Skip to contentVulnerabilities with public exploits
- qi-anxin qax virus removal, qianxin qax internet control gateway +1 moreQi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access controlCVE-2026-3796Public exploit4.8 Medium
- easycmsEasyCMS Request Parameter RbacuserAction.class.php sql injectionCVE-2026-3786Public exploit5.3 Medium
- psf blackBlack's vulnerable version parsing leads to RCE in GitHub ActionCVE-2026-31900Public exploitFix available8.7 High
- miguel useche js archive listJS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode AttributeCVE-2026-2020Public exploit7.5 High
- flowiseai flowiseFlowise: Missing Authentication on NVIDIA NIM EndpointsCVE-2026-30824Public exploitFix availableEPSS 37.3%7.7 High
- mesaMesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runnerCVE-2026-29075Public exploit8.3 High
- grokability, inc. snipe-itSnipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege EscalationCVE-2025-15602Public exploitFix available8.7 High
- windmillWindmill: SUPERADMIN_SECRET (rarely used) can be accessed publiclyCVE-2026-29059Public exploit6.9 Medium
- chamilo lms, chamilo-lms +1 moreChamilo: Authenticated Remote Code Execution via Unrestricted File UploadCVE-2026-29041Public exploit8.8 High
- epower epower.ieePower epower.ie Improper Restriction of Excessive Authentication AttemptsCVE-2026-27778Public exploit8.7 High
- olivetinOliveTin: RestartAction always runs actions as guestCVE-2026-30225Public exploitFix available5.3 Medium
- nltk, nltk nltk/nltk +1 moreArbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR LoadingCVE-2026-0848Public exploitFix available10.0 Critical
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Unauthenticated Backup Download with Encryption Key DisclosureCVE-2026-27944Public exploitFix availableEPSS 22.8%9.8 Critical
- templaza astroid framework, astroidframe.work astroid template framework +1 moreExtension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for JoomlaCVE-2026-21628Public exploit10.0 Critical
- crocoblock jetengineWordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerabilityCVE-2026-28134Public exploit8.5 High
- josh kohlbach wholesale suiteWordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerabilityCVE-2026-27541Public exploit7.2 High
- inseriswiss inseri coreWordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerabilityCVE-2026-27344Public exploit5.9 Medium
- isaacs node-tar, tar, red hat cryostat 4 +20 more +22 morenode-tar: Hardlink Path Traversal via Drive-Relative LinkpathCVE-2026-29786Public exploitFix available8.2 High
- bishopfox sliverSliver: Authenticated Nil-Pointer Dereference in HandlersCVE-2026-29781Public exploit2.1 Low
- govcert-lu eml parsereml_parser: Path Traversal in Official Example Script Leading to Arbitrary File WriteCVE-2026-29780Public exploitFix available5.5 Medium
- tcs cognix platformMissing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon...CVE-2026-26418Public exploit7.5 High
- tcs cognix platformA broken access control vulnerability in the password reset functionality of Tata Consultancy...CVE-2026-26417Public exploit8.1 High
- tcs cognix platformAn authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0...CVE-2026-26416Public exploit8.8 High
- No product listedAn issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to...CVE-2025-70995Public exploit8.8 High
- fonosterFonoster is vulnerable to directory traversalCVE-2024-43035Public exploitFix available5.8 Medium
- pac4j pac4j-jwtpac4j-jwt JwtAuthenticator Authentication BypassCVE-2026-29000Public exploitFix available9.3 Critical
- nltk, nltk nltk/nltk, red hat lightspeed core +5 more +7 morePath Traversal in nltk/nltkCVE-2026-0847Public exploitFix available8.6 High
- xwiki blog application, xwiki-contrib application-blog-ui +1 moreXWiki Blog Application home page vulnerable to Stored XSS via Post TitleCVE-2025-66024Public exploitFix available8.6 High
- cisco secure firewall management center (fmc), secure firewall management center +1 moreCisco Secure Firewall Management Center Software Remote Code Execution VulnerabilityCVE-2026-20131In KEVPublic exploitEPSS 44.4%10.0 Critical
- cisco secure firewall management center (fmc), secure firewall management center, secure firewall management center (fmc) and security cloud control (scc) firewall management +2 moreCisco Secure Firewall Management Center Authentication Bypass Remote Code Execution VulnerabilityCVE-2026-20079In KEVPublic exploitEPSS 88.7%10.0 Critical
- linux, linux kernel, siemens ruggedcom rst2428p (6gk6242-6pa00) +6 more +8 morenetfilter: nf_tables: fix use-after-free in nf_tables_addchain()CVE-2026-23231Public exploitFix available7.8 High
- cloudflare pingora, https://github.com/cloudflare/pingora +1 moreHTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding MisparsingCVE-2026-2835Public exploitFix available9.3 Critical
- grahampugh erase-installerase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded...CVE-2025-70342Public exploit6.6 Medium
- app-auto-patchInsecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to...CVE-2025-70341Public exploit7.8 High
- faintsnow hardware read \& write utilityAn issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25...CVE-2025-66678Public exploit9.8 Critical
- freescoutFreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code ExecutionCVE-2026-28289Public exploitEPSS 35.1%10.0 Critical
- craftcms cms, craft cms +1 moreCraft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadgetCVE-2026-28695Public exploitFix available7.5 High
- wwbn avideo-encoderAVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.phpCVE-2026-29058Public exploitFix available9.8 Critical
- ghostGhost Vulnerable to Remote Code Execution via Malicious ThemesCVE-2026-29053Public exploitFix available7.7 High
- mariadb, mariadb foundation server, amazon aurora mysql +3 more +5 moreMariaDB Server Audit Plugin Comment Handling BypassCVE-2026-3494Public exploitFix available5.3 Medium
- devcode openstamanagerOpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameterCVE-2026-24415Public exploitFix available5.1 Medium
- apache rangerApache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreatorCVE-2025-59059Public exploitFix available9.8 Critical
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership RegistrationCVE-2026-1492Public exploitEPSS 28.9%9.8 Critical
- wisecleaner wise force deleterAn issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier...CVE-2025-66680Public exploit7.1 High
- openclawOpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval BypassCVE-2026-28466Public exploitFix available9.4 Critical
- openclawOpenClaw < 2026.2.25 - Symlink Traversal in agents.files MethodsCVE-2026-32013Public exploitFix available8.7 High
- qwikQwik affected by unauthenticated RCE via server$ DeserializationCVE-2026-27971Public exploitFix available9.2 Critical
- modelscope ms-agentCommand injection vulnerability in ModelScope's ms-agentCVE-2026-2256Public exploit6.5 Medium
- google androidIn onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing...CVE-2026-0010Public exploitFix available8.4 High
- contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripeContest Gallery <= 28.1.4 - Unauthenticated SQL InjectionCVE-2026-3180Public exploit7.5 High
- Show moreLoading…