Skip to contentVulnerabilities with public exploits
- kitae park mang board wpWordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-84770Public exploit8.8 High
- paul ryan authorizerWordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerabilityCVE-2026-81294Public exploit9.8 Critical
- progress software telerik ui for asp.net ajaxDialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAXCVE-2026-19219Public exploit8.1 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert ActionCVE-2026-80467Public exploit8.1 High
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'CVE-2026-9055Public exploit9.8 Critical
- proxmox server solutions gmbh virtual environment (ve)Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge ParameterCVE-2023-54391Public exploit9.3 Critical
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 morePost-authentication Improper Neutralization of Special Elements used in an OS Command ('OS...CVE-2026-83549In KEVPublic exploit7.8 High
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 moreA Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due...CVE-2026-83548In KEVPublic exploit10.0 Critical
- cypht-org cyphtCypht < 2.12.2 PHP Object Injection RCE via back_query ParameterCVE-2026-71981Public exploit8.7 High
- composerComposer: Perforce source URL permits P4PORT `rsh:` command executionCVE-2026-84361Public exploitFix available7.7 High
- ohf-voice wyomingWyoming < 1.10.2 SSRF via uri Query ParameterCVE-2026-8712Public exploitFix available6.9 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript: GC componentCVE-2026-84118Public exploit5.4 Medium
- lutece coreCode injection in the Lutece CoreCVE-2026-4813Public exploit9.4 Critical
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge TagCVE-2026-19952Public exploit7.5 High
- wplegalpages wplp cookie consent – cookie banner & consent management for gdpr, ccpa & google consent modeWPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST EndpointCVE-2026-75865Public exploit9.8 Critical
- cpanelEval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute...CVE-2026-65643Public exploit8.7 High
- No product listedAn issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via...CVE-2026-51788Public exploit7.5 High
- google androidIn serviceClassExists of InCallController.java, there is a possible arbitrary code execution due...CVE-2026-49881Public exploitFix available7.8 High
- google androidIn dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This...CVE-2026-28618Public exploitFix available8.8 High
- google androidIn read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting...CVE-2026-28609Public exploitFix available8.8 High
- hyperledger-firefly fireflyhyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgeryCVE-2026-82957Public exploit6.9 Medium
- tickeraWordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerabilityCVE-2026-82226Public exploit9.8 Critical
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-82221Public exploit7.1 High
- hashthemes hash formWordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerabilityCVE-2026-81780Public exploit10.0 Critical
- fosrl pangolinPangolin < 1.22.0 Authentication Bypass via Share-Link EndpointCVE-2026-72001Public exploit8.6 High
- flatpakFlatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstreamCVE-2026-92162Public exploitFix available7.2 High
- No product listedFastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST ...CVE-2026-79483Public exploit5.3 Medium
- No product listedInsecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers...CVE-2026-38577Public exploit9.8 Critical
- d-link dir-825mD-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub_46725C stack-based overflowCVE-2026-82592Public exploit9.4 Critical
- ajcloud ajy ipc firmwareAJCloud AJY IPC Firmware Path Traversal via jdbhttpdCVE-2026-56718Public exploit8.7 High
- totolink a720rTOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruptionCVE-2026-82539Public exploit9.4 Critical
- sudo project sudoSudo through 1.9.17p2 Intercept Policy Bypass via execveatCVE-2026-82474Public exploitFix available8.5 High
- unknown user profile builderProfile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/ExportCVE-2026-76547Public exploit6.6 Medium
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcementCVE-2026-19295Public exploit9.9 Critical
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcementCVE-2026-19286Public exploit9.8 Critical
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcementCVE-2026-18729Public exploit8.8 High
- expressjs multermulter vulnerable to Denial of Service via crafted multipart field namesCVE-2026-77078Public exploitFix available7.5 High
- phpsysinfophpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headersCVE-2026-55584Public exploitFix available7.5 High
- jfrog artifactoryPotential authentication bypass leading to administrative access in ArtifactoryCVE-2026-82329In KEVPublic exploitEPSS 14.4%9.8 Critical
- yamcsYamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`CVE-2026-55511Public exploitFix available9.1 Critical
- builderio gpt-crawlergpt-crawler Arbitrary File Write via outputFileName ParameterCVE-2026-82286Public exploit8.8 High
- papercut mf/ng, mf, ng +1 more +3 morePaperCut MF/NG: Unsafe Dynamic Class Loading in Database ConnectorCVE-2026-82078In KEVPublic exploitEPSS 63.0%9.4 Critical
- papercut mf/ng, mf, ng +1 more +3 morePaperCut MF/NG: Authentication BypassCVE-2026-81578In KEVPublic exploitEPSS 84.7%8.8 High
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerabilityCVE-2026-82222Public exploit10.0 Critical
- digital-peak.com dp calendar extension for joomlaJoomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0CVE-2026-78071Public exploit7.5 High
- digital-peak.com dp calendar extension for joomlaJoomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2CVE-2026-78070Public exploit6.9 Medium
- linuxptp: vmclock: prevent read-only mappings from becoming writableCVE-2026-80724Public exploitFix available8.8 High
- wpmudev wpmu dev dashboardWPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization ConfusionCVE-2026-76581Public exploit9.8 Critical
- unknown shared files, shared-files-pro +1 moreShared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path TraversalCVE-2026-12513Public exploit6.8 Medium
- getpocket pocketPocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. ...CVE-2026-82090Public exploit9.2 Critical
- Show moreLoading…