Skip to contentVulnerabilities with public exploits
- apple ipados, macos, safari +3 more +5 moreA path handling issue was addressed with improved logic. This issue is fixed in macOS Tahoe 26.3,...CVE-2026-20660Public exploit7.5 High
- apple ipados, ios and ipados, iphone os +2 moreA path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.5...CVE-2025-43537Public exploit5.5 Medium
- zyddnys manga-image-translatormanga-image-translator Shared API Unsafe Deserialization RCECVE-2026-26215Public exploit9.3 Critical
- dani-garcia vaultwardenvaultwarden has Full Cipher Enumeration Ignoring Organization Collection PermissionsCVE-2026-26012Public exploit6.5 Medium
- pjsip, pjsip pjproject +1 morePJSIP has a heap buffer overflow in ICE with long usernameCVE-2026-25994Public exploitFix available8.1 High
- kanboardKanboard is Missing Access Control on Plugin Installation leading to Administrative RCECVE-2026-25924Public exploit8.5 High
- red hat enterprise linux 6, hardened images, siemens ruggedcom rst2428p +2 moreBusybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitizationCVE-2026-26157Public exploitFix available7.0 High
- milvusMilvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System CompromiseCVE-2026-26190Public exploitFix availableEPSS 38.8%9.8 Critical
- nko custom block builder – lazy blocksCustom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code ExecutionCVE-2026-1560Public exploitEPSS 10.4%8.8 High
- wpvividplugins wpvivid — backup, migration & stagingMigration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File UploadCVE-2026-1357Public exploitEPSS 39.0%9.8 Critical
- microsoft windows notepadWindows Notepad App Remote Code Execution VulnerabilityCVE-2026-20841Public exploit7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Hyper-V Remote Code Execution VulnerabilityCVE-2026-21244Public exploit7.3 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +6 more +8 moreWindows HTTP.sys Elevation of Privilege VulnerabilityCVE-2026-21250Public exploit7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Storage Elevation of Privilege VulnerabilityCVE-2026-21508Public exploit7.0 High
- microsoft office, 365 apps, 365 apps for enterprise +5 more +7 moreMicrosoft Word Security Feature Bypass VulnerabilityCVE-2026-21514In KEVPublic exploit7.8 High
- microsoft windows, windows 10 version 1607, windows 10 version 1809 +27 more +29 moreWindows Shell Security Feature Bypass VulnerabilityCVE-2026-21510In KEVPublic exploitEPSS 61.2%8.8 High
- microsoft azure ai language authoring, azure conversation authoring client library +1 moreAzure SDK for Python Remote Code Execution VulnerabilityCVE-2026-21531Public exploitFix available9.8 Critical
- microsoft windows, windows 10 version 1607, windows 10 version 1809 +27 more +29 moreWindows Remote Desktop Services Elevation of Privilege VulnerabilityCVE-2026-21533In KEVPublic exploit7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Hyper-V Remote Code Execution VulnerabilityCVE-2026-21248Public exploit7.3 High
- evershopEverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL KeysCVE-2026-25993Public exploit9.3 Critical
- tp-link systems inc. tapo c260 v1, tp link systems inc. tapo c211 v2, tapo c520ws v2.6 +2 more +4 morePath Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local httpsCVE-2026-0651Public exploit6.9 Medium
- fortinet forticlient, forticlientwindows +1 moreAn Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59]...CVE-2025-62676Public exploit6.4 Medium
- axis osThe VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a...CVE-2025-11142Public exploit7.1 High
- frangoteam fuxaFUXA Unauthenticated Remote Arbitrary Scheduler WriteCVE-2026-25939Public exploitFix availableEPSS 24.3%9.3 Critical
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution in Node-RED IntegrationCVE-2026-25938Public exploitFix available9.5 Critical
- sumatrapdfreader sumatrapdfSumatraPDF Update MITM -> Arbitrary Code ExecutionCVE-2026-25961Public exploit7.5 High
- filebrowserFile Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URLCVE-2026-25890Public exploitFix available8.1 High
- markusproject markusZip Slip in MarkUs config upload allowing RCECVE-2026-25057Public exploit9.1 Critical
- red hat build of keycloak 26.2, build of keycloak 26.2.13, build of keycloak 26.4 +1 more +3 moreOrg.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validationCVE-2026-1529Public exploitFix available8.1 High
- bulwarkmail webmailRoundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does...CVE-2026-25916Public exploitFix available4.3 Medium
- code-projects online reviewer systemcode-projects Online Reviewer System btn_functions.php cross site scriptingCVE-2026-2222Public exploit4.8 Medium
- jayarsiech jay login & registerJAY Login & Register <= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profileCVE-2025-15100Public exploit8.8 High
- shenzhen tenda technology tenda g300-f, tenda g300-f firmware +1 moreTenda G300-F Command Injection via formSetWanDiagCVE-2026-25857Public exploit8.6 High
- tpadmin project tpadminyuan1994 tpadmin WebUploader preview.php deserializationCVE-2026-2113Public exploit6.9 Medium
- beyondtrust privileged remote access, remote support (rs) and privileged remote access (pra), remote support +1 more +3 moreRemote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)CVE-2026-1731In KEVPublic exploitEPSS 93.9%9.9 Critical
- triliumnext triliumTrilium Notes has a Timing Attack Vulnerability in /api/login/syncCVE-2025-68621Public exploit7.4 High
- calibre-ebook calibreCalibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML ExportCVE-2026-25731Public exploitFix available7.8 High
- blakeblackshear frigateFrigate Affected by Authenticated Remote Command Execution (RCE) and Container EscapeCVE-2026-25643Public exploit9.1 Critical
- devcode openstamanagerOpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing ModuleCVE-2026-24416Public exploit8.7 High
- devcode openstamanagerOpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of ServiceCVE-2026-24417Public exploitFix available8.7 High
- devcode openstamanagerOpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations moduleCVE-2026-24418Public exploit8.7 High
- devcode openstamanagerOpenSTAManager has an SQL Injection in Scadenzario Print TemplateCVE-2025-69216Public exploit8.7 High
- devcode openstamanagerOpenSTAManager has an SQL Injection in the Prima Nota moduleCVE-2026-24419Public exploit8.7 High
- devcode openstamanagerOpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)CVE-2025-69214Public exploit8.7 High
- devcode openstamanagerOpenSTAManager has an OS Command Injection in P7M File ProcessingCVE-2025-69212Public exploit9.4 Critical
- gogsGogs vulnerable to arbitrary file deletion via path traversal in wiki page updateCVE-2026-24135Public exploitFix available7.2 High
- xerox centreware, centreware web +1 moreStored XSS on Xerox CentreWare Web 7.0.6CVE-2026-1769Public exploit5.3 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php sql injectionCVE-2026-2058Public exploit6.9 Medium
- neo4j community edition, neo4j, neo4j enterprise edition +2 moreInsufficient escaping of unicode characters in query logCVE-2026-1337Public exploitFix available1.1 Low
- fortinet forticlientems, forticlient ems +1 moreAn improper neutralization of special elements used in an sql command ('sql injection')...CVE-2026-21643In KEVPublic exploitEPSS 97.7%9.1 Critical
- Show moreLoading…