Skip to contentVulnerabilities with public exploits
- mozilla firefox, thunderbird +1 moreJIT miscompilation in the JavaScript Engine: JIT componentCVE-2026-109722Public exploitFix available8.1 High
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the JavaScript Engine: JIT componentCVE-2026-109721Public exploitFix available5.4 Medium
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the JavaScript Engine componentCVE-2026-109715Public exploitFix available8.1 High
- No product listedblob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability....CVE-2026-104587Public exploit5.4 Medium
- No product listedMobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, ...CVE-2026-104585Public exploit9.8 Critical
- No product listedreNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99)...CVE-2026-104584Public exploit9.8 Critical
- zofe rapyd-adminRapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeederCVE-2026-109566Public exploit9.3 Critical
- getkirby kirbygetkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorizationCVE-2026-108924Public exploit5.3 Medium
- zitadelZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider ConfusionCVE-2026-109372Public exploit9.3 Critical
- freerdpFreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_lengthCVE-2026-109255Public exploitFix available6.1 Medium
- linuxsched/cache: Decouple sched_cache_group from mm to fix UAFCVE-2026-98385Public exploitFix available7.8 High
- rapid7 metasploit frameworkMetasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code ExecutionCVE-2026-87690Public exploit8.8 High
- neterbit nw-431fNeterbit NW-431F Embedded Web Server sms.json information disclosureCVE-2026-108578Public exploit6.9 Medium
- floci-io flociFloci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping TemplatesCVE-2026-108598Public exploit9.3 Critical
- swe-agent mini-swe-agentmini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironmentCVE-2026-108592Public exploit6.0 Medium
- miniorange otp verificationWordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerabilityCVE-2026-106610Public exploit9.8 Critical
- ferdikoomen openapi-typescript-codegenopenapi-typescript-codegen through 0.31.0 Code Injection via Handlebars TemplatesCVE-2026-108551Public exploit9.3 Critical
- cthackers adm-zipadm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error EventCVE-2026-114102Public exploitFix available8.7 High
- divi essential plusDivi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' ParameterCVE-2026-91136Public exploit7.5 High
- expivi 3d product configurator for woocommerce3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' ParameterCVE-2026-103889Public exploit9.8 Critical
- go-vikunja vikunjaVikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeoverCVE-2026-62367Public exploitFix available7.5 High
- devolutions server, mariadb +1 moreMariaDB: insufficient validation of binary frm data when opening a tableCVE-2026-107821Public exploitFix available8.0 High
- argoproj argo-cdArgo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLCVE-2026-55797Public exploitFix available8.8 High
- smartertools smartermailSmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume MountCVE-2026-104082Public exploit8.6 High
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Authenticated Remote Code Execution via Backup Restore App Config OverwriteCVE-2026-107806Public exploitFix available9.4 Critical
- px-lab zombifyWordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerabilityCVE-2026-94503Public exploit10.0 Critical
- stiofan userswpWordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-94641Public exploit7.1 High
- codemstory 워드프레스 결제 심플페이WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerabilityCVE-2026-95597Public exploit6.5 Medium
- nearform fast-jwtfast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly setCVE-2026-107720Public exploitFix available7.4 High
- netscaler adc, gateway +1 moreMemory overflow vulnerability leading to Remote Code Execution or Denial of ServiceCVE-2026-107406Public exploit9.5 Critical
- zuler technology deskinDeskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated InstallerCVE-2026-11318Public exploit8.5 High
- corazawaf corazaCoraza before 3.8.1 Multipart filename* Charset Handling FILES Rule BypassCVE-2026-114101Public exploitFix available6.3 Medium
- zimbra collaboration suiteZimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable ExpansionCVE-2026-50055Public exploit6.5 Medium
- ollamaPath Traversal leading to Remote Code Execution in OllamaCVE-2026-103663Public exploit6.9 Medium
- akin software computer import-export industry and trade co. ltd. akinsoft wolvox control panelDatabase Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control PanelCVE-2026-92555Public exploit9.8 Critical
- bricksforgeBricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' ParameterCVE-2026-85097Public exploit9.8 Critical
- devolutions server, mariadb +1 moreMariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.CVE-2026-92262Public exploitFix available9.9 Critical
- splunk, splunk enterprise +1 moreMissing Authentication for Critical Function in the Patroni REST API in Splunk EnterpriseCVE-2026-76268Public exploit9.8 Critical
- drupal two factor authentication - tfa / passwordless loginTwo Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207CVE-2026-107268Public exploitFix available4.3 Medium
- sipcapture homerHomer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)CVE-2026-62253Public exploitFix available9.8 Critical
- apache jackrabbitApache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokensCVE-2026-92414Public exploit9.3 Critical
- telegram desktopTelegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: SchemeCVE-2026-107181Public exploitFix available8.6 High
- sonicwall sma1000Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the...CVE-2026-102258Public exploit6.1 Medium
- sonicwall sma1000A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface...CVE-2026-102257Public exploit7.2 High
- sonicwall sma1000Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS...CVE-2026-102256Public exploit7.8 High
- sonicwall sma1000A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due...CVE-2026-102255Public exploit10.0 Critical
- miniupnp project miniupnpdMiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX HeaderCVE-2026-107159Public exploit7.1 High
- lmcacheLMCache Unauthenticated RCE in multiprocess mode via pickle deserializationCVE-2026-105192Public exploitFix available9.8 Critical
- ordasoft.com ordasoft simple membership extension for joomlaJoomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0CVE-2026-102782Public exploit9.3 Critical
- vmware fusion, workstation +1 moreVMware Workstation and Fusion VMXNET3 integer-overflow vulnerabilityCVE-2026-59346Public exploit9.3 Critical
- Show moreLoading…