Skip to contentVulnerabilities with public exploits
- keywordrush content eggContent Egg < 11.9.0 - Contributor+ Stored XSS via Import QueueCVE-2026-92424Public exploit6.8 Medium
- beenuar aisocAiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTRCVE-2026-103056Public exploit9.4 Critical
- es iperf3iperf3 < 3.22 UDP Receive Worker Infinite Loop DoSCVE-2026-102253Public exploitFix available8.7 High
- simple-git project simple-git, steveukx git-js +1 moresimple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)CVE-2026-102827Public exploitFix available8.1 High
- simple-git project simple-git, steveukx git-js +1 moresimple-git allows command execution through unblocked Git configuration includesCVE-2026-102826Public exploitFix available8.1 High
- cthackers adm-zipadm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalationCVE-2026-102282Public exploitFix available7.1 High
- python software foundation cpythonRace condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directoryCVE-2026-12345Public exploitFix available5.9 Medium
- eclipse foundation threadx netx duoOut-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER lengthCVE-2026-102718Public exploit8.7 High
- balbooa forms, balbooa.com balbooa forms extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4CVE-2026-102425Public exploit9.5 Critical
qemu Alpaquita, qemu-hwe Ubuntu +1 moreqemu-11.1.2-1.1 on GA mediaCVE-2026-17588Public exploitFix availableNo score- ollamaOllama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based AuthorizationCVE-2026-102697Public exploit8.5 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3CVE-2026-90907Public exploitFix available6.9 Medium
- opensolution quick.cartCross-Site Request Forgery in admin panel of Quick.CartCVE-2026-41875Public exploit6.9 Medium
- mypresta google merchant center feedUnauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop moduleCVE-2026-85520Public exploit9.3 Critical
- hitachi energy rtu500 series cmu firmwareAn authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500...CVE-2026-8065Public exploit9.1 Critical
- owen2345 camaleon cmsowen2345 Camaleon CMS Media Crop media_controller.rb crop authorizationCVE-2026-102261Public exploit5.3 Medium
- shell-quoteshell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` tokenCVE-2026-102422Public exploitFix available9.2 Critical
- No product listedImproper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier...CVE-2026-79417Public exploit5.3 Medium
- nginxproxymanager nginx-proxy-managerNginx Proxy Manager through 2.16.0 Missing Brute-Force ProtectionCVE-2026-102334Public exploit9.1 Critical
- jpadilla pyjwtPyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardCVE-2026-102268Public exploitFix available9.1 Critical
- authlibAuthlib library contains a signature‑verification bypass vulnerabilityCVE-2026-96760Public exploitFix available9.8 Critical
- berriai litellmLiteLLM Weak JWT Authentication via Email-Based User LookupCVE-2026-93355Public exploit7.6 High
- apple ipados, macos, ios and ipados +2 more +4 moreAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in...CVE-2026-86950In KEVPublic exploitEPSS 26.2%8.8 High
- ordasoft book library, ordasoft.com book library (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6CVE-2026-101110Public exploit9.3 Critical
- ordasoft real estate manager, ordasoft.com real estate manager (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9CVE-2026-100752Public exploit9.3 Critical
- ordasoft vehicle manager, ordasoft.com vehicle manager (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8CVE-2026-101108Public exploit9.3 Critical
- kevva decompress@xhmikosr/decompress: Path traversal via symlink chainCVE-2026-101894Public exploitFix available9.1 Critical
- suse rancherUnauthenticated update of public UI settings leading to stored cross-site scripting in RancherCVE-2026-88804Public exploit9.6 Critical
- cbk soft software hardware electronic computer systems industry and trade inc. envisionSQLi in Iron Mountain's enVisionCVE-2026-86595Public exploit8.8 High
- thinkware u3000Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access controlCVE-2026-101053Public exploit6.9 Medium
modemmanager DebianReachable assertion in Cell Broadcast encoding parse causes denial of serviceCVE-2026-95622Public exploitNo score- apache software foundation rollerApache Roller: Unauthenticated deserialization in the XML-RPC endpointCVE-2026-82384Public exploit9.8 Critical
- ооо нпо ритм georitmООО НПО Ритм GEOritm REST API obj-groups missing authenticationCVE-2026-100903Public exploit6.9 Medium
- seetong t8108, t8108p, t8116 +1 more +3 moreSeetong T8108/T8108P/T8116/T8232 Debug Service improper authenticationCVE-2026-100886Public exploit10.0 Critical
- krayin laravel-crmKrayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorizationCVE-2026-100885Public exploit6.9 Medium
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreTCP Initial Sequence Number (ISN) predictionCVE-2026-88778Public exploit8.8 High
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreMemory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of ServiceCVE-2026-88777Public exploit8.8 High
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreMemory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of ServiceCVE-2026-88776Public exploit8.8 High
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreMemory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of ServiceCVE-2026-88775Public exploit8.8 High
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreHTTP Request SmugglingCVE-2026-88773Public exploit9.3 Critical
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreFeature policy bypass due to improper HTTP URL based expression usageCVE-2026-88774Public exploit7.0 High
- citrix netscaler, netscaler gateway, citrix netscaler adc +2 more +4 moreMemory overflow vulnerability leading to Remote Code Execution or Denial of ServiceCVE-2026-88772In KEVPublic exploitEPSS 76.6%9.5 Critical
- citrix netscaler, netscaler gateway, citrix netscaler adc +2 more +4 moreA remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commandsCVE-2026-88771In KEVPublic exploitEPSS 81.9%9.5 Critical
- edgelesssys contrastContrast before 1.16.0 Remote Attestation Relay AttackCVE-2026-100835Public exploit9.1 Critical
- edgelesssys contrastContrast before 1.23.1 Image Substitution via Policy GenerationCVE-2026-100833Public exploit8.6 High
- patriksimek vm2vm2 before 3.12.2 Authorization Bypass via Custom ResolverCVE-2026-100721Public exploitFix available9.5 Critical
- d-link dir-895lD-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds writeCVE-2026-100740Public exploit9.4 Critical
- themefic ultra addons for contact form 7Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form FieldCVE-2026-82901Public exploit9.8 Critical
- cyberlord92 miniorange otp login, verification and sms notificationsminiOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' ParameterCVE-2026-85984Public exploit9.8 Critical
- lomart up, lomart.fr up plugin for joomla +1 moreJoomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29CVE-2026-97161Public exploit9.2 Critical
- Show moreLoading…