Skip to contentVulnerabilities with public exploits
- provectus kafka-ui, ui +1 moreprovectus kafka-ui Endpoint testexecutions validateAccess code injectionCVE-2026-5562Public exploit6.9 Medium
- badlogic pi-monobadlogic pi-mono loader.ts discoverAndLoadExtensions code injectionCVE-2026-5556Public exploit5.3 Medium
- code-projects concert ticket reservation systemcode-projects Concert Ticket Reservation System Parameter login.php sql injectionCVE-2026-5555Public exploit6.9 Medium
- ollamaOllama Model Pull API download.go server-side request forgeryCVE-2026-5530Public exploit5.3 Medium
- roxnor elementskit elementor addons – advanced widgets & templates addons for elementorElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab WidgetCVE-2026-2600Public exploit6.4 Medium
- apeworx web3.pyweb3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handlingCVE-2026-40072Public exploitFix available1.7 Low
- fortinet forticlientems, forticlient ems +1 moreA improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow...CVE-2026-35616In KEVPublic exploitEPSS 94.0%9.1 Critical
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +3 more +5 moreLiteLLM has an authentication bypass via OIDC userinfo cache key collisionCVE-2026-35030Public exploitFix available9.4 Critical
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +3 more +5 moreLiteLLM affected by privilege escalation via unrestricted proxy configuration endpointCVE-2026-35029Public exploitFix availableEPSS 38.6%8.7 High
- vllmvLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url `CVE-2026-34753Public exploitFix available5.4 Medium
- infiniflow ragflowRAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" ComponentCVE-2026-28797Public exploit8.7 High
- lexiforest curl cffiRedirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)CVE-2026-33752Public exploitFix available8.6 High
- openprinting cupsOpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the networkCVE-2026-34980Public exploitFix available6.1 Medium
- openprinting cupsOpenPrinting CUPS: Local print admin token disclosure using temporary printersCVE-2026-34990Public exploitFix available5.0 Medium
- gardyn mobile application, cloud api +1 moreGardyn Mobile Application and Device Firmware Use Hard-coded CredentialsCVE-2025-10681Public exploit8.8 High
- gardyn cloud apiGardyn Cloud API Authorization Bypass Through User-Controlled KeyCVE-2026-25197Public exploit9.3 Critical
- gardyn cloud apiGardyn Cloud API Missing Authentication for Critical FunctionCVE-2026-28766Public exploit9.2 Critical
- gardyn cloud apiGardyn Cloud API Missing Authentication for Critical FunctionCVE-2026-28767Public exploit6.9 Medium
- gardyn cloud apiGardyn Cloud API Missing Authentication for Critical FunctionCVE-2026-32646Public exploit8.7 High
- gardyn cloud apiGardyn Cloud API Active Debug CodeCVE-2026-32662Public exploit6.9 Medium
- linux, linux kernel, red hat enterprise linux 10 +22 more +24 morenfsd: fix heap overflow in NFSv4.0 LOCK replay cacheCVE-2026-31402Public exploitFix available9.8 Critical
- perfmattersPerfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' ParameterCVE-2026-4350Public exploit8.1 High
- ech0Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadataCVE-2026-35037Public exploitFix available7.2 High
- intermesh group-office, groupoffice +1 moreGroup-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`CVE-2026-34838Public exploit10.0 Critical
- openprojectOpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_stringCVE-2026-34717Public exploit9.9 Critical
- rackRack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.CVE-2026-34835Public exploitFix available4.8 Medium
- openbsd opensshOpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios...CVE-2026-35414Public exploitFix available4.2 Medium
- progress sharefile storage zones controllerEAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)CVE-2026-2699Public exploitEPSS 58.4%9.8 Critical
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flawCVE-2026-4282Public exploitFix available7.4 High
- linux, linux kernel +1 moremm/mseal: update VMA end correctly on mergeCVE-2026-23416Public exploitFix available5.5 Medium
- linux, linux kernel +1 morefutex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()CVE-2026-23415Public exploitFix available7.8 High
- No product listedA Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows...CVE-2026-30332Public exploit7.5 High
- interzen zencrm, zenhr, zenproject +1 more +3 moreMultiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of...CVE-2026-30252Public exploit6.1 Medium
- interzen zenshare suiteA reflected cross-site scripting (XSS) vulnerability in the login_newpwd.php endpoint of Interzen...CVE-2026-30251Public exploit6.1 Medium
- percona monitoring and managementAn issue was discovered in Percona PMM before 3.7. Because an internal database user retains...CVE-2026-25212Public exploit9.9 Critical
- knadh listmonklistmonk: Active sessions remain valid after password reset and password changeCVE-2026-34828Public exploitFix available7.1 High
- kubeaiKubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model podsCVE-2026-34940Public exploitFix available8.7 High
- devcode openstamanagerOpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2CVE-2026-29782Public exploitFix available7.2 High
- ggml llama.cppllama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backendCVE-2026-34159Public exploitFix available9.8 Critical
- metinfo, metinfo cms cms +1 moreMetInfo CMS Unauthenticated PHP Code Injection RCECVE-2026-29014Public exploitEPSS 39.5%9.3 Critical
- google chrome, dawn +1 moreUse after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had...CVE-2026-5281In KEVPublic exploitFix availableEPSS 13.7%8.8 High
- No product listedMultiple stored cross-site scripting (XSS) vulnerabilities in the submit_add_user.asp endpoint of...CVE-2026-29598Public exploit5.4 Medium
- google androidIn onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service...CVE-2026-0049Public exploitFix available6.2 Medium
- openclawOpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval CommandsCVE-2026-41303Public exploitFix available8.7 High
- lodash, lodash lodash-amd, lodash-es +105 more +107 morelodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800Public exploitFix available8.1 High
- cmsmadesimple cms made simpleCMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversalCVE-2026-5203Public exploit5.1 Medium
- bishopfox sliverSliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP InterfaceCVE-2026-34227Public exploitFix available5.9 Medium
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreCommand Injection in mlflow/mlflowCVE-2026-0596Public exploitFix available9.6 Critical
- openclawOpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair ApprovalCVE-2026-33579Public exploitFix available9.4 Critical
- nhost cli, nhost +1 moreNhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network PortCVE-2026-34200Public exploit7.7 High
- Show moreLoading…