Skip to contentVulnerabilities with public exploits
- demsking image-downloaderImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloaderCVE-2026-103648Public exploit9.1 Critical
- gitlab ai gatewayImproper Neutralization of Special Elements Used in a Template Engine in GitLab AI GatewayCVE-2026-90970Public exploitEPSS 17.5%9.9 Critical
- amauric wpmobile.app – android and ios app builderWPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' ParameterCVE-2026-94541Public exploit9.8 Critical
- diviengine divi membershipDivi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' ParameterCVE-2026-19660Public exploit9.8 Critical
- dplugins devkit proDevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch FlowCVE-2026-14378Public exploit9.8 Critical
mediawiki Debian[Unknown description]CVE-2026-102975Public exploitFix availableNo scoremediawiki Debian[Unknown description]CVE-2026-102973Public exploitFix availableNo scoremediawiki Debian[Unknown description]CVE-2026-102971Public exploitFix availableNo score- hascheksolutions pictsharePictShare < 3.7.1 Predictable Delete Code via rand()CVE-2026-104356Public exploit8.2 High
- hascheksolutions pictsharePictShare < 3.7.1 Sensitive Information Disclosure via info APICVE-2026-104051Public exploit8.8 High
- fortinet fortimailAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability...CVE-2026-104286In KEVPublic exploit9.8 Critical
- confluent confluent-kafkaConfluent Kafka Python Improper TLS Certificate ValidationCVE-2026-15911Public exploitFix available7.4 High
- @capacitor android, ios, ionic-team capacitor +2 more +4 moreCapacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy pathCVE-2026-103922Public exploitFix available9.3 Critical
- apache http serverApache HTTP Server: mod_xml2enc crash on charset conversion failureCVE-2026-63686Public exploitFix available7.5 High
- apache http serverApache HTTP Server: mod_vhost_alias stack overflowCVE-2026-63292Public exploitFix available7.5 High
- elastic endpoint securityWatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory AccessCVE-2026-13043Public exploit9.3 Critical
- codeastro leave management systemitsourcecode Leave Management System controller.php sql injectionCVE-2026-103690Public exploit5.3 Medium
- paul ryan authorizerWordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerabilityCVE-2026-103752Public exploit9.8 Critical
- ultimate member memberWordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerabilityCVE-2026-62059Public exploit7.6 High
- apache software foundation camel quarkusApache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardeningCVE-2026-88789Public exploit8.6 High
- webrehab super forms – drag & drop form builderSuper Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' ParameterCVE-2026-15989Public exploit9.8 Critical
- genians, inc genian nac 5.0.75 lts release, genian nac 5.0.85 release stable, genian nac 5.0.86 release +3 more +5 moreGenians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal InterfaceCVE-2026-76142Public exploit9.3 Critical
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name FieldCVE-2026-92966Public exploit9.1 Critical
- the wikimedia foundation mediawiki mediasearch extensionattacker-controlled javascript license URL via XSSCVE-2026-103585Public exploit1.2 Low
- the wikimedia foundation mediawiki commonsmetadata extensionattacker-controlled javascript license URL via XSSCVE-2026-103584Public exploit1.1 Low
- the wikimedia foundation mediawiki pagetriage extensionpagetriagelist discloses suppressed reviewer usernamesCVE-2026-103440Public exploit1.2 Low
- the wikimedia foundation mediawiki readinglists extensionReadingLists imported metadata permits JavaScript URL XSSCVE-2026-103437Public exploit1.1 Low
- the wikimedia foundation mediawiki wikilambda extensionWikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragmentsCVE-2026-103446Public exploit7.4 High
- the wikimedia foundation mediawiki page forms extensionStored XSS through PageForms #autoedit redirect linksCVE-2026-103445Public exploit1.2 Low
- quenary tugtainerTugtainer: OIDC id_token claims accepted without signature/audience/expiry verificationCVE-2026-87004Public exploit8.1 High
- quenary tugtainerTugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unsetCVE-2026-55494Public exploit9.8 Critical
- zammadUndisclosed RCE in Zammad v6.3 and higherCVE-2026-102489In KEVPublic exploitEPSS 49.9%8.7 High
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreSSLContext.wrap_bio() missing validation of server_hostname parameterCVE-2026-19553Public exploitFix available7.6 High
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreUse-after-free of a server-side SSLContext when sni_callback switches contextsCVE-2026-19445Public exploitFix available9.2 Critical
- the wikimedia foundation mediawiki centralauth extensionMergeAccount PHP object injection via session-key substitutionCVE-2026-103442Public exploit7.2 High
- the wikimedia foundation mediawiki wikibase extensionUnauthenticated arbitrary file deletion through Wikibase serialized entity parsingCVE-2026-103441Public exploit7.2 High
- ordasoft joomla cck, ordasoft.com ordasoft joomla cck +1 moreJoomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16CVE-2026-102427Public exploit10.0 Critical
- vercel satori, next +1 moreSatori-generated SVG has improper escapingCVE-2026-94545Public exploitFix available5.3 Medium
- joomcode jc tables, joomcode.com jctables extension for joomla +1 moreJoomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1CVE-2026-76570Public exploit10.0 Critical
- trex digital smart manufacturing systems inc. mesSQL Injection in Trex Digital Manufacturing's Trex MESCVE-2026-18782Public exploit9.8 Critical
- trex digital smart manufacturing systems inc. mesMissing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MESCVE-2026-18783Public exploit8.8 High
- litespeed technologies web server, litespeedtech litespeed web server +1 moreLiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a...CVE-2026-93903Public exploit9.4 Critical
- cisco catalyst sd-wan managerCisco Catalyst SD-WAN Manager System Account Authorization Bypass VulnerabilityCVE-2026-76504In KEVPublic exploitEPSS 38.9%9.8 Critical
- wp chill strong testimonialsWordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-97286Public exploit6.5 Medium
- yoohw studio blacklist manager – woocommerce anti-fraud, blacklist & checkout verificationWordPress Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-96838Public exploit8.8 High
- siteskiteWordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerabilityCVE-2026-96349Public exploit10.0 Critical
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerabilityCVE-2026-94074Public exploit6.5 Medium
- red hat openshift container platform 4.16, openshift container platform 5 +1 moreCri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socketCVE-2026-62146Public exploit7.8 High
- moodleMoodle: sql injection in question bank web serviceCVE-2026-102578Public exploitFix available5.5 Medium
- kazukiyanamoto post views stats counterPost Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent HeaderCVE-2026-97347Public exploit7.2 High
- Show moreLoading…