Skip to contentVulnerabilities with public exploits
- opennebulaA cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10...CVE-2025-56534Public exploit6.1 Medium
- neorazorx facturascriptsFacturaScripts unauthorized modification of immutable nick field via EditUser controllerCVE-2026-32699Public exploit5.3 Medium
- nsa grassmarlinNSA GRASSMARLIN Improper Restriction of XML External Entity ReferenceCVE-2026-6807Public exploit5.5 Medium
- opencatsOpenCATS PHP Code Injection via installer AJAX endpointCVE-2026-27760Public exploitEPSS 33.0%9.2 Critical
- code-projects coaching management systemcode-projects Coaching Management System POST reply.php sql injectionCVE-2026-7229Public exploit5.3 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injectionCVE-2026-7228Public exploit6.9 Medium
- code-projects coaching management systemcode-projects Coaching Management System Complaint Form complaint.php cross site scriptingCVE-2026-7222Public exploit5.1 Medium
- proftpdmod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a...CVE-2026-42167Public exploitFix available8.1 High
- No product listedA reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1...CVE-2026-37750Public exploit6.1 Medium
openjdk-13 Ubuntu, openjdk-16 Ubuntu, openjdk-18 Ubuntu +2 more +4 more[updated libpng in Oracle Java]CVE-2026-22020Public exploitNo score- No product listedThe Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12...CVE-2025-67223Public exploit7.5 High
- amd epyc™ 7001 series processors, epyc™ embedded 3000 series processors +1 moreA transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to...CVE-2025-54505Public exploitFix available2.0 Low
- projeqtorProjeQtor < 12.4.4 Unauthenticated SQL Injection via LoginCVE-2026-41462Public exploit9.3 Critical
- apache camel, red hat build of apache camel for spring boot 4, fuse 7 +2 more +4 moreApache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV storeCVE-2026-27172Public exploitFix available8.8 High
- apache camel, red hat build of apache camel 4.18.1 for spring boot 3.5.14, fuse 7 +2 more +4 moreApache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code ExecutionCVE-2026-33453Public exploitFix available10.0 Critical
- apache camel, red hat build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +8 more +10 moreApache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)CVE-2026-33454Public exploitFix available9.4 Critical
- apache camel, apache software foundation camel platform http main, red hat openshift serverless +7 more +9 moreApache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtimeCVE-2026-40022Public exploitFix available8.2 High
- apache camel, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +4 more +6 moreApache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation RepositoryCVE-2026-40858Public exploitFix available8.8 High
- apache camel, apache software foundation camel coap, camel google pubsub +10 more +12 moreApache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows ca…CVE-2026-40453Public exploitFix available9.9 Critical
- apache camel, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +4 more +6 moreApache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqpCVE-2026-40860Public exploitFix available9.8 Critical
- apache camel, apache software foundation camel pqc, red hat build of apache camel for spring boot 4 +2 moreApache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManagerCVE-2026-40048Public exploitFix available7.8 High
- apache camel, apache software foundation camel mina, red hat build of apache camel for spring boot 4 +1 more +3 moreApache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDPCVE-2026-40473Public exploitFix available8.8 High
- notepad++Vulnerability in Notepad++CVE-2026-3008Public exploit6.6 Medium
- code-projects home service systemcode-projects Home Service System Appointment Booking booking.php cross site scriptingCVE-2026-7089Public exploit5.3 Medium
- codeastro online job portalCodeAstro Online Job Portal user-cvs file information disclosureCVE-2026-7071Public exploit6.9 Medium
- code-projects inventory management systemcode-projects Inventory Management System Login sql injectionCVE-2026-7070Public exploit6.9 Medium
- No product listedCross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before...CVE-2026-38934Public exploit8.8 High
- No product listedA reflected cross-site scripting (XSS) vulnerability exists in WebFileSys version 2.31.1. User...CVE-2026-29971Public exploit6.1 Medium
- andybalholm brotli, 7-zip p7zip, anthropic bun +100 more +102 moreOut-of-Bounds Write in Google Brotli DecoderCVE-2026-111497In KEVPublic exploitFix availableEPSS 82.6%9.2 Critical
- No product listedAn issue in Pro-Bit before v1.77.4 allows unauthenticated attackers to directly access sensitive directory and its subdirectories.CVE-2025-69428Public exploit7.5 High
- No product listedNASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the category parameterCVE-2024-46636Public exploit9.4 Critical
- codeastro online job portalCodeAstro Online Job Portal All Jobs delete-jobs.php sql injectionCVE-2026-7028Public exploit5.1 Medium
- ollamaOllama Tensor Model Transfer transfer.go digestToPath path traversalCVE-2026-7020Public exploit6.3 Medium
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +5 more +7 moreLiteLLM: Authenticated command execution via MCP stdio test endpointsCVE-2026-42271In KEVPublic exploitFix availableEPSS 91.4%8.7 High
- linksys mr9600, mr9600 firmware +1 moreLinksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injectionCVE-2026-6992Public exploit8.6 High
- simple-git project simple-git, red hat enterprise linux 8, enterprise linux 9 +3 more +5 moresimple-git is vulnerable to Remote Code ExecutionCVE-2026-6951Public exploitFix available9.2 Critical
- cyberpanelCyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner EndpointsCVE-2026-41473Public exploit8.8 High
- cyberpanelCyberPanel < 2.4.5 Stored XSS via AI Scanner DashboardCVE-2026-41472Public exploit5.3 Medium
- skim-rs skimSkim: Arbitrary code execution via pull_request_target fork checkout in pr.ymlCVE-2026-41414Public exploitFix available7.4 High
- berriai litellm, red hat lightspeed core, ansible automation platform 2 +1 more +3 moreLiteLLM: SQL injection in Proxy API key verificationCVE-2026-42208In KEVPublic exploitFix availableEPSS 89.4%9.3 Critical
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreLiteLLM: Server-Side Template Injection in /prompts/test endpointCVE-2026-42203Public exploitFix available8.6 High
- linux, linux kernel +1 morerxrpc: fix oversized RESPONSE authenticator length checkCVE-2026-31635Public exploitFix available7.5 High
- perforce helix core server (p4d)Insecure Default Configuration in P4 ServerCVE-2026-6043Public exploit8.8 High
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by JolokiaCVE-2026-41044Public exploitFix available8.8 High
- trustedfirmware op-tee, op-tee optee os +1 moreOP-TEE: PKCS#11 TA out-of-bounds read and memory disclosureCVE-2026-33317Public exploit8.7 High
- lightspeed classroomA client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated...CVE-2026-30368Public exploit5.4 Medium
- th30d4y openlearnxOpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution EnvironmentCVE-2026-41900Public exploitFix available8.8 High
- tungsten automation capture (formerly kofax capture)Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET RemotingCVE-2026-23751Public exploit9.3 Critical
- funnelforms llc funnelformsproWordPress FunnelFormsPro plugin <= 3.8.1 - Remote Code Execution (RCE) vulnerabilityCVE-2026-39440Public exploit9.9 Critical
- unknown ht mega addons for elementorHT Mega < 3.0.7 – Unauthenticated PII DisclosureCVE-2026-4106Public exploit5.3 Medium
- Show moreLoading…