Skip to contentVulnerabilities with public exploits
- sdelements lets-chatLet's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room LookupCVE-2026-66749Public exploit7.1 High
- owen2345 camaleon-cmsCamaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom FieldCVE-2026-66748Public exploit8.7 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributesCVE-2026-58222Public exploitFix available8.8 High
samba Debiansamba security updateCVE-2026-58221Public exploitFix available8.8 High- ninenines cowlibUnbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoSCVE-2026-59248Public exploitFix available8.7 High
- apple ipados, macos, watchos +2 more +4 moreA race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and...CVE-2026-43805Public exploit9.8 Critical
- apple ipados, macos, tvos +4 more +6 moreA validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26...CVE-2026-43813Public exploit7.1 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...CVE-2026-39875Public exploit7.8 High
- apple ipados, macos, tvos +4 more +6 moreA buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.6...CVE-2026-64747Public exploit7.8 High
- apple ipados, macos, tvos +4 more +6 moreAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in...CVE-2026-64725Public exploit7.1 High
- apple macosThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7...CVE-2026-43682Public exploit9.8 Critical
- apple macosA logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7...CVE-2026-28912Public exploit7.8 High
- jfrog artifactoryPotential privilege escalation to JFrog administrator privilegesCVE-2026-65616Public exploit8.8 High
- jfrog artifactoryIncorrect authorization validation of user token in JFrog Artifactory allows Privilege EscalationCVE-2026-42016In KEVPublic exploit8.1 High
- boazsegev facil.iofacil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoSCVE-2026-66731Public exploit8.7 High
- boazsegev facil.iofacil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body ParserCVE-2026-66730Public exploit8.7 High
- boazsegev facil.iofacil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body ParserCVE-2026-66729Public exploit8.7 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was...CVE-2026-63077In KEVPublic exploitEPSS 94.9%9.8 Critical
- strategy11 team awp classifiedsWordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerabilityCVE-2026-59550Public exploit9.3 Critical
- vbulletinvBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.phpCVE-2026-61511Public exploitEPSS 74.3%9.3 Critical
- media manager tastyigniterStored Cross-Site Scripting (XSS) in TastyIgniter Media ManagerCVE-2026-14856Public exploit6.3 Medium
- zte blade a75 5gPath Traversal Vulnerability in ZTE Blade A75 5GCVE-2026-40000Public exploit1.8 Low
- cp-plus ez-p21 ip cameraArbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP CameraCVE-2026-65893Public exploit7.0 High
- linux, linux kernel +1 morenet: openvswitch: reject oversized nested action attrsCVE-2026-64531Public exploitFix available7.8 High
- unknown bookingpress-appointment-booking-proBookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback BugCVE-2026-9830Public exploit8.2 High
- unknown realtyna organic idx plugin + wpl real estateRealtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code ExecutionCVE-2026-13714Public exploit9.8 Critical
- silverplugins217 custom fields account registration for woocommerceCustom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege EscalationCVE-2026-13152Public exploit8.1 High
- No product listedCross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8...CVE-2026-51565Public exploit6.1 Medium
- No product listedAn issue in the redirect parameter in Milk admin <=0.9.8 allows remote attackers to redirect...CVE-2026-51564Public exploit4.9 Medium
- No product listedSQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in...CVE-2025-50455Public exploit9.1 Critical
- koxudaxi datamodel-code-generatordatamodel-code-generator Code Injection via Unvalidated customBasePath Schema FieldCVE-2026-63720Public exploit7.5 High
- linux, linux kernel +1 morex86/bugs: Enable IBPB flush on BPF JIT allocationCVE-2026-64507Public exploitFix available5.5 Medium
- linux, linux kernel +1 morebinder: fix UAF in binder_free_transaction()CVE-2026-64468Public exploitFix available7.8 High
- wpforms proWPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize OrderingCVE-2026-10818Public exploit8.1 High
- nic knot resolverKnot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the...CVE-2026-66374Public exploitFix available8.1 High
- linux, linux kernel +1 moreKVM: x86: Check for invalid/obsolete root *after* making MMU pages availableCVE-2026-64561Public exploitFix available8.8 High
- networkupstools nutupsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD executionCVE-2026-54161Public exploitFix available8.1 High
dotnet8-runtime AlpaquitaCVE-2026-56158Public exploitFix availableNo score- owap defectdojoOWASP DefectDojo API/Web serializers.py UserSerializer privileges managementCVE-2026-16764Public exploit5.3 Medium
- microweberMicroweber CMS 2.0.20 Path Traversal via ServeStaticFileControllerCVE-2026-65694Public exploit8.7 High
- calcom cal.diyCal.com before 5.9.9 Remote Code Execution via RSCCVE-2025-71389Public exploit10.0 Critical
- cyberlord92 saml single sign on – sso loginSAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse ParameterCVE-2026-15981Public exploit9.8 Critical
- chatwootChatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob CreationCVE-2026-63765Public exploit8.8 High
- zohocorp manageengine adaudit plusRemote Code ExecutionCVE-2026-6516Public exploit10.0 Critical
- joomshaper.com easy store extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1CVE-2026-65761Public exploit9.3 Critical
- metin saraç popup for cf7 with sweet alertWordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-65540Public exploit7.1 High
- easy appointments appointments, easyappointments easy appointments +1 moreWordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2026-61946Public exploit6.5 Medium
- cascadiawebservices mountdev ai mcp connector for wordpressMountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization EndpointCVE-2026-15015Public exploit9.8 Critical
- rtcamp godam – organize wordpress media library & file manager with unlimited folders for images, videos & moreGoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload FieldCVE-2026-14282Public exploit9.8 Critical
- alibaba fastjsonRemote Code Execution in fastjson 1.2.68–1.2.83CVE-2026-16723Public exploit9.0 Critical
- Show moreLoading…