Skip to contentVulnerabilities with public exploits
- trueconf serverA remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server...CVE-2026-72530In KEVPublic exploit9.5 Critical
- balbooa.com balbooa forms extension for joomlaJoomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2CVE-2026-67363Public exploit7.7 High
- citrix netscaler, netscaler gateway, netscaler adc +2 more +4 moreNetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490CVE-2026-19490In KEVPublic exploitEPSS 33.3%9.3 Critical
- netscaler adc, gateway +1 moreVulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: from 14.1 through...CVE-2026-19489Public exploit8.8 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerabilityCVE-2026-66613Public exploit9.8 Critical
- alsa project alsa-libalsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()CVE-2026-90781Public exploitFix available4.8 Medium
- unknown broken link checkerBroken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable InjectionCVE-2026-18937Public exploit9.0 Critical
- nabil lemsieh easy media replaceEasy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment TitleCVE-2026-15253Public exploit6.8 Medium
- No product listedAn issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain...CVE-2026-51367Public exploit7.5 High
- No product listedSQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker...CVE-2026-51366Public exploit9.9 Critical
- rargames 4gaboards4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated userCVE-2026-53959Public exploit6.5 Medium
- tp-link systems inc tapo c120 v1, tp-link tapo c120 firmware, tapo c200 firmware +1 more +3 moreUnauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200CVE-2026-15315Public exploit8.7 High
- @clerk fastifyfastify vulnerable to schema validation bypass via root primitive coercion mismatchCVE-2026-18504Public exploitFix available5.4 Medium
- moby go-archive, docker cli, compose +3 more +5 moreTar extraction in moby/go-archive can write outside the destination directory via link followingCVE-2026-17106Public exploitFix available7.1 High
- nvidia triton inference serverNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause...CVE-2026-47630Public exploit5.5 Medium
- nvidia triton inference serverNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause...CVE-2026-47627Public exploit9.8 Critical
- magicmirrororg magicmirrorMagicMirror newsfeed Socket.IO notification allows blind server-side request forgeryCVE-2026-63642Public exploitFix available6.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.15, build of keycloak 26.6 +11 more +13 moreKeycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassCVE-2026-18963Public exploitFix available9.1 Critical
- joomla joomla\!, joomla! project cms, framework filesystem package +2 moreJoomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2CVE-2026-73373Public exploitFix available8.9 High
- sureformsSureForms contains an uncontrolled resource consumption vulnerabilityCVE-2026-19500Public exploit7.5 High
- sureformsCVE-2026-19501CVE-2026-19501Public exploit8.8 High
- infiniflow ragflowRAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke ComponentCVE-2026-75898Public exploit8.4 High
- microsoft copilot, copilot web +1 moreMicrosoft Copilot Information Disclosure VulnerabilityCVE-2026-24301Public exploit8.8 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Graphics componentCVE-2026-74970Public exploit5.4 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Graphics: Text componentCVE-2026-74945Public exploitFix available6.5 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the Graphics: ImageLib componentCVE-2026-74943Public exploitFix available9.8 Critical
- mozilla firefox, thunderbird +1 morePrivilege escalation in the DOM: Navigation componentCVE-2026-74939Public exploitFix available8.8 High
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript: WebAssembly componentCVE-2026-74936Public exploitFix available9.8 Critical
- arcadedata arcadedbArcadeDB before 26.8.1 Path Traversal via create/drop databaseCVE-2026-75855Public exploit8.4 High
- getgrav gravGrav before 2.0.15 Arbitrary File Write via error_logCVE-2026-75827Public exploitFix available9.3 Critical
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field ConfigurationCVE-2026-15748Public exploit9.8 Critical
- No product listedCross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the...CVE-2026-67921Public exploit9.3 Critical
- No product listedAn issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app...CVE-2026-67920Public exploit8.8 High
redis Mageia, redis-modules openSUSE +1 moreUpdated redis packages fix a security vulnerabilityCVE-2026-62356Public exploitFix available7.5 High- No product listedAn Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which...CVE-2021-43718Public exploit5.3 Medium
- No product listedAn issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector...CVE-2021-43717Public exploit9.8 Critical
- No product listedVerification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1...CVE-2021-43716Public exploit9.8 Critical
- apple ipados, macos, safari +3 more +5 moreThis issue was addressed through improved state management. This issue is fixed in iOS 26.6.1 and...CVE-2026-65351Public exploitFix available4.3 Medium
- apple ipados, macos, tvos +4 more +6 moreThe issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and...CVE-2026-65330Public exploit6.5 Medium
- apple ipados, macos, visionos +3 more +5 moreThe issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and...CVE-2026-64788Public exploit5.4 Medium
- apple ipados, macos, tvos +4 more +6 moreA use after free issue was addressed with improved memory management. This issue is fixed in iOS...CVE-2026-65343Public exploit7.5 High
- apple ipados, macos, tvos +4 more +6 moreAn out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26...CVE-2026-65349Public exploit6.6 Medium
- lfprojects mlflowMLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)CVE-2026-64849In KEVPublic exploitFix availableEPSS 10.0%9.3 Critical
- typemillTypemill < 2.26.0 Authorization Bypass via Media File Download RouteCVE-2026-71518Public exploit8.7 High
- budibaseBudibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`CVE-2026-54356Public exploit7.1 High
- notepad-plus-plusNotepad++: session.xml backupFilePath starts_with BypassCVE-2026-52886Public exploit5.1 Medium
- gitlabCross-Site Request Forgery (CSRF) in GitLabCVE-2026-19650Public exploitFix available7.1 High
- gitlabImproper Control of Generation of Code ('Code Injection') in GitLabCVE-2026-19478Public exploitFix available9.4 Critical
- nettyNetty: Cache Poisoning and Information Disclosure via CORS Vary Header OverwriteCVE-2026-59903Public exploitFix available6.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.156085,
2026.1.13913,
2026.2.18112 an unauthenticated...CVE-2026-75045Public exploit9.1 Critical
- Show moreLoading…