Skip to contentVulnerabilities with public exploits
- bishopfox sliverSliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG DecoderCVE-2026-77622Public exploitFix available8.2 High
- wavlink wn530hg4bWavlink WN530HG4B api.cgi heap-based overflowCVE-2026-110958Public exploit10.0 Critical
- opnsense coreOPNsense: Root RCE via Arbitrary File Write in GeoIP Alias ImporterCVE-2026-57155Public exploit9.9 Critical
- opnsense coreOPNsense: XPATH Injection can disclose any secret in config.xmlCVE-2026-53582Public exploit7.1 High
- siemens software centerA vulnerability has been identified in Siemens Software Center (All versions). The affected...CVE-2026-110936In KEVPublic exploit8.4 High
- linuxipv4: validate checksum_start before completing checksumCVE-2026-99999Public exploitFix available9.3 Critical
- linux, linux kernel +1 moreipv4: free inet_opt and ireq_opt after an RCU grace periodCVE-2026-98432Public exploitFix available9.8 Critical
- carazo import and export users and customersImport and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile FieldsCVE-2026-17001Public exploit6.4 Medium
- dragonflybsdIn DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput()...CVE-2026-110912Public exploit7.1 High
- No product listedDirectory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to...CVE-2026-78851Public exploit6.5 Medium
matomo DebianAn issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the...CVE-2026-78850Public exploitDisputed5.0 Medium- No product listedAn issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the...CVE-2026-36436Public exploit7.5 High
- No product listedAUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in...CVE-2026-104586Public exploit9.8 Critical
- error311 fileriseFileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.phpCVE-2026-104110Public exploit5.3 Medium
- error311 fileriseFileRise: Session-scoped TOTP rate limiting permits repeated verification attemptsCVE-2026-103977Public exploit8.1 High
- tp-link systems inc. re190 v5, re200 v5, re205 v4 +13 more +15 moreImproper Authentication in Multiple TP-Link WiFi RepeatersCVE-2026-109506Public exploit5.9 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +2 more +4 morePAN-OS: Authenticated Remote Code Execution (RCE) in the Management InterfaceCVE-2026-0322In KEVPublic exploit8.6 High
- drupal coreDrupal core - Critical - Remote code execution - SA-CORE-2026-014CVE-2026-108097Public exploitFix available8.1 High
- cisco secure email, secure email gateway, asyncos +2 moreCisco Secure Email Gateway Arbitrary File Write VulnerabilityCVE-2026-76519In KEVPublic exploit9.8 Critical
- discourseDiscourse: Stored oEmbed HTML injection via allowed iframeCVE-2026-91159Public exploitFix available7.7 High
- f5 nginx open source, nginx plus +1 moreNGINX ngx_http_core_module vulnerabilityCVE-2026-97205Public exploitFix available9.2 Critical
- f5 nginx open source, nginx plus +1 moreNGINX ngx_http_ssl_module vulnerabilityCVE-2026-97629Public exploitFix available8.3 High
- f5 nginx open source, nginx plus +1 moreNGINX ngx_http_core_module vulnerabilityCVE-2026-15176Public exploitFix available9.2 Critical
- giteaGitea Org-mode file disclosure and code executionCVE-2026-59774Public exploitEPSS 28.3%9.8 Critical
- danday74 git-diffgit-diff before 2.0.7 OS Command Injection via gitDiff Input StringsCVE-2026-110634Public exploitFix available9.3 Critical
- red hat enterprise linux 10, enterprise linux 10.2 extended update support, enterprise linux 6 +3 more +5 moreGstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserializeCVE-2026-86476Public exploitFix available8.4 High
- wpazleen simpleform – form maker to chat apps with quiz, poll and multi lead notificationsSimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_registerCVE-2026-104748Public exploit9.8 Critical
- curlHTTP/2 upload Use-After-FreeCVE-2026-92392Public exploitFix available8.1 High
- collabora online - built-in code server, online – built-in code server +1 moreCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app,...CVE-2026-110447In KEVPublic exploitEPSS 73.3%9.2 Critical
- tyche softwares abandoned cart pro for woocommerceAbandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' ParameterCVE-2026-97657Public exploit9.8 Critical
- microsoft .net 10.0 runtime, .net 11.0 runtime, .net 8.0 runtime +11 more +13 moreMicrosoft QUIC Remote Code Execution VulnerabilityCVE-2026-105016Public exploitFix available9.8 Critical
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows Audio Service Elevation of Privilege VulnerabilityCVE-2026-97799Public exploit7.8 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 moreWindows Error Reporting Service Elevation of Privilege VulnerabilityCVE-2026-97798Public exploit7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 moreWindows Setup and Deployment Elevation of Privilege VulnerabilityCVE-2026-97793Public exploit7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows NetBIOS Elevation of Privilege VulnerabilityCVE-2026-70054Public exploit7.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows Health and Optimized Experiences Service Elevation of Privilege VulnerabilityCVE-2026-85884Public exploit7.8 High
- microsoft paintWindows Paint Remote Code Execution VulnerabilityCVE-2026-83844Public exploit7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Kernel-Mode Drivers Elevation of Privilege VulnerabilityCVE-2026-83834Public exploit7.0 High
- microsoft powertoysMicrosoft PowerToys Tampering VulnerabilityCVE-2026-83681Public exploit5.5 Medium
- adobe commerce, commerce b2b, magento open source +1 more +3 moreAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)CVE-2026-103849Public exploitFix available10.0 Critical
- fortinet fortisiemA improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in...CVE-2026-106173Public exploit9.4 Critical
- docker hubDocker Hub account conversion could reassign an active personal access token to another userCVE-2026-105445Public exploit9.4 Critical
- phpwcmsslackero phpwcms Extension Check cnt23.article.inc.php unrestricted uploadCVE-2026-110025Public exploit6.9 Medium
- ivanti connect secureAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated...CVE-2026-104935In KEVPublic exploitEPSS 88.9%8.6 High
- No product listedYouTransfer Template Rendering template path traversalCVE-2026-109519Public exploit6.9 Medium
- wazuh wazuh-managerWazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom CommandCVE-2026-74034Public exploit8.7 High
- gitlab, gitlab community edition and enterprise edition, ruby-lang ruby +2 moreInteger Overflow or Wraparound in GitLabCVE-2026-97229In KEVPublic exploitFix availableEPSS 69.3%10.0 Critical
- sap se netweaver and sap web dispatcher (internet communication manager)Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)CVE-2026-58249Public exploit7.5 High
- microsoft visual studio 2022 version 17.14, visual studio 2026 version 18.10, microsoft.aspnetcore.components.webassembly.server +2 moreASP.NET Core Remote Code Execution VulnerabilityCVE-2026-96230Public exploitFix available8.8 High
- No product listedAn issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed...CVE-2026-37107Public exploit9.8 Critical
- Show moreLoading…