Skip to contentVulnerabilities with public exploits
- google chrome, chromium v8 +1 moreInappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote...CVE-2026-3910In KEVPublic exploitFix available8.8 High
- google chrome, skia +1 moreOut of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to...CVE-2026-3909In KEVPublic exploitFix available8.8 High
- honeywell iq3, iq412, iq412 firmware +9 more +11 moreHoneywell IQ4x BMS Controller Missing authentication for critical functionCVE-2026-3611Public exploit10.0 Critical
- getzep graphitiGraphiti vulnerable to Cypher Injection via unsanitized node_labels in search filtersCVE-2026-32247Public exploitFix available8.1 High
- ggml llama.cppllama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 FixCVE-2026-27940Public exploitFix available7.8 High
- asseco liveLocal File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0...CVE-2025-66955Public exploit6.5 Medium
- adguard adguardhomeAdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication BypassCVE-2026-32136Public exploitFix available9.8 Critical
- fastgptFastGPT Python Sandbox Bypass of File-Write RestrictionCVE-2026-32128Public exploit6.3 Medium
- open-emr openemrSQL Injection Vulnerability in ajax graphs library (OpenEMR)CVE-2026-32127Public exploit8.8 High
- useplunk plunkPlunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/snsCVE-2026-32096Public exploit9.3 Critical
- r-project rR 3.4.4 Windows x64 Buffer Overflow SEH DEP ASLR BypassCVE-2019-25485Public exploit6.9 Medium
- jellyfin code-quality.yml, jellyfin +1 moreJellyfin Possible Organization/Secret Compromise from dangerous CI implementationCVE-2026-31852Public exploit10.0 Critical
- craftcms cms, craft cms +1 moreCraftCMS has an RCE vulnerability via relational conditionals in the control panelCVE-2026-31857Public exploitFix available8.1 High
- curluse after free in SMB connection reuseCVE-2026-3805Public exploitFix available7.5 High
- kohaAuthenticated SQL Injection in Koha displayby parameter of suggestion.plCVE-2026-31844Public exploit8.7 High
- unknown datalogics ecommerce deliveryDatalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege EscalationCVE-2026-2631Public exploit9.8 Critical
- elemntor ally – web accessibility & usabilityAlly – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL PathCVE-2026-2413Public exploit7.5 High
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthentication Bypass in Web Interface allows Unauthenticated Admin Password ResetCVE-2026-23813Public exploit9.8 Critical
- openclawA remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers...CVE-2026-30741Public exploit9.8 Critical
- No product listedEasy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP...CVE-2025-70330Public exploit3.3 Low
- lantronix eds5000, e210 series, e213f102s firmware +36 more +38 moreLantronix EDS5000, G520, and X300 OS Command InjectionCVE-2025-67038In KEVPublic exploitEPSS 21.1%9.3 Critical
- No product listedInsecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0...CVE-2025-66956Public exploit9.9 Critical
- sequelize, red hat confidential compute attestation, enterprise linux 10 +2 more +4 moreSequelize v6 Vulnerable to SQL Injection via JSON Column Cast TypeCVE-2026-30951Public exploitFix available7.5 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachmentCVE-2026-27825Public exploitFix availableEPSS 12.3%9.1 Critical
- adobe dng software development kit (sdk), dng software development kit +1 moreDNG SDK | Out-of-bounds Write (CWE-787)CVE-2026-27280Public exploitFix available7.8 High
- github enterprise serverImproper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write accessCVE-2026-3306Public exploit5.3 Medium
- github enterprise serverRemote code execution via git push option injection in GitHub Enterprise ServerCVE-2026-3854Public exploitEPSS 41.9%8.7 High
- microsoft azure mcp server, azure mcp server tools 1.0.0 (npm), azure mcp server tools 1.0.0 (nuget) +3 more +5 moreAzure MCP Server Tools Elevation of Privilege VulnerabilityCVE-2026-26118Public exploitFix available8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +27 more +29 moreWindows SMB Server Elevation of Privilege VulnerabilityCVE-2026-26128Public exploit7.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +2 moreMicrosoft SharePoint Server Remote Code Execution VulnerabilityCVE-2026-26114Public exploit8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +27 more +29 moreActive Directory Domain Services Elevation of Privilege VulnerabilityCVE-2026-25177Public exploit8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +19 more +21 moreWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2026-25172Public exploit8.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +27 more +29 moreWindows SMB Server Elevation of Privilege VulnerabilityCVE-2026-24294Public exploit7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +27 more +29 moreWindows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege VulnerabilityCVE-2026-24291Public exploit7.8 High
- studiocmsStudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of ServiceCVE-2026-30945Public exploitFix available7.1 High
- studiocmsStudioCMS Affected by Privilege Escalation via Insecure API Token GenerationCVE-2026-30944Public exploitFix available8.8 High
- fortinet forticlient, forticlientlinux +1 moreA UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through...CVE-2026-24018Public exploit7.4 High
- nextscripts nextscripts: social networks auto-posterNextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' ShortcodeCVE-2026-3228Public exploit6.4 Medium
- apache software foundation pdfbox examples, apache pdfbox-examples +1 moreApache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example CodeCVE-2026-23907Public exploitFix available5.3 Medium
- harttle liquidjsliquidjs has a path traversal fallback vulnerabilityCVE-2026-30952Public exploitFix available8.7 High
- pdfmakepdfmake is vulnerable to server-side request forgery (SSRF)CVE-2026-26801Public exploitFix available7.5 High
- appsmithCritical Stored XSS & Privilege Escalation in AppsmithCVE-2026-30862Public exploitFix available9.1 Critical
- isaacs node-tar, tar +1 morenode-tar Symlink Path Traversal via Drive-Relative LinkpathCVE-2026-31802Public exploitFix available8.2 High
- kubernetes ingress-nginxingress-nginx rewrite-target nginx configuration injectionCVE-2026-3288Public exploit8.8 High
- budibaseBudibase Universal Auth Bypass via Webhook Query Param InjectionCVE-2026-31816Public exploitEPSS 16.7%9.1 Critical
- openclawOpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin RedirectsCVE-2026-32913Public exploitFix available8.8 High
- linux, linux kernel +1 morexattr: switch to CLASS(fd)CVE-2024-14027Public exploitFix available5.5 Medium
- freebsdRemote code execution via ND6 Router AdvertisementsCVE-2025-14558Public exploit7.2 High
- apache apache-airflow-providers-amazon, apache software foundation airflow providers amazon +1 moreApache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication BypassCVE-2026-25604Public exploitFix available5.4 Medium
- apache airflow providers httpApache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperatorCVE-2025-69219Public exploitFix available8.8 High
- Show moreLoading…