Skip to contentVulnerabilities with public exploits
- No product listedAn issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an...CVE-2026-51376Public exploit6.5 Medium
- No product listedCross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before...CVE-2026-50980Public exploit6.1 Medium
- No product listedA command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1...CVE-2026-50979Public exploit8.1 High
- zoneminderOS Command Injection in PayRange APICVE-2026-76060Public exploit8.7 High
- speechbrainSpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml ParsingCVE-2026-10036Public exploit8.7 High
- unitree robotics g1 eduUnitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path TraversalCVE-2026-76639Public exploit8.7 High
- eazsolution eazyfixEAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step"...CVE-2026-25250Public exploit6.0 Medium
- joomlaeventmanager.net jem - joomla event manager extension for joomlaJoomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1CVE-2026-77991Public exploit9.4 Critical
- spring framework, vmware spring framework +1 moreSpring Framework Improper Path Limitation in XsltViewCVE-2026-47884Public exploitFix available9.8 Critical
- spring framework, vmware spring framework +1 moreSpring Framework Open Redirect in UrlHandlerFilterCVE-2026-47883Public exploit6.1 Medium
- No product listedIncorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9...CVE-2026-37073Public exploit5.3 Medium
- No product listedVeno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access...CVE-2026-37072Public exploit9.8 Critical
- No product listedArbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno...CVE-2026-37071Public exploit9.8 Critical
- No product listedIncorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9...CVE-2026-37070Public exploit6.5 Medium
- No product listedAbsolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1...CVE-2026-37069Public exploit5.3 Medium
- No product listedArbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File...CVE-2026-37068Public exploit8.1 High
- No product listedIncorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project...CVE-2026-37067Public exploit5.3 Medium
- No product listedPath traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax...CVE-2026-37066Public exploit6.5 Medium
- No product listedVeno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php...CVE-2026-37065Public exploit9.1 Critical
- No product listedUser enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an...CVE-2026-37064Public exploit5.3 Medium
- No product listedAn issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a...CVE-2026-26897Public exploit9.8 Critical
- free5gc smfSimple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()CVE-2026-43621Public exploit8.6 High
- webpros plesk migrator, plesk site import +1 moreImproper symlink resolution before file access in Plesk allows remote authenticated users to...CVE-2026-65647Public exploit8.7 High
- giteaGitea: Remote Code Execution via diffpatch Git Hook InstallationCVE-2026-60004In KEVPublic exploitFix availableEPSS 24.0%9.8 Critical
- ilias-elearning e.v. iliasILIAS PHP Object Injection via Shibboleth LogoutCVE-2026-80428Public exploit9.3 Critical
- linuxmptcp: avoid combining some incoming suboptionsCVE-2026-80587Public exploitFix available9.8 Critical
- linuxaf_unix: Unlink scc_entry in unix_del_edge().CVE-2026-80521Public exploitFix available7.8 High
- kyvernoKyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-systemCVE-2026-54523Public exploitFix available9.6 Critical
- wedevs erp: complete hr, accounting & crm suite built for woocommerceERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP AttachmentCVE-2026-18080Public exploit9.8 Critical
- ubiquiti inc uid enterprise agentA malicious actor with access to the network and high privileges could exploit an Improper Input...CVE-2026-77542Public exploit9.1 Critical
- teamviewer full client, host, quicksupport & portable, full client, host, quicksupport & portable (for windows 7 & 8), full client, host, quicksupport & portable (v13 for windows) +5 more +7 moreImproper Validation of File Paths in TeamViewer Desktop ClientsCVE-2026-16444Public exploit7.5 High
- themefusion avada (fusion) builder, avada | website builder for wordpress & woocommerce +1 moreAvada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File WriteCVE-2026-18431Public exploit9.8 Critical
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link DisclosureCVE-2026-19632Public exploit9.8 Critical
cockpit UbuntuCross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to...CVE-2026-39275Public exploit6.1 Medium- No product listedPath traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and...CVE-2026-36851Public exploit7.5 High
- red hat enterprise linux 10Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fixCVE-2026-77680Public exploitFix available5.3 Medium
- google chromeUse after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...CVE-2026-79266Public exploitFix available8.8 High
- google chromeType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute...CVE-2026-78938Public exploitFix available8.8 High
- apple macos, ios and ipados +1 moreA buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS...CVE-2026-64705Public exploit5.5 Medium
- creativeitem ekushey project manager crmEkushey Project Manager CRM 5.0 Stored XSS via System Name FieldCVE-2026-26211Public exploit4.8 Medium
- kaltura html5 video player, html5 libraryCVE-2026-19912CVE-2026-19912Public exploit9.8 Critical
- nltkNLTK before 3.10.3 Remote Code Execution via Unsafe Pickle DeserializationCVE-2026-79657Public exploitFix available9.3 Critical
- servmask all-in-one wp migration and backupAll-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code ExecutionCVE-2026-19949Public exploit8.8 High
- ilya-zlobintsev lactPolkit authentication bypass in LACTCVE-2026-75037Public exploit7.3 High
- typo3 extension "apache solr for typo3 - enterprise search"Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)CVE-2026-56096Public exploit6.3 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' ParameterCVE-2026-17089Public exploit6.1 Medium
- vrana adminerAdminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN InjectionCVE-2026-56705Public exploitFix available9.3 Critical
- opensslHeap Buffer Overflow in CMS Key UnwrappingCVE-2026-63072Public exploitFix available7.5 High
sqlite Red Hat, sqlite3 Debian, lemon Red Hat +7 more +9 moreBuffer Overflow vulnerability in SQLite affected version source snapshots/builds containing...CVE-2026-39113Public exploitFix available4.0 Medium- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy PathsCVE-2026-5006Public exploitFix available6.8 Medium
- Show moreLoading…