Skip to contentVulnerabilities with public exploits
- No product listedAn issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the ...CVE-2025-67888Public exploit7.3 High
- No product listed1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE...CVE-2025-67887Public exploit9.8 Critical
- No product listedBitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE...CVE-2025-67886Public exploitDisputed6.3 Medium
- No product listedLINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad...CVE-2024-53326Public exploit7.3 High
- yeti-platform yetiA SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server.CVE-2024-46507Public exploit7.3 High
- No product listedA Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows...CVE-2024-45257Public exploit7.3 High
- No product listedSOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with...CVE-2024-33722Public exploit6.3 Medium
- No product listed/cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to...CVE-2024-30167Public exploit6.3 Medium
- No product listedMikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a...CVE-2024-27686Public exploit7.5 High
- prusa3d prusaslicerIn libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project...CVE-2023-47268Public exploit5.3 Medium
- microsoft azure devopsAzure DevOps Information Disclosure VulnerabilityCVE-2026-42826Public exploit10.0 Critical
- neorazorx facturascriptsFacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product ImagesCVE-2026-42879Public exploit6.3 Medium
- alam00000 bentopdfBentoPDF: Stored XSS via Markdown Editor Leading to Persistent File ExfiltrationCVE-2026-41653Public exploit7.0 High
- mispMISP core - Stored XSS in MISP template (old engine) element attribute typeCVE-2026-8080Public exploit6.8 Medium
- phpXSS within PHP-FPM status endpointCVE-2026-6735Public exploitFix available7.3 High
- tubitak bilgem software technologies research institute liderahenkRCE in TUBITAK BILGEM's LiderahenkCVE-2026-6508Public exploit9.8 Critical
- spring cloud config, vmware spring cloud config, red hat enterprise linux 8 +1 more +3 moreSpring Cloud Config vulnerable to Path TraversalCVE-2026-40982Public exploitFix available9.1 Critical
- zte zx297520v3 bootrom, zx297520v3 firmware +1 moreUSB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROMCVE-2026-40003Public exploit5.1 Medium
- gotenbergGotenberg: Unauthenticated RCE via ExifTool Metadata Key InjectionCVE-2026-42589Public exploit9.8 Critical
krayin/laravel-crm PackagistWebkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpointCVE-2026-36341Public exploitFix available5.4 Medium- nearform fast-jwtfast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypassCVE-2026-44351Public exploitFix available9.1 Critical
- dedoc scrambleScramble: Remote code execution via evaluation of user-controlled input in validation rulesCVE-2026-44262Public exploitFix available9.4 Critical
- palo alto networks cloud ngfw, pan-os, prisma access +2 more +4 morePAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication PortalCVE-2026-0300In KEVPublic exploitEPSS 41.7%9.3 Critical
- google chromeOut of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote...CVE-2026-7899Public exploitFix available8.8 High
- craftcms cmsCraft CMS: Potential authenticated Remote Code Execution via malicious attached BehaviorCVE-2026-44011Public exploitFix available8.6 High
- cisco iot field network director, iot field network director (iot-fnd) +1 moreCisco IoT Field Network Director Command Injection VulnerabilityCVE-2026-20169Public exploit6.4 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreeventpoll: defer struct eventpoll free to RCU grace periodCVE-2026-43074Public exploitFix available7.8 High
- No product listedCross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute...CVE-2026-36358Public exploit5.4 Medium
- No product listedSensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6...CVE-2026-34474Public exploitEPSS 24.7%7.5 High
- No product listedUnauthenticated DoS in ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X,...CVE-2026-34473Public exploit7.5 High
- getgrav gravGrav: Privilege Escalation via Missing Server-Side Validation of groups/accessCVE-2026-42613Public exploitFix available9.4 Critical
- getgrav gravGrav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install FeatureCVE-2026-42607Public exploitFix available9.1 Critical
- pocketbasePocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgradeCVE-2026-44166Public exploitFix available6.1 Medium
- magicmirrorMagicMirror²: Unauthenticated SSRF via /cors endpointCVE-2026-42281Public exploitFix available9.2 Critical
- photostructure exiftool-vendored.jsexiftool-vendored: Argument injection via newline characters in tag namesCVE-2026-43893Public exploitFix available8.2 High
- citeum openctiOpenCTI privilege escalation and unauthenticated access via default admin accountCVE-2026-27960Public exploitFix available9.8 Critical
- langflowLangflow: Path Traversal in Langflow Knowledge Bases APICVE-2026-42048Public exploitFix available9.6 Critical
- jupyter jupyterhubJupyterHub: Cross-origin form POSTs bypass XSRFCVE-2026-40864Public exploitFix available5.4 Medium
- jupyter server, jupyter-server jupyter server, red hat migration toolkit for applications 8.2 +2 more +4 morejupyter-server path traversal allows access to sibling directories sharing root_dir name prefixCVE-2026-35397Public exploitFix available7.6 High
- redis, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 moreredis-server RESTORE invalid memory access may allow remote code executionCVE-2026-25243Public exploitFix available7.7 High
- redis, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 moreredis-server Lua use-after-free may allow remote code executionCVE-2026-23631Public exploitFix available6.1 Medium
- redis, red hat enterprise linux 10, enterprise linux 10.0 extended update support +4 more +6 moreredis-server use-after-free in unblock client flow may allow remote code executionCVE-2026-23479Public exploitFix available7.7 High
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'CVE-2026-3359Public exploit7.5 High
- ahmadgb geekybot — ai copilot, chatbot, woocommerce lead gen & zero-prompt contentGeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'CVE-2026-3456Public exploit7.5 High
- No product listedThe GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD...CVE-2026-36356Public exploitEPSS 20.3%9.1 Critical
- No product listedThe rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through...CVE-2026-36355Public exploit7.7 High
- @turbo workspacesLocal Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight AgentCVE-2026-7791Public exploit8.5 High
- phpvmsphpvms: /importer authorization bypass causing full database wipeCVE-2026-42569Public exploitFix available9.4 Critical
- thymeleafThymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressionsCVE-2026-41901Known exploitedPublic exploitFix available9.0 Critical
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin ClaimCVE-2026-42221Public exploitFix available8.1 High
- Show moreLoading…