Skip to contentVulnerabilities with public exploits
- ubiquiti inc unifi network applicationA malicious actor with access to the network could exploit a Path Traversal vulnerability found...CVE-2026-22557Public exploitEPSS 29.0%10.0 Critical
- bmc footprintsBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication BypassCVE-2025-71257Public exploitEPSS 44.2%6.9 Medium
- tomwright daselDasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of serviceCVE-2026-33320Public exploitFix available6.2 Medium
- rymera web co pty ltd. woocommerce wholesale lead captureWordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerabilityCVE-2026-27540Public exploit9.0 Critical
- rymera web co pty ltd. woocommerce wholesale lead captureWordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerabilityCVE-2026-27542Public exploit9.8 Critical
- gnu ncurses, siemens ruggedcom rst2428p +1 morencurses v6.5 and v6.4 are vulnerable to Buffer Overflow in progs/infocmp.c, function...CVE-2025-69720Public exploitFix available7.3 High
- px4 px4-autopilot, dronecode px4 drone autopilot +1 morePX4 Autopilot: Stack-based Buffer Overflow via Oversized Path Input in MAVLink Log Request HandlingCVE-2026-32743Public exploit6.5 Medium
- kanKan is Vulnerable to Unauthenticated SSRF via Attachment Download EndpointCVE-2026-32255Public exploitEPSS 28.5%8.6 High
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data ExfiltrationCVE-2026-32321Public exploit8.8 High
- grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 moregRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186Public exploitFix available9.1 Critical
- dynaconfdynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja ResolverCVE-2026-33154Public exploitFix available7.5 High
- mesop-dev mesopMesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-pyCVE-2026-33057Public exploitFix available9.8 Critical
- apostrophecms import-exportApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip ExtractionCVE-2026-32731Public exploitFix available10.0 Critical
- b3log siyuanSiYuan has Stored XSS to RCE via Unsanitized Bazaar Package MetadataCVE-2026-33067Public exploitFix available5.3 Medium
- iqonicdesign kivicare – clinic & patient management system (ehr)KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login TokenCVE-2026-2991Public exploit7.3 High
- vmware spring aiCVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverterCVE-2026-22730Public exploitFix available8.8 High
- No product listedA Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of...CVE-2026-30695Public exploit6.1 Medium
- No product listedA zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows...CVE-2026-30345Public exploit7.5 High
@developer.notchatbot/webchat npmNotChatbot WebChat has a stored cross-site scripting (XSS) vulnerabilityCVE-2026-30048Public exploit5.4 Medium- apple ipados, macos, safari +3 more +5 moreA cross-origin issue in the Navigation API was addressed with improved input validation. This...CVE-2026-20643Public exploitFix available5.4 Medium
- langflowLangflow has Unauthenticated Remote Code Execution via Public Flow Build EndpointCVE-2026-33017In KEVPublic exploitFix availableEPSS 96.4%9.3 Critical
- bishopfox sliverSliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard TransportsCVE-2026-32941Public exploit5.7 Medium
- wazuhWazuh Cluster vulnerable to Remote Code Execution via Insecure DeserializationCVE-2026-25769Public exploit9.1 Critical
- agentejo cockpitCockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()CVE-2026-31891Public exploitFix available7.7 High
- canonical ubuntu 16.04 lts, ubuntu 18.04 lts, ubuntu 20.04 lts +3 more +5 moreLocal Privilege Escalation in snapdCVE-2026-3888Public exploitFix available7.8 High
- github.com/jackc/pgproto3/v2, jackc pgproto3, red hat assisted installer for red hat openshift container platform 2 +26 more +28 moreDenial of service in github.com/jackc/pgproto3/v2CVE-2026-32286Public exploitFix available7.5 High
- pluginsglpi fieldsFields GLPI plugin vulnerable to RCE in dropdown generationCVE-2026-23489Public exploit9.1 Critical
- tenda ac8, ac8 firmware +1 moreTenda AC8 Web UploadCfg route_set_user_policy_rule os command injectionCVE-2026-4253Public exploit5.1 Medium
- bloomberg memrayMemray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadataCVE-2026-32722Public exploitFix available3.6 Low
- lxc incus-osIncusOS has a LUKS encryption bypass due to insufficient TPM policyCVE-2026-32606Public exploitFix available7.7 High
- mattermost, mattermost server +1 moreMissing authorization check allows unauthorized modification of other users' comments on a boardCVE-2026-2461Public exploitFix available4.3 Medium
- thermalright tr-vision homeDLL Injection Privilege EscalationCVE-2026-4255Public exploit8.4 High
- samsung smart switchPath traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite...CVE-2026-21005Public exploit7.1 High
- samsung smart switchImproper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to...CVE-2026-21004Public exploit6.9 Medium
- samsung galaxy storeImproper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows...CVE-2026-21002Public exploit5.9 Medium
- samsung galaxy storePath traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file...CVE-2026-21001Public exploit5.9 Medium
- No product listedAn Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8....CVE-2025-69727Public exploit5.3 Medium
- No product listedIn Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a...CVE-2025-68971Public exploit6.5 Medium
- No product listedThe `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is...CVE-2025-50881Public exploit8.8 High
- tp link systems inc. tl-wr840n v6, tp-link systems inc. tl-wr802n v4, tl-wr841n v14 +3 more +5 moreAuthenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840NCVE-2026-3227Public exploit8.5 High
- dronecode px4 drone autopilot, px4 px4-autopilot +1 morePX4 autopilot has a stack buffer overflow in tattu_can due to unbounded memcpy in frame assembly loopCVE-2026-32707Public exploit5.2 Medium
- @angular compiler, core, angular cli +2 moreAngular has XSS in i18n attribute bindingsCVE-2026-32635Public exploitFix available8.6 High
- @apollo gateway, federation-internals, query-planner +2 moreApollo Federation has prototype pollution via incomplete key sanitizationCVE-2026-32621Public exploitFix available9.9 Critical
- fit2cloud jumpserverJumpServer has a Server-Side Template Injection Leading to RCE via YAML RenderingCVE-2026-31864Public exploit6.8 Medium
- courtbouillon cairosvgCairoSVG vulnerable to Exponential DoS via recursive <use> element amplificationCVE-2026-31899Public exploitFix available7.5 High
- gnu inetutilstelnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local...CVE-2026-32746Public exploitFix availableEPSS 45.3%9.8 Critical
- tp-link omada sg2005p-pd firmware, omada sg2008 firmware, omada sg2008p firmware +98 more +100 moreInput Validation Vulnerability on Multiple Omada SwitchesCVE-2026-1668Public exploit7.7 High
- apache livyApache Livy: Restrict file accessCVE-2025-60012Public exploitFix available6.3 Medium
- apache livyApache Livy: Unauthorized directory accessCVE-2025-66249Public exploitFix available6.3 Medium
- linknacional pix for woocommercePix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File UploadCVE-2026-3891Public exploitEPSS 34.3%9.8 Critical
- Show moreLoading…