Skip to contentVulnerabilities with public exploits
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_mediaCVE-2026-12684Public exploit6.5 Medium
- cyberlord92 saml single sign on – sso loginSAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm ConfusionCVE-2026-15013Public exploit9.8 Critical
- No product listedAn issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler...CVE-2026-36425Public exploit6.5 Medium
- nocobaseNocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCECVE-2026-52887Public exploitFix available10.0 Critical
- pegatron corp. tdelo64.sysCVE-2026-14960CVE-2026-14960Public exploit9.8 Critical
- penpotPenpot: Authenticated SSRF in remote image import via create-file-media-object-from-urlCVE-2026-45806Public exploit7.7 High
- f5 nginx open source, nginx plus, nginx gateway fabric +2 more +4 moreNGINX Map directive and Regex matching vulnerabilityCVE-2026-42533Public exploitFix available9.2 Critical
- preferredai cornacCornac < 2.6.0 Path Traversal via _extract_archive() in download.pyCVE-2026-43637Public exploitFix available8.8 High
- apache fineractApache Fineract: Office list: SQL Injection via Subquery in orderByCVE-2026-57821Public exploit8.1 High
- grafana mcp serverSSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL headerCVE-2026-15583Public exploit8.6 High
- asus business manager, system control interface, business manager manager +1 more +3 moreAllocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not...CVE-2026-13585Public exploit8.2 High
- emqx nanomqAn issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the...CVE-2026-36590Public exploit7.5 High
- No product listedLiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation...CVE-2026-30623Public exploit9.8 Critical
- No product listedCross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute...CVE-2026-26719Public exploit6.1 Medium
- No product listedA Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3...CVE-2026-26718Public exploit9.1 Critical
- adobe commerce, commerce b2b, commerce events +5 more +7 moreAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)CVE-2026-48356In KEVPublic exploitEPSS 47.5%9.3 Critical
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 morePost-authentication improper control of generation of code ('Code Injection') vulnerability has...CVE-2026-15410In KEVPublic exploitEPSS 11.8%7.2 High
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 moreA Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance...CVE-2026-15409In KEVPublic exploit10.0 Critical
- eric teubert podlove podcast publisherPodlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url ParameterCVE-2026-13001Public exploit9.8 Critical
- microsoft configuration manager, configuration manager 2503, configuration manager 2509 +1 more +3 moreConfiguration Manager Elevation of Privilege VulnerabilityCVE-2026-47301Public exploit8.8 High
- golang.org/x/text golang.org/x/text/unicode/normInfinite loop on invalid input in golang.org/x/textCVE-2026-56852Public exploitFix available7.5 High
- microsoft windows subsystem for linux (wsl2), windows subsystem for linux +1 moreWindows Subsystem for Linux (WSL2) Kernel Tampering VulnerabilityCVE-2026-57973Public exploit6.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreRemote Desktop Protocol Remote Code Execution VulnerabilityCVE-2026-56190Public exploit9.8 Critical
- microsoft dynamics nav, dynamics nav 2018 +1 moreMicrosoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution VulnerabilityCVE-2026-55944Public exploit9.8 Critical
- microsoft sharepoint, sharepoint server, sharepoint enterprise server 2016 +2 more +4 moreMicrosoft SharePoint Server Security Feature Bypass VulnerabilityCVE-2026-55040In KEVPublic exploitEPSS 69.5%9.1 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreActive Directory Certificate Services Elevation of Privilege VulnerabilityCVE-2026-54121Public exploit8.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows Search Service Elevation of Privilege VulnerabilityCVE-2026-50679Public exploit7.8 High
- microsoft defender for endpoint, defender for endpoint for mac +1 moreMicrosoft Defender for Endpoint for Mac Information Disclosure VulnerabilityCVE-2026-50657Public exploit4.7 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreNTFS Elevation of Privilege VulnerabilityCVE-2026-50402Public exploit7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Remote Desktop Services Elevation of Privilege VulnerabilityCVE-2026-50369Public exploit8.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWin32k Information Disclosure VulnerabilityCVE-2026-50416Public exploit3.3 Low
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 moreMicrosoft Install Service Elevation of Privilege VulnerabilityCVE-2026-50343Public exploit7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Event Logging Service Information Disclosure VulnerabilityCVE-2026-34348Public exploit6.5 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 moreWindows Narrator Braille Elevation of Privilege VulnerabilityCVE-2026-58635Public exploit7.8 High
- microsoft sharepoint, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 moreMicrosoft SharePoint Remote Code Execution VulnerabilityCVE-2026-50522In KEVPublic exploit9.8 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Elevation of Privilege VulnerabilityCVE-2026-56164In KEVPublic exploitEPSS 27.3%5.3 Medium
- microsoft azure spring apps, azure spring cloud +1 moreAzure Spring Apps Elevation of Privilege VulnerabilityCVE-2026-50338Public exploit8.2 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreMicrosoft Message Queuing Queue Manager Remote Code Execution VulnerabilityCVE-2026-54992Public exploit8.4 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Win32k Elevation of Privilege VulnerabilityCVE-2026-54107Public exploit8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +18 more +20 moreWindows WalletService Elevation of Privilege VulnerabilityCVE-2026-49176Public exploit7.8 High
- sigstore sigstore-jsCredential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registryCVE-2026-59891Public exploitFix available9.6 Critical
- bulwarkmail webmailIn Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting ...CVE-2026-54433Public exploitFix available7.2 High
- cloudflare quicheResource exhaustion in quiche HTTP/3 and QPACK layersCVE-2026-12523Public exploit7.5 High
- mozilla firefox, thunderbird +1 moreInvalid pointer in the JavaScript: WebAssembly componentCVE-2026-15718Public exploitFix available4.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)CVE-2026-12478Public exploitFix available4.8 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreQemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keysCVE-2026-12080Public exploitFix available7.3 High
- kimaiKimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account TakeoverCVE-2026-52824Public exploitFix available9.1 Critical
- linux, linux kernel +1 morexfs: resample the data fork mapping after cycling ILOCKCVE-2026-64600Public exploitFix available7.8 High
- No product listedCross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows...CVE-2026-52100Public exploit7.5 High
- osticketosTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored...CVE-2026-36214Public exploit6.4 Medium
- Show moreLoading…