Skip to contentVulnerabilities with public exploits
- No product listedCute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper...CVE-2021-3030Public exploit6.1 Medium
- craftcms cmsCraft CMS before 4.18.6 Remote Code Execution via signed cookieCVE-2026-92592Public exploit8.7 High
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 moreCisco Identity Services Engine Authentication Bypass VulnerabilityCVE-2026-76460In KEVPublic exploitEPSS 75.6%10.0 Critical
- cisco secure firewall adaptive security appliance (asa) software, secure firewall management center (fmc), secure firewall threat defense (ftd) software +2 moreCisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Exceptional Conditions Handling Vulnerabil…CVE-2026-20329Public exploit9.9 Critical
- hp linux imaging and printing, hp inc. linux imaging and printing software (hplip) +1 moreHP Linux Imaging and Printing (HPLIP) Software– Multiple VulnerabilitiesCVE-2026-91097Public exploitFix available7.0 High
- red hat build of keycloak 26.4, build of keycloak 26.4.16, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: broker-originated username collision causes account lockoutCVE-2026-19607Public exploit5.3 Medium
- checkpoint quantum security managementStack overflow in login process to the Security Management and Log ServersCVE-2026-91843Public exploit9.8 Critical
- nlnet labs unboundHeap buffer overflow and possible Remote Code Execution when digesting DNSKEYCVE-2026-81642Public exploitFix available9.1 Critical
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path TraversalCVE-2026-76555Public exploit6.8 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' ParameterCVE-2026-12793Public exploit9.8 Critical
- synaptikcms synaptik-cmssynaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted uploadCVE-2026-92247Public exploit5.1 Medium
- No product listedAn issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34...CVE-2026-79298Public exploit8.4 High
- No product listedAn issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote...CVE-2026-51990Public exploit9.8 Critical
- google chromeUse after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to...CVE-2026-91737Public exploitFix available8.8 High
- shaneisrael fireshareFireshare has Unauthenticated Argument Injection to Arbitrary File Write/OverwriteCVE-2026-54337Public exploit9.8 Critical
- http4sHttp4s: FollowRedirect middleware leaks credentials over https->http same-authority redirectCVE-2026-69212Public exploit5.9 Medium
- issabel foundation frameworkIssabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originateCVE-2026-89026Public exploit9.3 Critical
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the…CVE-2026-18110Public exploit8.7 High
- unclecode crawl4aicrawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategyCVE-2026-91940Public exploit8.7 High
- docker sandboxesDocker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallbackCVE-2026-77179Public exploit9.4 Critical
- efm iptime c200eEFM ipTIME C200E System Setup iux_set.cgi os command injectionCVE-2026-90847Public exploit9.4 Critical
- No product listedTenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded...CVE-2026-79551Public exploit7.5 High
- No product listedkaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements...CVE-2026-79303Public exploit9.9 Critical
- No product listedThe C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal...CVE-2026-51134Public exploit7.5 High
- No product listedCross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows...CVE-2026-51133Public exploit6.1 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval NotificationsCVE-2026-18116Public exploit7.3 High
- apple macosAn out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in...CVE-2026-84543Public exploit7.5 High
- apple ipados, macos, tvos +3 more +5 moreThis issue was addressed with improved data protection. This issue is fixed in iOS 26.7 and...CVE-2026-43664Public exploit5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreThe issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS...CVE-2026-43687Public exploit6.5 Medium
- apple macosA race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A...CVE-2026-43783Public exploit7.8 High
- apple ipados, tvos, visionos +3 more +5 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...CVE-2026-84636Public exploit5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...CVE-2026-84600Public exploit5.4 Medium
- apple ipados, macos, tvos +4 more +6 moreA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26...CVE-2026-84616Public exploit5.5 Medium
- apple macosA path traversal issue was addressed with improved path validation. This issue is fixed in macOS...CVE-2026-84568Public exploit7.8 High
- apple macosThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden...CVE-2026-43786Public exploit7.8 High
- apple macosA memory corruption issue was addressed with improved validation. This issue is fixed in macOS...CVE-2026-65374Public exploit8.8 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...CVE-2026-84589Public exploit5.5 Medium
- apple macosA buffer overflow was addressed with improved size validation. This issue is fixed in macOS...CVE-2026-84520Public exploit9.8 Critical
- apple ipados, macos, tvos +4 more +6 moreA certificate validation issue was addressed with improved certificate validation. This issue is...CVE-2026-86881Public exploit9.1 Critical
- mikrotik routerosMikroTik RouterOS Stack Buffer Overflow via TFTP URL Path Leading to Privilege EscalationCVE-2026-89020Public exploit8.7 High
- cisco asyncos, secure email, secure email gateway +2 moreCisco Secure Email Gateway SQL Injection VulnerabilityCVE-2026-76461In KEVPublic exploitEPSS 40.2%9.8 Critical
- cisco secure email, secure email and web manager +1 moreCisco Secure Email Gateway Security Hardening ReleaseCVE-2026-76443Public exploit9.8 Critical
- laradashboardLaraDashboard 0.9.2 through 1.2.2 Path Traversal RCECVE-2026-90932Public exploit8.6 High
- laradashboardLaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG UploadCVE-2026-90931Public exploit5.1 Medium
- brokercap bifrostBifrost unauthenticated remote code execution via MCP stdio client registrationCVE-2026-90898Public exploit9.8 Critical
- suprema biostar 2An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and...CVE-2026-31278Public exploit7.7 High
- unknown cryptopayment gatewayCryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX RouterCVE-2026-81648Public exploit10.0 Critical
- systerel s2opcS2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()CVE-2026-90782Public exploit6.0 Medium
- stellarwp the events calendarThe Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable InvocationCVE-2026-78159Public exploit9.8 Critical
- stellarwp the events calendarThe Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code ExecutionCVE-2026-78006Public exploit9.8 Critical
- Show moreLoading…