Skip to contentVulnerabilities with public exploits
- dell wyse management suiteDell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization...CVE-2026-22765Public exploit8.8 High
- binardat ltd. 10g08-0800gsm network switch, binardat 10g08-0800gsm firmware +1 moreBinardat 10G08-0800GSM Network Switch Hard-coded CredentialsCVE-2026-27507Public exploit9.3 Critical
- exiftool project exiftoolexiftool PNG File MacOS.pm SetMacOSTags os command injectionCVE-2026-3102Public exploit5.3 Medium
- mindsdbMindsDB has Path Traversal in /api/files Leading to Remote Code ExecutionCVE-2026-27483Public exploitFix availableEPSS 11.0%8.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreJIT miscompilation in the JavaScript: WebAssembly componentCVE-2026-2796Public exploit9.8 Critical
- apache supersetApache Superset: Improper Neutralization of Special Elements used in a SQL CommandCVE-2026-23980Public exploitFix available5.3 Medium
- zyxel vmg3625-t50b firmware, dx5401-b1 firmware, emg3525-t50b firmware +3 more +5 moreA post-authentication command injection vulnerability in the TR-369 certificate download CGI...CVE-2026-1459Public exploit7.2 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the JavaScript Engine: JIT componentCVE-2026-2766Public exploitFix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreJIT miscompilation, use-after-free in the JavaScript Engine: JIT componentCVE-2026-2764Public exploitFix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the JavaScript Engine componentCVE-2026-2763Public exploitFix available9.8 Critical
- frangoteam fuxaFUXA has JWT Authentication Bypass via HTTP Referer header spoofingCVE-2025-69985Public exploitEPSS 14.3%9.8 Critical
- totolink x5000r firmwareTOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin...CVE-2025-67445Public exploit7.5 High
- yt-dlpyt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` optionCVE-2026-26331Public exploitFix available8.8 High
- collerek ormarormar is vulnerable to SQL Injection through aggregate functions min() and max()CVE-2026-26198Public exploitFix available9.8 Critical
- traccarTraccar Missing Origin Validation in WebSocketsCVE-2025-68930Public exploit7.1 High
- lfprojects valkey, red hat enterprise linux 10, enterprise linux 10.0 extended update support +1 more +3 moreValkey Affected by RESP Protocol Injection via Lua error_replyCVE-2025-67733Public exploitFix available8.5 High
- apache camel, apache software foundation camel leveldb, red hat build of apache camel for spring boot 4 +3 more +5 moreApache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDBCVE-2026-25747Public exploitFix available8.8 High
- apache camelApache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicyCVE-2026-23552Public exploitFix available9.1 Critical
- higuma web-audio-recorder-js, webaudiorecorder.js +1 morehiguma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollutionCVE-2026-2964Public exploit2.3 Low
- tencent pcmanagerA privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on...CVE-2025-63946Public exploit7.4 High
- tencent ioaA privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on...CVE-2025-63945Public exploit7.4 High
- funadminfunadmin Backend Endpoint AuthCloudService.php getMember deserializationCVE-2026-2898Public exploit5.1 Medium
- karnop realtime-collaboration-platformCollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data ExposureCVE-2026-27579Public exploit7.4 High
- hackerbay oneuptimeOneUptime: node:vm sandbox escape in probe allows any project member to achieve RCECVE-2026-27574Public exploitFix available10.0 Critical
- zoneminderZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause FieldsCVE-2026-27470Public exploitFix available8.8 High
- google cloud vertex ai sdk for python, red hat openshift ai 2.25 +1 moreStored Cross-Site Scripting (XSS) in Vertex AI Python SDK VisualizationCVE-2026-2472Public exploitFix available8.6 High
- case-themes bookedWordPress Booked plugin <= 3.0.0 - Account Takeover vulnerabilityCVE-2026-22341Public exploit6.7 Medium
- teconcetheme coven coreWordPress Coven Core plugin <= 1.3 - SQL Injection vulnerabilityCVE-2025-69295Public exploit9.3 Critical
- tassos.gr advanced custom fields, convert forms, engagebox +3 more +5 moreExtension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for JoomlaCVE-2026-21627Public exploit9.5 Critical
- opensourcepos open source point of saleOpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php:...CVE-2026-26746Public exploit8.8 High
- openclawOpenClaw File Existence tools.exec.safeBins information exposureCVE-2026-4040Public exploitFix available4.8 Medium
- pallets werkzeugWerkzeug safe_join() allows Windows special device namesCVE-2026-27199Public exploitFix available6.3 Medium
- nolimits4web swiperSwiper has a Prototype Pollution VulnerabilityCVE-2026-27212Public exploitFix available9.4 Critical
- spipSPIP < 4.4.9 Insecure DeserializationCVE-2026-27475Public exploitFix available9.2 Critical
- spipSPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated SitesCVE-2026-27472Public exploitFix available5.3 Medium
- tomdever wpforo forumwpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL InjectionCVE-2026-1581Public exploit7.5 High
- microsoft semantic kernel, semantic-kernel +1 moreMicrosoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code executionCVE-2026-26030Public exploitFix available10.0 Critical
- hyland alfresco community, alfresco enterprise, alfresco content services +2 moreHyland Alfresco Improper Authorization Arbitrary File ReadCVE-2026-26336Public exploit8.7 High
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)CVE-2026-25940Public exploitFix available8.1 High
- spip saisies, saisies pour formulaire +1 moreSPIP Saisies Plugin < 5.11.1 Remote Code ExecutionCVE-2025-71243Public exploit9.3 Critical
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF has PDF Object Injection via Unsanitized Input in addJS MethodCVE-2026-25755Public exploitFix available8.1 High
- prodigy commerce commerce, prodigycommerce prodigy commerce +1 moreProdigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]CVE-2026-0926Public exploit9.8 Critical
- franchidesign slider futureSlider Future <= 1.0.5 - Unauthenticated Arbitrary File UploadCVE-2026-1405Public exploit9.8 Critical
- epson printer controller installermacOS Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller InstallerCVE-2025-4960Public exploit7.8 High
- gnu inetutilstelnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing...CVE-2026-28372Public exploitFix available7.4 High
- formalmsA user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery...CVE-2026-26744Public exploit5.3 Medium
- softvision webpdfSoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery (SSRF). The PDF...CVE-2025-55853Public exploit9.1 Critical
- invoiceplaneInvoicePlane has Stored XSS via Product Unit Name in Invoice Item ListCVE-2026-25596Public exploit4.8 Medium
- invoiceplaneInvoicePlane has Stored XSS via Invoice Number in Invoice View and DashboardCVE-2026-25595Public exploit4.8 Medium
- invoiceplaneInvoicePlane has Stored XSS via Family Name in Product FormCVE-2026-25594Public exploit4.8 Medium
- Show moreLoading…