Skip to contentVulnerabilities with public exploits
- freebsdFlaw in Linuxulator execution of setugid binariesCVE-2026-49413Public exploit7.1 High
- freebsdMultiple vulnerabilities in the sound(4) mmap pathCVE-2026-45258Public exploit7.8 High
- freebsdMultiple vulnerabilities in the sound(4) mmap pathCVE-2026-49417Public exploit7.0 High
- frisbii pay, reepaydenmark frisbii pay +1 moreFrisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token ModificationCVE-2026-3462Public exploit6.5 Medium
- themeisle stripe payment forms by wp full pay – accept credit card payments, donations & subscriptionsStripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' ParameterCVE-2026-12432Public exploit5.3 Medium
- kestra, kestra oss +1 moreKestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`CVE-2026-49869In KEVPublic exploit10.0 Critical
- kestraKestra: Unauthenticated RCE via /configs path-suffix auth-filter bypassCVE-2026-53576Public exploit10.0 Critical
- david-a-wheeler flawfinderFlawfinder output manipulation via untrusted filenames and source textCVE-2026-48813Public exploitFix available8.7 High
- notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 moreNotepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crashCVE-2026-48770Public exploit5.0 Medium
- notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 moreNotepad++: Arbitrary Code Execution via config.xml commandLineInterpreterCVE-2026-48778Public exploit7.8 High
- notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 moreNotepad++ TOCTOU: HMAC Checks Disk, Executes from MemoryCVE-2026-52885Public exploit7.5 High
- notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 moreNotepad++: Arbitrary Code Execution via shortcuts.xml UserCommand InjectionCVE-2026-48800Public exploit7.8 High
- opf openprojectOpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized ResourcesCVE-2026-52782Public exploit9.9 Critical
- max-mapper extract-zipextract-zip unvalidated symlink path traversalCVE-2026-56876Public exploitFix available8.6 High
- fluent fluentdFluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` PlaceholderCVE-2026-44024Public exploitFix available9.8 Critical
- safetica endpoint clientKernel driver vulnerability in Safetica Endpoint ClientCVE-2026-0828Public exploit7.5 High
- chrisvrichardson mappress maps for wordpressWordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-56011Public exploit7.1 High
- unknown frontend file manager pluginFrontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post DeletionCVE-2026-8380Public exploit6.5 Medium
- No product listedLansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key...CVE-2026-39031Public exploit5.5 Medium
- cactiCacti: SQL Injection in managers.phpCVE-2026-40083Public exploitFix available7.2 High
- wolfsslML-KEM ARM64 NEON ciphertext comparison only compares half of the inputCVE-2026-6330Public exploitFix available6.3 Medium
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.4 +3 more +5 moreOrg.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusionCVE-2026-11800Public exploitFix available8.1 High
- seaweedfsSeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket accessCVE-2026-54917Public exploitFix available7.8 High
- go-chi chigo-chi chi v5.2.1 IP Spoofing via X-Forwarded-For HeaderCVE-2026-72815Public exploitFix available6.9 Medium
- vanhauser-thc thc-hydraHydra - Stack Buffer Overflow in NTLM Authentication HandlerCVE-2026-56766Public exploitFix available8.6 High
- filebrowserFile Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)CVE-2026-54088Public exploitFix available9.3 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypassCVE-2026-9086Public exploitFix available7.3 High
- tenable nessusSQL Injection in Nessus via Malicious Scan Result File ImportCVE-2026-57588Public exploit1.6 Low
- linux kernel, linux +1 morenetfilter: bridge: make ebt_snat ARP rewrite writableCVE-2026-53266In KEVPublic exploitFix available8.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenet/sched: act_api: use RCU with deferred freeing for action lifecycleCVE-2026-53264Public exploitFix available7.8 High
- linux, linux kernel +1 morenet: phonet: free phonet_device after RCU grace periodCVE-2026-53157Public exploitFix available7.8 High
- dynabook inc. generic io & memory access driverGeneric IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc....CVE-2026-56129Public exploit6.8 Medium
- No product listedGROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a...CVE-2026-37149Public exploit7.7 High
- cactiCacti: Unauthenticated RCE on Graph ImageCVE-2026-39938Public exploitFix available9.8 Critical
- drupal openai provider, openai provider project provider +1 moreOpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053CVE-2026-13233Public exploitFix available3.3 Low
- fatpipe warpWarp: Remote SSH cwd can lead to unauthorized remote command executionCVE-2026-48732Public exploit8.8 High
- fatpipe warpWarp: DCS lifecycle hook spoofing can alter terminal session metadataCVE-2026-54686Public exploit4.3 Medium
- linux, linux kernel +1 moreppp: require CAP_NET_ADMIN in target netns for unattached ioctlsCVE-2026-53075Public exploitFix available8.8 High
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 moretipc: fix double-free in tipc_buf_append()CVE-2026-52993Public exploitFix available9.8 Critical
- feast-dev feast, red hat openshift ai (rhoai), openshift ai 3.4 +2 moreFeast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC DeserializationCVE-2026-56121Public exploitFix available9.3 Critical
- marlinfirmware marlinMarlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code HandlerCVE-2026-56111Public exploit8.3 High
- linux, linux kernel, red hat enterprise linux 10 +10 more +12 morenet: skbuff: fix missing zerocopy reference in pskb_carve helpersCVE-2026-52943Public exploitFix available7.8 High
- curlincomplete mTLS config matching in conn reuseCVE-2026-8932Public exploitFix available7.5 High
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 moresctp: purge outqueue on stale COOKIE-ECHO handlingCVE-2026-52924Public exploitFix available9.8 Critical
- linux, linux kernel, red hat enterprise linux 10 +13 more +15 moreipc: limit next_id allocation to the valid ID rangeCVE-2026-52923Public exploitFix available7.8 High
- pravel invoice generatorInvoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' ParameterCVE-2026-12416Public exploit9.8 Critical
- freedesktop.org libslirplibslirp TCP URG OOB Read Information LeakCVE-2026-9539Public exploitFix available6.5 Medium
- geovision inc. gv-i/o box 4eGeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET commandCVE-2026-12485Public exploit10.0 Critical
- anthropic claude desktop coworkAnthropic Claude Desktop Cowork VM Image Contents Not Validated Before UseCVE-2026-7574Public exploit8.7 High
- fasterxml jackson-databindjackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiationCVE-2026-54512Public exploitFix available8.1 High
- Show moreLoading…