Skip to contentVulnerabilities with public exploits
- No product listedAn issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate...CVE-2026-38764Public exploit7.8 High
- dompdfDompdf: Uncontrolled resource consumption based on declared BMP dimensionsCVE-2026-59941Public exploitFix available6.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreLocal File Disclosure in MongoDB Server via MozJS Scripting Engine Module LoaderCVE-2026-13078Public exploitFix available6.3 Medium
- elggElgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar...CVE-2026-65650Public exploit4.3 Medium
- onlook repoOnlook tRPC Insecure Direct Object Reference via multiple proceduresCVE-2026-65013Public exploit8.7 High
- xpoda türkiye informatics technology inc. no code platformSQLi in Xpoda Türkiye Informatics Technology's No Code PlatformCVE-2026-2395Public exploit9.8 Critical
- check point smartconsole, checkpoint multi-domain security management, quantum security management +2 moreAuthentication Bypass in the SmartConsole Login Process Using an Application TokenCVE-2026-16232In KEVPublic exploit9.3 Critical
- progress telerik ui for asp.net ajaxRadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAXCVE-2026-13181Public exploit8.1 High
- traefikTraefik before v2.11.52 Authentication Bypass via ReplacePathRegexCVE-2026-65600Public exploitFix available7.8 High
- n8nn8n before 1.123.64 Sanitizer Bypass Remote Code ExecutionCVE-2026-65591Public exploitFix available8.9 High
- universe software computer marketing trade and industry inc. online registration and workflow management systemIDOR in Universe Software's Online Registration and Workflow Management SystemCVE-2026-2406Public exploit6.5 Medium
- No product listedAn issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate...CVE-2026-38766Public exploit7.8 High
- No product listedAn issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate...CVE-2026-38765Public exploit7.8 High
- No product listedAn issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to cause a...CVE-2026-38763Public exploit5.5 Medium
- oracle corporation mysql connectors, oracle mysql connector\/j +1 moreVulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). ...CVE-2026-61082Public exploit6.5 Medium
- oracle corporation mysql connectors, oracle mysql connector\/j +1 moreVulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). ...CVE-2026-60623Public exploit7.1 High
- oracle corporation mysql connectors, oracle mysql connector\/j +1 moreVulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). ...CVE-2026-60586Public exploit7.7 High
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...CVE-2026-60206Public exploit9.9 Critical
- canonical ubuntu 22.04 lts, ubuntu 24.04 lts, ubuntu 26.04 lts +2 moresnap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment SetupCVE-2026-8933Public exploitFix available7.8 High
- getgrav gravGrav before 2.0.7 Remote Code Execution via Blueprint dynamicDataCVE-2026-65008Public exploit9.3 Critical
- zyxel ax7501-b1 firmwareA post-authentication command injection vulnerability in the "LogServer" field of the syslog...CVE-2026-6952Public exploit7.2 High
- 7-zip7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution VulnerabilityCVE-2026-14266Public exploitFix available7.0 High
- No product listedIn Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password...CVE-2025-66390Public exploitDisputed9.8 Critical
- freescout-help-desk freescoutFreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQLCVE-2026-53595Public exploit9.4 Critical
- rvc-boss gpt-sovitsGPT-SoVITS 20250606v2pro OS Command Injection via webui.pyCVE-2026-63766Public exploit9.3 Critical
- dj-extensions.com dj-classifieds extension for joomlaJoomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2CVE-2026-61424Public exploit10.0 Critical
- apache syncopeApache Syncope: User self-service privilege escalationCVE-2026-62183Public exploit9.8 Critical
- stevejburge tag groups is the advanced way to display your taxonomy termsTag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' ParameterCVE-2026-9833Public exploit7.1 High
- unknown mailersendMailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRFCVE-2026-13156Public exploit5.4 Medium
- unknown modern event calendar pro, modern events calendar lite +1 moreModern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_moreCVE-2026-11349Public exploit8.6 High
- libgit2libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_dataCVE-2026-53587Public exploitFix available7.5 High
- No product listedAn issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C...CVE-2026-52656Public exploit9.8 Critical
- No product listedAn issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to...CVE-2026-51385Public exploit6.9 Medium
- No product listedFlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in...CVE-2026-51031Public exploit7.5 High
- linuxapparmor: mediate the implicit connect of TCP fast open sendmsgCVE-2026-63828Public exploitFix available8.4 High
- croogo cmsCroogo CMS Admin File Manager FileManager.php isEditable path traversalCVE-2026-16219Public exploit5.3 Medium
- scikit-hep uprootuproot 5.7.4 and prior Code Injection via TStreamerInfo MetadataCVE-2026-9147Public exploit8.5 High
- wordpress, wordpress core +1 moreWordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionCVE-2026-63030In KEVPublic exploitFix availableEPSS 10.6%9.8 Critical
- wordpress, wordpress core +1 moreWordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryCVE-2026-60137In KEVPublic exploitFix available5.9 Medium
- ibm langflow, langflow oss +1 moreUnauthenticated Remote Code Execution via Auto-Login Bypass and Code ValidationCVE-2026-9198In KEVPublic exploitEPSS 28.7%9.8 Critical
- sangoma switchvox, switchvox smb edition +1 moreUnauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMBCVE-2026-9586In KEVPublic exploitEPSS 19.0%9.3 Critical
- osticketosTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosureCVE-2026-14871Public exploit7.1 High
- openclawOpenClaw < 2026.6.6 Network Policy Bypass via exec-serverCVE-2026-62201Public exploit4.9 Medium
- No product listedAn issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute...CVE-2026-52199Public exploit9.1 Critical
- No product listedXenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to...CVE-2026-51833Public exploit7.5 High
- No product listedAn unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3...CVE-2026-36669Public exploit9.8 Critical
- ahnlab epp managementAhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability...CVE-2025-60357Public exploit8.1 High
- arcadedata arcadedbArcadeDB before 26.7.2 Remote Code Execution via Trigger ScriptsCVE-2026-67340Public exploitFix available8.6 High
- pheditorPheditor: Hardcoded default password 'admin' with no forced change enables full application compromiseCVE-2026-55579Public exploitFix available9.8 Critical
- nuclioNuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard containerCVE-2026-52832Public exploitFix available4.9 Medium
- Show moreLoading…