Skip to contentVulnerabilities with public exploits
- tp link systems inc. archer ax17 v1, tp-link systems inc. archer ax12 v1, archer ax1300 v1.6 +1 more +3 moreCommand Injection Vulnerability in OpenVPN on Multiple TP-Link Archer RoutersCVE-2026-9151Public exploit8.5 High
- makeplane planePlane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspacesCVE-2026-46558Public exploit8.3 High
- nomachinePotential local privileges escalation through argument injection in the nxchmod.sh scriptCVE-2026-53694Public exploit7.3 High
- jenkins, red hat openshift developer tools and services 4.12, openshift developer tools and services 4.13 +9 more +11 moreJenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonationCVE-2026-53435Public exploitFix availableEPSS 51.2%8.8 High
- image-sizeimage-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF ParserCVE-2025-71329Public exploitFix available8.7 High
- unknown wpzoom portfolio, wpzoom portfolio +1 moreWordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-49069Public exploit7.1 High
- amentotech doctreat coreDoctreat Core <= 1.6.8 - Unauthenticated Privilege EscalationCVE-2025-6254Public exploit9.8 Critical
- dahua ipc/sd/nvr/xvr/evs/vto/vth/asi/tpcA vulnerability has been found in some Dahua products could
allow an unauthenticated remote...CVE-2026-29116Public exploit8.7 High
- dahua ipc/sdA vulnerability has been found in some Dahua products could allow an authenticated remote...CVE-2026-29115Public exploit6.9 Medium
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media UploadCVE-2026-9067Public exploit9.1 Critical
- 8theme xstoreXStore < 9.7.3 - Unauthenticated SQLiCVE-2026-3326Public exploit8.6 High
- dahua ipcA vulnerability has been found in some Dahua products. An attacker
may obtain the device’s CA...CVE-2026-29114Public exploit2.3 Low
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 8 +7 more +9 moreAnsible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chownCVE-2026-11837Public exploitFix available7.3 High
- qnap systems inc. qts, quts hero, qutscloud +2 moreQTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)CVE-2025-59382Public exploit1.2 Low
- spring data rest, vmware spring data rest +1 moreSpring Data REST SpEL Injection via Map Key in JSON PatchCVE-2026-41729Public exploitFix available8.1 High
- veeam backup and replicationA vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated...CVE-2026-44963Public exploit9.4 Critical
- pheditorPheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)CVE-2026-48030Public exploitFix available9.9 Critical
- frankverbeke openclinic gaOpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload HandlerCVE-2026-25860Public exploit5.3 Medium
- bankpro e-service technology service center, baramundi management suite, blancco uk whitecanyon wipedrive +10 more +12 moreCVE-2026-8863CVE-2026-8863Public exploit7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Push Notifications Elevation of Privilege VulnerabilityCVE-2026-42978Public exploit7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreNT OS Kernel Elevation of Privilege VulnerabilityCVE-2026-42980Public exploit7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +23 more +25 moreWindows BitLocker Security Feature Bypass VulnerabilityCVE-2026-50507Public exploit6.8 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreHTTP.sys Denial of Service VulnerabilityCVE-2026-49160Public exploitEPSS 56.6%7.5 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Elevation of Privilege VulnerabilityCVE-2026-45504Public exploit8.8 High
- fortinet fortisandbox, fortisandbox cloud, fortisandbox paas +2 moreA improper neutralization of special elements used in an os command ('os command injection')...CVE-2026-25089In KEVPublic exploitEPSS 76.1%9.1 Critical
- ivanti sentry, standalone sentry +1 moreAn Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and...CVE-2026-10523Public exploitEPSS 54.0%9.9 Critical
- ivanti sentry, standalone sentry +1 moreAn OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1...CVE-2026-10520In KEVPublic exploitEPSS 99.9%10.0 Critical
- linux, linux kernel, red hat enterprise linux 10 +12 more +14 moreKVM: arm64: vgic-its: Drop the translation cache reference only for the erased entryCVE-2026-46316Public exploitFix available9.3 Critical
- themeisle woody code snippetsWordPress Insert PHP Plugin < 2.5.1 PHP Code Injection via REST APICVE-2017-20251Public exploit9.3 Critical
- arm c1-premium, c1-ultra, cortex-a710 +45 more +47 moreArm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1,...CVE-2025-10263Public exploitFix available9.1 Critical
- broadcom spring retry, spring retry +1 moreCache Exhaustion in Stateful Retries leads to Denial of ServiceCVE-2026-41710Public exploitFix available5.9 Medium
- strukturag libheiflibheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)CVE-2026-50142Public exploitFix available7.5 High
- openssl, red hat cost management 4, multicluster engine for kubernetes +23 more +25 moreHeap Use-After-Free in the PKCS7_verify() FunctionCVE-2026-45447Public exploitFix available8.8 High
- google chrome, chromium v8 +1 moreOut of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote...CVE-2026-11645In KEVPublic exploitFix available8.8 High
- phpoffice phpspreadsheetPhpSpreadsheet: File::prohibitWrappers bypassCVE-2026-45034Public exploitFix available9.2 Critical
- tenda hg10, hg7, hg9 +2 moreTenda HG7/HG9/HG10 formPPPEdit stack-based overflowCVE-2026-11553Public exploit8.7 High
- openbullet openbullet2OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key HeaderCVE-2026-25555Public exploit9.3 Critical
- openbullet openbullet2OpenBullet2 0.3.2 Authenticated RCE via Job Configuration InterfaceCVE-2026-25856Public exploit8.7 High
- apache http server, red hat jboss core services for rhel 8, enterprise linux 10 +10 more +12 moreApache HTTP Server: mod_xml2enc heap overflowCVE-2026-42536Public exploitFix available7.5 High
- sourcecodester inventory systemSourceCodester Inventory System User Management users.php cross site scriptingCVE-2026-11518Public exploit5.3 Medium
- check point security gateway, checkpoint gaia embedded, gaia os +2 more +4 moreUser Authentication Bypass in VPN Remote Access and Mobile AccessCVE-2026-50751In KEVPublic exploitEPSS 85.3%9.3 Critical
- tenda hg10, hg7, hg9 +2 moreTenda HG7/HG9/HG10 formDOMAINBLK stack-based overflowCVE-2026-11499Public exploit9.3 Critical
- wpdevteam essential addons for elementor – popular elementor templates & widgetsEssential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX HandlerCVE-2026-7665Public exploit5.3 Medium
- mdjm event managementMDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' ParameterCVE-2026-7537Public exploit7.2 High
- wpusermanager wp user manager – user profile builder & membershipWP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query ParameterCVE-2026-9290Public exploit7.5 High
- codepress admin columnsAdmin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta ValueCVE-2026-7654Public exploit8.8 High
- webfactory advanced google recaptchaWP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File UploadCVE-2026-5411Public exploit8.8 High
- webfactory advanced google recaptchaWP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login LinkCVE-2026-5415Public exploit8.8 High
- hippooo hippoo mobile app for woocommerceHippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST APICVE-2026-10580Public exploit9.8 Critical
- haxtheweb haxcms-phpHAX CMS Vulnerable to Command Injection using Git.phpCVE-2026-46394Public exploit7.7 High
- Show moreLoading…