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 morePotential SQL injection via QuerySet.order_by and FilteredRelationCVE-2026-1312Public exploitFix available5.4 Medium
- djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 morePotential SQL injection via raster lookups on PostGISCVE-2026-1207Public exploitFix availableEPSS 12.8%5.4 Medium
- tokio-rs bytesBytes is vulnerable to integer overflow in BytesMut::reserveCVE-2026-25541Public exploitFix available5.5 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and DeletionCVE-2026-1375Public exploit8.1 High
- thehappymonster happy addons for elementorHappy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta FieldCVE-2026-1210Public exploit6.4 Medium
- notepad++, notepad-plus-plus, notepad-plus-plus notepad\+\+ +2 moreNotepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity VerificationCVE-2025-15556In KEVPublic exploit7.7 High
- stefanprodan podinfoPodinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)CVE-2025-70849Public exploitFix available6.1 Medium
- netboxNetBox is an open-source infrastructure resource modeling and IP address management platform. A...CVE-2025-69848Public exploit5.4 Medium
- mediacrushAn issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to...CVE-2025-61506Public exploit9.8 Critical
- youdatasum cpas audit management systemYouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList...CVE-2025-57529Public exploit9.8 Critical
- tp link systems inc. archer ax73 v2, tp-link systems inc. archer be230 v1.2, tp-link archer be230 firmware +2 moreCommand Injection Vulnerability on TP-Link Archer BE230 and AX73CVE-2026-22226Public exploit8.5 High
- vllm, red hat ai inference server, ai inference server 3.2 +5 more +7 morevLLM leaks a heap address when PIL throws an errorCVE-2026-22778Public exploitFix availableEPSS 18.3%9.8 Critical
- beyondtrust privilege management for windowsAnti-Tamper Bypass in BeyondTrust Privilege Management for WindowsCVE-2026-1232Public exploit6.8 Medium
- nokia ontInsufficient Input Validation on WEBUI in Nokia ONT/Beacon productCVE-2025-9974Public exploit8.0 High
- mediatek nr15, nr16, nr17 +2 more +4 moreIn Modem, there is a possible system crash due to improper input validation. This could lead to...CVE-2026-20404Public exploitFix available6.5 Medium
- unknown user profile builderUser Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password ResetCVE-2025-15030Public exploit9.8 Critical
- openclawOpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrlCVE-2026-25253Public exploitFix availableEPSS 32.4%8.8 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 Denial of ServiceCVE-2025-36001Public exploitFix available6.5 Medium
- aliasrobotics caiCybersecurity AI vulnerable to command Injection through argument injection in find_file Agent toolCVE-2026-25130Public exploit9.7 Critical
- kodmatic computer software tourism construction industry and trade ltd. co. online exam and assessmentTime-Based Blind SQLi in Kodmatic Computer's Online Exam and AssessmentCVE-2025-4686Public exploit8.6 High
- Show moreLoading…