Skip to contentVulnerabilities with public exploits
- invoiceplaneInvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log PoisoningCVE-2026-25548Public exploit9.1 Critical
- librenmsLibreNMS: SQL Injection in ajax_table.php spreads through a covert data streamCVE-2026-26988Public exploitFix available9.3 Critical
- ghostGhost has a SQL Injection in its Content APICVE-2026-26980Public exploitFix availableEPSS 71.1%9.4 Critical
- mjdm majordomoMajorDoMo Supply Chain Remote Code Execution via Update URL PoisoningCVE-2026-27180Public exploit9.3 Critical
- mjdm majordomoMajorDoMo Unauthenticated SQL Injection in Commands ModuleCVE-2026-27179Public exploit8.8 High
- mjdm majordomoMajorDoMo Command Injection in rc/index.php via Race ConditionCVE-2026-27175Public exploitEPSS 23.7%9.2 Critical
- mjdm majordomoMajorDoMo Unauthenticated Remote Code Execution via Admin Console EvalCVE-2026-27174Public exploit9.3 Critical
- advantech wise-6610-cb, wise-6610-eb, wise-6610-el-cb +10 more +12 moreAdvantech WISE-6610-NB Background Management openvpn_apply os command injectionCVE-2026-2670Public exploitEPSS 13.7%8.6 High
- github enterprise serverIncorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requestsCVE-2026-1999Public exploit7.1 High
- invoiceplaneInvoicePlane has Unauthenticated Path Traversal in Guest ControllerCVE-2026-23491Public exploit9.3 Critical
- aquasec trivy action, aquasecurity trivy-action +1 moreTrivy Action has a script injection via sourced env file in composite actionCVE-2026-26189Public exploitFix available5.9 Medium
- grandstream gxp1610, gxp1615, gxp1620 +9 more +11 moreGrandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflowCVE-2026-2329Public exploitEPSS 41.7%9.3 Critical
- payara platform serverAdmin Account Takeover via malicious URL payloadCVE-2025-14340Public exploit7.3 High
- yaycommerce yaymail – woocommerce email customizerYayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX ActionCVE-2026-1937Public exploit7.2 High
- strategy11team business directory plugin – easy listing directories for wordpressBusiness Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment ParameterCVE-2026-2576Public exploit7.5 High
- kaizencoders url shortify – simple and easy url shortenerURL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' ParameterCVE-2026-1277Public exploit4.7 Medium
- wpshuffle frontend post submission manager lite – frontend posting wordpress pluginFrontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' ParameterCVE-2026-1296Public exploit6.1 Medium
- codeastro membership management systemCodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in...CVE-2025-70149Public exploit9.8 Critical
- zoneminderZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application...CVE-2025-65791Public exploitDisputed9.8 Critical
- microsoft windows admin centerWindows Admin Center Elevation of Privilege VulnerabilityCVE-2026-26119Public exploitEPSS 11.2%8.8 High
- gogsGogs has a Protected Branch Deletion Bypass in Web InterfaceCVE-2026-25232Public exploitFix available7.1 High
- weblateWeblate has an argument injection in management consoleCVE-2026-24126Public exploitFix available6.6 Medium
- ocaml, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreIn OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization ...CVE-2026-28364Public exploitFix available7.9 High
- metagauss eventprime – events calendar, bookings and ticketsEventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX EndpointCVE-2026-1657Public exploit5.3 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site ScriptingCVE-2026-2002Public exploit4.4 Medium
- No product listedA Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart...CVE-2025-70830Public exploit9.9 Critical
- running-elephant datartAn information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to...CVE-2025-70829Public exploit5.7 Medium
- running-elephant datartAn issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter...CVE-2025-70828Public exploit8.8 High
- No product listedAn issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers...CVE-2025-65753Public exploit7.5 High
- phpgurukul gym management systemA Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym...CVE-2024-55271Public exploit3.5 Low
- phpgurukul student management systemphpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search...CVE-2024-55270Public exploit8.8 High
- ritwickdey live serverAn issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files...CVE-2025-65717Public exploit4.3 Medium
- adminkov midi-synthmidi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX ActionCVE-2026-1306Public exploit9.8 Critical
- raju ahmed best-wp-google-mapBest-wp-google-map <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode AttributeCVE-2026-1096Public exploit6.4 Medium
- webilop user language switchUser Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' ParameterCVE-2026-0745Public exploit5.5 Medium
- amentotechpvtltd one to one user chat by wpguppyOne to one user Chat by WPGuppy <= 1.1.4 - Unauthenticated Information Disclosure via Chat Message InterceptionCVE-2025-6792Public exploit5.3 Medium
- pixelyoursite pro – your smart pixel (tag) managerPixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-1844Public exploit7.2 High
- calero verasmartCalero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCECVE-2026-26335Public exploit9.3 Critical
- tandoor recipesTandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe ImportCVE-2026-25991Public exploit7.7 High
- google chrome, chromium +1 moreUse after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to...CVE-2026-2441In KEVPublic exploitFix availableEPSS 54.5%8.8 High
- tandoor recipesTandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File ReadCVE-2026-25964Public exploit4.9 Medium
- anysphere cursorCursor sandbox escape via Git hooksCVE-2026-26268Public exploit8.1 High
- hyland onbase workflow timer serviceHyland OnBase Timer Service Unauthenticated .NET Remoting RCECVE-2026-26221Public exploit9.3 Critical
- linux, linux kernel, red hat enterprise linux 10 +13 more +15 morenetfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()CVE-2026-23111Public exploitFix available7.8 High
- iobit unlockerAn issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a...CVE-2025-66676Public exploit6.2 Medium
- m-audio m-track duo hdThe installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which...CVE-2026-25676Public exploit7.1 High
- albrecht jung gmbh & co. kg jung smart visu server, jung-group smart visu server firmware +1 moreJUNG Smart Visu Server 1.1.1050 - 'JUNG Smart Visu Server' Missing AuthenticationCVE-2026-26235Public exploit8.7 High
- postgresql, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 morePostgreSQL pgcrypto heap buffer overflow executes arbitrary codeCVE-2026-2005Public exploitFix available8.8 High
- haloAn issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a...CVE-2025-70886Public exploit7.5 High
- apple ipados, macos, tvos +5 more +7 moreA memory corruption issue was addressed with improved state management. This issue is fixed in...CVE-2026-20700In KEVPublic exploit7.8 High
- Show moreLoading…