Skip to contentVulnerabilities with public exploits
- lmsys sglangCVE-2026-5760CVE-2026-5760Public exploit9.8 Critical
- linux, linux kernel +1 morenet: skb: fix cross-cache free of KFENCE-allocated skb headCVE-2026-31429Public exploitFix available5.5 Medium
- asustor inc. adm, asustor data master +1 moreA command injection vulnerability was found in the PPTP VPN Clients on the ADMCVE-2026-6644Public exploit9.4 Critical
- asustor inc. adm, asustor data master +1 moreA stack-based buffer overflow vulnerability in the VPN Clients on the ADMCVE-2026-6643Public exploit8.6 High
- openbsdIn OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a...CVE-2026-41285Public exploit4.3 Medium
- rclone, red hat openshift api for data protection, advanced cluster management for kubernetes 2 +2 moreRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command executionCVE-2026-41179Public exploitFix available9.2 Critical
arduino UbuntuA stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0....CVE-2026-26399Public exploit5.3 Medium- No product listedA vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated...CVE-2025-66954Public exploit6.5 Medium
- editorconfig editorconfig-core-ceditorconfig-core-c has incomplete fix for CVE-2023-0341CVE-2026-40489Public exploitFix available8.6 High
- gitroom postiz, gitroomhq postiz-app +1 morePostiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSSCVE-2026-40487Public exploit8.9 High
- dagster-io dagsterDagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager IntegrationsCVE-2026-41490Public exploitFix available8.3 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on WindowsCVE-2026-35603Public exploitFix available5.4 Medium
- dolibarr, dolibarr erp\/crm +1 moreDolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configurationCVE-2026-23500Public exploit9.4 Critical
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist BypassCVE-2026-5718Public exploit8.1 High
- mobatek mobaxterm home editionMobatek MobaXterm Home Edition msimg32.dll uncontrolled search pathCVE-2026-6421Public exploit7.3 High
- No product listedA SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote...CVE-2026-37749Public exploit9.8 Critical
- No product listedSTProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged...CVE-2025-70795Public exploit5.5 Medium
- josdejong mathjs, red hat developer hub, enterprise linux 10 +5 more +7 moreMath.js: Unsafe object property setter in mathjsCVE-2026-40897Public exploitFix available8.8 High
- protobufjs project protobufjs, protobufjs protobuf.js, red hat cryostat 4 +20 more +22 moreprotobufjs has an arbitrary code execution issueCVE-2026-41242Public exploitFix available9.4 Critical
- dataeaseDataEase: Quartz Deserialization → Remote Code ExecutionCVE-2026-40901Public exploit7.5 High
- digital knowledge knowledgedeliverKnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey valueCVE-2026-5426Public exploit9.1 Critical
- jconti payment gateway for redsys & woocommerce litePayment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status ManipulationCVE-2026-5050Public exploit7.5 High
- asus driverhubAn Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub...CVE-2026-1880Public exploit5.4 Medium
- thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 moreImproper restriction of the scope of accessible objects in Thymeleaf expressionsCVE-2026-40477Known exploitedPublic exploitFix available9.1 Critical
- google chromeType Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...CVE-2026-6307Public exploitFix available8.8 High
- google chromeUse after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...CVE-2026-6300Public exploitFix available8.8 High
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Multiple Remote Code Execution VulnerabilityCVE-2026-20180Public exploit9.9 Critical
- lenovo diagnostics, hardware scan, vantage +2 moreDuring an internal security assessment, a potential vulnerability was discovered in Lenovo...CVE-2026-0827Public exploit6.9 Medium
- owen webstackWebStack <= 1.2024 - Unauthenticated Arbitrary File UploadCVE-2026-1555Public exploit9.8 Critical
- boidcmsBoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameterCVE-2026-39387Public exploit7.2 High
- openremoteOpenRemote is Vulnerable to Expression InjectionCVE-2026-39842Public exploitFix available10.0 Critical
- jellyfinJellyfin: Potential RCE via subtitle upload path traversal + .strm chainCVE-2026-35031Public exploit10.0 Critical
- docmostDocmost has cross-page attachment overwrite via flawed attachmentId overwrite validationCVE-2026-34213Public exploit5.4 Medium
- docmostDocmost page content has stored XSS via unsanitized attachment URLsCVE-2026-34212Public exploit5.4 Medium
- docmostDocmost's Public Share Search Exposes Metadata of Restricted ChildrenCVE-2026-33146Public exploit4.3 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS has OS Command Injection via export_all_certificates actionCVE-2026-35196Public exploit8.8 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata servicesCVE-2026-34160Public exploit8.6 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer actionCVE-2026-33715Public exploit7.2 High
- composer, red hat hardened images +1 moreComposer is vulnerable to Command Injection via Malicious Perforce RepositoryCVE-2026-40176Public exploitFix available7.8 High
- composer, red hat hardened images +1 moreComposer has Command Injection via Malicious Perforce ReferenceCVE-2026-40261Public exploitFix available8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Snipping Tool Spoofing VulnerabilityCVE-2026-33829Public exploit4.3 Medium
- microsoft internet key exchange (ike) service extensions, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows Internet Key Exchange (IKE) Service Extensions Remote Code Execution VulnerabilityCVE-2026-33824In KEVPublic exploitEPSS 77.4%9.8 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows TCP/IP Remote Code Execution VulnerabilityCVE-2026-33827Public exploit8.1 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing VulnerabilityCVE-2026-32201In KEVPublic exploitEPSS 44.0%6.5 Medium
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +10 more +12 moreWindows Kerberos Elevation of Privilege VulnerabilityCVE-2026-27912Public exploit8.0 High
- microsoft windows server 2012 r2, windows server 2012 r2 (server core installation), windows server 2016 +9 more +11 moreWindows Active Directory Remote Code Execution VulnerabilityCVE-2026-33826Public exploit8.0 High
- microsoft defender, defender antimalware platform +1 moreMicrosoft Defender Elevation of Privilege VulnerabilityCVE-2026-33825In KEVPublic exploit7.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows USB Printing Stack (usbprint.sys) Elevation of Privilege VulnerabilityCVE-2026-32223Public exploit6.8 Medium
- microsoft windows, windows 10 version 1607, windows 10 version 1809 +26 more +28 moreWindows Shell Spoofing VulnerabilityCVE-2026-32202In KEVPublic exploitFix availableEPSS 71.3%4.3 Medium
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +9 more +11 moreWindows Kernel Elevation of Privilege VulnerabilityCVE-2026-26179Public exploit7.8 High
- Show moreLoading…