Skip to contentVulnerabilities with public exploits
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows HTTP.sys Elevation of Privilege VulnerabilityCVE-2026-62735Public exploit7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Imaging Component Remote Code Execution VulnerabilityCVE-2026-54984Public exploit7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Active Directory Domain Services Remote Code Execution VulnerabilityCVE-2026-49179Public exploit8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution VulnerabilityCVE-2026-63520Public exploit8.1 High
- zoom communications clientsZoom Clients - Buffer Over-writeCVE-2026-53413Public exploit8.3 High
- vimVim: Heap Buffer Overflow when Loading a Spell FileCVE-2026-73072Public exploitFix available8.5 High
- siemens simatic iot2050 advanced (6es7647-0ba00-1ya2), simatic iot2050 basic (6es7647-0ba00-0ya2), simatic iot2050 m.2 (6es7647-0bb00-1ya2) +1 more +3 moreA vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All...CVE-2026-58115Public exploit10.0 Critical
- friendicaFriendica Friendica - SQL InjectionCVE-2026-72550Public exploit9.8 Critical
- sap se commerce cloud (data hub adapter)Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)CVE-2026-58231Public exploit10.0 Critical
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreIperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustionCVE-2026-71217Public exploitFix available7.5 High
- grafana mcp-grafana, mcp server +1 moreCVE-2026-19516 CVE RecordCVE-2026-19516Public exploit9.1 Critical
- sap se netweaver and abap platformMemory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP PlatformCVE-2026-34265Public exploit9.8 Critical
- typemillTypemill CMS 2.x Persistent XSS via Markdown javascript URICVE-2026-44401Public exploit4.6 Medium
- dokployDokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)CVE-2026-72867Public exploit9.9 Critical
- metabaseMetabase SQL injection via password reset endpointCVE-2026-72898In KEVPublic exploitEPSS 98.2%10.0 Critical
- spipSPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLiteCVE-2026-66738Public exploitFix available7.7 High
- linuxppp: defer channel free to an RCU grace period to fix pppol2tp RX UAFCVE-2026-68398Public exploitFix available7.8 High
- linuxsctp: fix auth_hmacs array size in struct sctp_cookieCVE-2026-68376Public exploitFix available8.1 High
- linuxnet/sched: serialize qdisc_rtab_list against concurrent get/putCVE-2026-68138Public exploitFix available7.8 High
- linuxpppoe: reload header pointer after dev_hard_header()CVE-2026-68121Public exploitFix available7.8 High
- apache rangerApache Ranger: OS Command Injection via Username in UnixUserGroupBuilderCVE-2026-28672Public exploit9.8 Critical
- tychesoftwares product input fields for woocommerceProduct Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File UploadCVE-2026-19089Public exploit9.8 Critical
- unknown login & register formsLogin & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password ResponseCVE-2026-18470Public exploit7.5 High
- infinitewp client, unknown infinitewp client +1 moreInfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on MultisiteCVE-2026-15038Public exploit9.8 Critical
- flippercode wp maps proWP Maps Pro < 6.1.3 - Unauthenticated Denial of ServiceCVE-2026-18464Public exploit7.5 High
- flowiseai flowiseFlowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-ListCVE-2026-67620Public exploit6.3 Medium
- brix crypto-jscrypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency ChainCVE-2026-71851Public exploitFix available9.0 Critical
- wordpressWordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escala…CVE-2026-64638Public exploitFix available8.9 High
- @clerk nuxtNuxt before 4.5.1 Information Disclosure via Chrome DevToolsCVE-2026-72744Public exploitFix available6.9 Medium
- go-gitgo-git: Malicious reference names may modify files outside the reference storageCVE-2026-71557Public exploitFix available6.3 Medium
- gitroomhq postiz-appUnauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeoverCVE-2026-19264Public exploit9.3 Critical
- phoca.cz phoca commander extension for joomlaJoomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3CVE-2026-66491Public exploit8.2 High
- phoca.cz phoca commander extension for joomlaJoomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3CVE-2026-66492Public exploit6.1 Medium
- phoca.cz phoca commander extension for joomlaJoomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3CVE-2026-66493Public exploit6.4 Medium
- unknown wp mapsWP Maps < 4.9.7 - Subscriber+ Denial of ServiceCVE-2026-16265Public exploit6.5 Medium
- v-secure jingyun antivirusV-Secure Jingyun Antivirus Kernel Driver ZyArk.sys access controlCVE-2026-19195Public exploit8.5 High
- avast antivirusJiangmin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access controlCVE-2026-19193Public exploit8.5 High
- python-hyper h2h2: Duplicate Host header could facilitate request smugglingCVE-2026-71554Public exploitFix available5.3 Medium
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox EscapeCVE-2026-72781Public exploitFix available8.7 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.configCVE-2026-72778Public exploitFix available8.7 High
- apple macosAn authentication issue was addressed with improved state management. This issue is fixed in...CVE-2026-65400In KEVPublic exploitEPSS 18.1%9.8 Critical
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 +2 more +4 moreUdisks2: udisks2: local privilege escalation via as-user option spoofingCVE-2026-7867Public exploitFix available7.8 High
- apache polarisApache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validationCVE-2026-64640Public exploitFix available5.3 Medium
- wso2 api control plane, api manager, multiple products +3 more +5 moreAuthentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account TakeoverCVE-2026-5430In KEVPublic exploitEPSS 22.4%10.0 Critical
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 extended lifecycle support +11 more +13 moreGstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloadersCVE-2026-18649Public exploitFix available7.5 High
- No product listedSQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code...CVE-2026-67689Public exploit9.8 Critical
- No product listedInsecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate...CVE-2026-67687Public exploit8.8 High
- No product listedIn Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.CVE-2024-39024Public exploit8.8 High
- thermo fisher abi prism 310 data collection software, abi prism 3100/3100-avant data collection software, applied biosystems 3130 series data collection software +9 more +11 moreThermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity CheckCVE-2026-17583Public exploit8.3 High
- aws aws-transform-mcp-server, amazon aws transform mcp server +1 moreImproper limitation of a pathname to a restricted directory in aws-transform-mcp-serverCVE-2026-18953Public exploit6.3 Medium
- Show moreLoading…