Skip to contentVulnerabilities with public exploits
- themeum kirki – freeform page builder, website builder & customizerKirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'CVE-2026-8206Public exploit9.8 Critical
- qualcomm ar8031 firmware, ar8035 firmware, cologne firmware +215 more +217 moreMissing Authentication for Critical Function in HLOSCVE-2026-24090Public exploitFix available7.1 High
- qualcomm ar9380 firmware, csr8811 firmware, fastconnect 6200 firmware +244 more +246 moreMissing Authentication for Critical Function in BootCVE-2026-24088Public exploitFix available8.2 High
- code-projects hotel and tourism reservation systemcode-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injectionCVE-2026-10290Public exploit6.9 Medium
- code-projects hotel and tourism reservation systemcode-projects Hotel and Tourism Reservation System tour.php cross site scriptingCVE-2026-10289Public exploit5.3 Medium
- code-projects hotel and tourism reservation systemcode-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authenticationCVE-2026-10288Public exploit6.9 Medium
- thorvgThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed inputCVE-2026-45729Public exploitFix available4.3 Medium
- vitejs launch-editor, vite, red hat cluster observability operator 1.5.0 +25 more +27 morelaunch-editor vulnerable to command injection via the crafted request on WindowsCVE-2024-52011Public exploitFix available7.5 High
- kiteworks security-advisoriesNextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDCCVE-2026-45156Public exploit8.1 High
- linux, linux kernel, red hat nvidia for rhel 10 +26 more +28 moresmb: client: reject userspace cifs.spnego descriptionsCVE-2026-46243Public exploitFix available7.1 High
- cloudpirates-io helm-chartsCloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requestsCVE-2026-45131Public exploit10.0 Critical
- cloudpirates-io helm-chartsCloudPirates Open Source Helm Charts: GitHub Actions workflow leaks PAT and SSH signing key via unsafe credential handlingCVE-2026-45132Public exploit10.0 Critical
- hp inc. poly trio 8300, poly trio 8500, poly trio 8800 +1 more +3 morePoly Voice – Possible Remote Control of Certain Poly DevicesCVE-2026-0826Public exploitEPSS 32.2%9.2 Critical
- gravity forms forms, rocketgenius inc. gravity forms +1 moreWordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerabilityCVE-2026-48866Public exploit9.6 Critical
- vitest-dev vitestVitest: Arbitrary file can be read and executed when Vitest UI server is listeningCVE-2026-47429Public exploitFix available9.8 Critical
- cure53 dompurifyDOMPurify XSS via `selectedcontent` re-cloneCVE-2026-47423Public exploitFix available8.2 High
- code-projects smart parking systemcode-projects Smart Parking System Admin Endpoint missing authenticationCVE-2026-10243Public exploit6.9 Medium
- apache solrApache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure usersCVE-2026-44825Public exploitFix available8.1 High
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnectorCVE-2026-42588Public exploitFix available8.1 High
- otrs, otrs ag ((otrs)) community edition +1 moreSQL Injection via MySQL Quote MethodCVE-2026-48188Public exploitFix available9.1 Critical
- otrs, otrs ag ((otrs)) community edition +1 moreDenial-of-Service via SVG Rendering in TicketCVE-2026-48208Public exploit6.5 Medium
- google androidIn multiple locations, there is a possible way to execute code in the launcher process due to an...CVE-2026-0091Public exploitFix available7.8 High
- google androidIn multiple functions, there is a possible way to access the contacts database due to a SQL...CVE-2026-0075Public exploitFix available7.8 High
- google androidIn multiple locations, there is a possible tapjacking due to a logic error in the code. This...CVE-2026-0009Public exploitFix available7.8 High
- android framework, google android +1 moreIn multiple locations, there is a possible way to achieve code execution due to an integer...CVE-2025-48595In KEVPublic exploitFix available8.4 High
- totolink n300rhTotolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflowCVE-2026-10187Public exploit9.3 Critical
- code-projects visitor management systemcode-projects Visitor Management System phone_0.php sql injectionCVE-2026-10170Public exploit5.3 Medium
- linux, linux kernel +1 moreeventpoll: fix ep_remove struct eventpoll / struct file UAFCVE-2026-46242Public exploitFix available7.8 High
- brainstormforce spectra gutenberg blocks – website builder for the block editorSpectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block AttributesCVE-2026-7465Public exploit8.8 High
- eskapism simple history – track, log, and audit wordpress changesSimple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction EndpointCVE-2026-7459Public exploit7.5 High
- code-projects student details management systemcode-projects Student Details Management System index.php sql injectionCVE-2026-10110Public exploit6.9 Medium
- home-assistant home assistant coreHome Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restoreCVE-2026-64824Public exploit9.3 Critical
mautic/core PackagistMautic has Stored Cross-Site Scripting (XSS) in Project Option SelectorCVE-2026-9811Public exploitFix available5.4 Mediummautic/core PackagistMautic has Stored Cross-Site Scripting (XSS) in Projects ComponentCVE-2026-9809Public exploitFix available7.6 Highmautic/core PackagistMautic has Server-Side Template Injection (SSTI) in Theme TemplatesCVE-2026-9558Public exploitFix available9.9 Critical- linkwhspr link whisper freeLink Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site ScriptingCVE-2025-11262Public exploit7.2 High
- flippercode wp maps proWP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX ActionCVE-2026-8732Public exploitEPSS 20.4%9.8 Critical
- No product listedFalco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the...CVE-2026-39292Public exploit7.3 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' ParameterCVE-2026-8809Public exploit9.8 Critical
- google chromeInappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a...CVE-2026-9999Public exploitFix available8.8 High
- google chromeInteger overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who...CVE-2026-9998Public exploitFix available8.3 High
- google chromeUse after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who...CVE-2026-9997Public exploitFix available8.3 High
- google chromeOut of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to...CVE-2026-9973Public exploitFix available8.8 High
- scadabrScadaBR Authenticated Remote Code ExecutionCVE-2026-9645Public exploit9.9 Critical
- oracle e-business suite, oracle corporation payments +1 moreVulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File...CVE-2026-46817In KEVPublic exploitEPSS 12.3%9.8 Critical
- casdoorCVE-2026-9090CVE-2026-9090Public exploit9.1 Critical
- tp-link archer c64 firmware, tp-link systems inc. archer c64 v1.0 +1 moreImproper Authentication Rate Limiting on TP-Link's Archer C64CVE-2026-8697Public exploit8.7 High
- tiny tinymceTinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injectionCVE-2026-47761Public exploitFix available8.7 High
- linux, linux kernel +1 moredrm: Set old handle to NULL before prime swap in change_handleCVE-2026-46215Public exploitFix available7.8 High
- peachpay — payments & express checkout for woocommerce (supports stripe, paypal, square, authorize.net, nmi)PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe UnlinkCVE-2026-9618Public exploit4.3 Medium
- Show moreLoading…