Skip to contentVulnerabilities with public exploits
- gitea open source git serverGitea webhook and migration allow-list filtering permits SSRFCVE-2026-22874Public exploitFix available9.6 Critical
- gitea open source git serverGitea Docker image trusts spoofable reverse-proxy headers by defaultCVE-2026-20896Public exploitFix available9.8 Critical
- webpack-dev-serverwebpack-dev-server vulnerable to cross-site request forgery via internal developer endpointsCVE-2026-14620Public exploitFix available4.7 Medium
- tubitak bilgem software technologies research institute pardus-softwareArgument Injection in TUBITAK BILGEM's pardus-softwareCVE-2026-14459Public exploit8.8 High
- linux kernel, linux, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 more +3 moreipv6: account for fraggap on the paged allocation pathCVE-2026-53362In KEVPublic exploitFix available7.8 High
- asus router appAn Improper Export of Android Application Components vulnerability in ASUS Router App allows a...CVE-2026-12960Public exploit6.0 Medium
- gardyn cloud api, home firmware, studio firmware +2 moreGardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting SyntaxCVE-2026-54477Public exploit5.1 Medium
- gardyn cloud api, home firmware, studio firmware +2 moreGardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-55726Public exploit6.9 Medium
- gardyn cloud api, home firmware, studio firmware +2 moreGardyn IoT Hub Use of Hard-coded CredentialsCVE-2026-13768Public exploit9.5 Critical
- libreswanIKEv2 Denial of Service via malformed fragmentationCVE-2026-12413Public exploitFix available7.5 High
- decolua 9router9Router: Hardcoded Default fallback JWT Secret Allows Authentication BypassCVE-2026-49352Public exploitFix available9.8 Critical
- langroidLangroid: Path traversal in the file tools allows read/write outside configured current directoryCVE-2026-50181Public exploitFix available7.1 High
- notifiarr dockwatchDockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.phpCVE-2026-58455Public exploit9.2 Critical
- ubiquiti inc unifi connect applicationA malicious actor with access to the network could exploit an Improper Access Control...CVE-2026-50746Public exploit10.0 Critical
- little orbit gamefirst anti-cheatCVE-2026-12166CVE-2026-12166Public exploit5.5 Medium
- divi engine form builderDivi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' ParameterCVE-2026-5524Public exploit9.8 Critical
- nikhilgadhiya product video gallery for woocommerceProduct Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail ParameterCVE-2026-10104Public exploit4.4 Medium
- craftcms cmsCraft CMS: Potential authenticated Remote Code Execution via referrer redirectCVE-2026-55794Public exploitFix available8.7 High
- cloudflare universal sslCloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA recordsCVE-2026-14440Public exploit7.6 High
- google chromeType Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute...CVE-2026-14431Public exploitFix available8.8 High
- google chromeInsufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46...CVE-2026-14382Public exploitFix available9.6 Critical
- shenzhen aitemi e commerce co. ltd. m300 wi-fi repeaterShenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.cspCVE-2026-58457Public exploit9.3 Critical
- clamav, cisco secure endpoint +1 moreClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption VulnerabilityCVE-2026-20217Public exploitFix available7.5 High
- mediawikiRemote Code Execution via Unsafe Deserialization in LogItem ImportCVE-2026-58025Public exploitFix available5.9 Medium
- control web panel web panelControl Web Panel < 0.9.8.1225 Blind SQL Injection via userRes ParameterCVE-2026-57517Public exploit9.3 Critical
- cozyvision1 sms alert – sms & otp for woocommerce, order notifications & abandoned cart recoverySMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password ResetCVE-2026-11387Public exploit9.8 Critical
- rarlab rar, unrar, winrar +1 more +3 moreWinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeaderCVE-2026-14191Public exploitFix available7.8 High
- No product listedAn issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in...CVE-2026-51947Public exploit9.8 Critical
- google chromeInsufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0...CVE-2026-13934Public exploitFix available9.6 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Server-Side RCE via PythonCodeStructuredTool in Public FlowsCVE-2026-10134Public exploit10.0 Critical
- ibm langflow oss, langflow +1 moreCode Injection Vulnerability in Code Validation EndpointCVE-2026-7873Public exploitFix available9.9 Critical
- conductor-oss conductorOrkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script EvaluatorsCVE-2026-58138Public exploit9.3 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)CVE-2026-48282In KEVPublic exploitEPSS 42.4%10.0 Critical
- citrix netscaler gateway, netscaler adc, gateway +1 more +3 moreInsufficient input validation leading to memory overreadCVE-2026-10817Public exploit6.9 Medium
- citrix netscaler adc and netscaler gateway, netscaler gateway, netscaler adc +2 more +4 moreMemory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of ServiceCVE-2026-8452In KEVPublic exploit8.8 High
- citrix netscaler gateway, netscaler adc, gateway +1 more +3 moreInsufficient input validation leading to memory overreadCVE-2026-8451Public exploitEPSS 14.2%8.8 High
- dgraph-io dgraphDgraph Vulnerable to DQL Injection via checkUserPassword GraphQL QueryCVE-2026-44840Public exploitFix available7.5 High
- zephyrproject zephyrPath traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file readCVE-2026-8023Public exploit7.5 High
- apache tomcatApache Tomcat: XSS in number guess exampleCVE-2026-50229Public exploitFix available6.1 Medium
- apple ipados, macos, safari +5 more +7 moreA cross-origin issue was addressed with improved tracking of security origins. This issue is...CVE-2026-43700Public exploit6.5 Medium
- apple ipados, macos, tvos +4 more +6 moreThe issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and...CVE-2026-43724Public exploit7.8 High
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2...CVE-2026-43735Public exploit8.1 High
- gorse-io gorseGorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore EndpointsCVE-2026-56782Public exploit9.3 Critical
- ollyo helix3, joomshaper.com helix3 extension for joomla +1 moreJoomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handlerCVE-2026-49049Known exploitedPublic exploit7.5 High
- joomlack page builder, page builder ck, joomlack.fr page builder ck extension for joomla +2 moreJoomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0CVE-2026-56290In KEVPublic exploitEPSS 30.9%10.0 Critical
- No product listedAn issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the...CVE-2026-37637Public exploit9.1 Critical
- gigamon gigavue-osGigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem.CVE-2026-36848Public exploit7.5 High
- joomcoder joomcck, joomcoder.com joomcck extension for joomla +1 moreJoomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1CVE-2026-49048Public exploit8.7 High
- nmapNmap - Integer Underflow in IPv6 Extension Header ParsingCVE-2026-58058Public exploitFix available6.9 Medium
- flowiseFlowise - Custom MCP Environment Variable Denylist Bypass via Case SensitivityCVE-2026-58057Public exploit2.3 Low
- Show moreLoading…