Skip to contentVulnerabilities with public exploits
- No product listedAn issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary...CVE-2026-51954Public exploit8.1 High
- No product listedAn issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of...CVE-2026-107079Public exploit4.3 Medium
- tp-link systems inc. archer c6 v2Hardcoded AES encryption key in Archer C6CVE-2026-89052Public exploit5.9 Medium
- flarum frameworkLaravel TokenGuard authentication bypass through non-string API credentialsCVE-2026-114509Public exploitFix available9.2 Critical
- oracle corporation graalvm enterprise edition, graalvm for jdk, java se +2 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...CVE-2026-91403Public exploitFix available9.1 Critical
- python pillowPillow: Heap buffer overflow writing JPEG comment after ICC profile fills bufferCVE-2026-96778Public exploitFix available7.7 High
- jupyter nbconvertnbconvert: File write via path traversal in cell output filenamesCVE-2026-114140Public exploitFix available8.8 High
- gimpGIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityCVE-2026-92183Public exploitFix available7.8 High
- nomachineNoMachine Redis Improper Authentication Local Privilege Escalation VulnerabilityCVE-2026-92209Public exploit7.8 High
- nomachineNoMachine mDNS Heap-based Buffer Overflow Remote Code Execution VulnerabilityCVE-2026-92208Public exploit8.8 High
- cisco telepresence video communication server (vcs) expresswayCisco Expressway Series Remote Code Execution VulnerabilityCVE-2026-76466Public exploit9.8 Critical
- isc bind 9Concurrent GSS-TSIG messages corrupt memoryCVE-2026-94300Public exploitFix available8.1 High
- nlnet labs unboundDNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.CVE-2026-97206Public exploitFix available7.5 High
- kevin stover ninja formsWordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-110899Public exploit7.1 High
- php, paloaltonetworks pan-os, panorama virtual appliance +111 more +113 moreRCE via stale global stateCVE-2026-109619In KEVPublic exploitFix availableEPSS 100.0%9.2 Critical
- php, paloaltonetworks pan-os, panorama virtual appliance +110 more +112 moreRCE via OOM corruptionCVE-2026-109618In KEVPublic exploitFix availableEPSS 100.0%9.2 Critical
- oracle corporation application object libraryVulnerability in the Oracle Application Object Library product of Oracle E-Business Suite ...CVE-2026-101767Public exploit9.8 Critical
- oracle corporation mysql connectorsVulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The...CVE-2026-101678Public exploit4.3 Medium
- @modelcontextprotocol server, modelcontextprotocol typescript-sdk +1 moreModel Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to anotherCVE-2026-111770Public exploitFix available7.7 High
- gaijin entertainment war thunderWar Thunder Account ImpersonationCVE-2026-107692Public exploit4.8 Medium
- tox-dev filelockfilelock: ReadWriteLock follows a symlink at the lock path into SQLiteCVE-2026-112936Public exploitFix available6.1 Medium
- typo3 extension "typo3 shop by coding.ms"Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)CVE-2026-112071Public exploit6.9 Medium
- typo3 extension "typo3 shop by coding.ms"Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)CVE-2026-113468Public exploit6.9 Medium
- eventon - subscriberEventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' ParameterCVE-2026-93300Public exploit7.5 High
- bulwarkmail webmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A...CVE-2026-113386Public exploitFix available7.1 High
- apple ipados, macos, tvos +4 more +6 moreA double free issue was addressed with improved memory management. This issue is fixed in iOS 26...CVE-2026-86962Public exploit5.5 Medium
- python pillowPillow: Argument Injection in Ghostscript call, potentially leading into RCECVE-2026-112900Public exploitFix available9.2 Critical
- python pillowPillow: Heap buffer overflow in ImagingJpegDecodeCVE-2026-112403Public exploitFix available9.2 Critical
- python pillowPillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionCVE-2026-112398Public exploitFix available9.2 Critical
- mlflowMLflow < 3.18.0 Path Traversal via Trace ID APICVE-2026-53995Public exploitFix available8.8 High
- tp-link systems inc. tapo c320ws v2Authenticated Local Stack Overflow in TP-Link Tapo C320WSCVE-2026-105810Public exploit8.5 High
- fusionpbxFusionPBX Dialplan Editor dialplan.php os command injectionCVE-2026-112195Public exploit5.1 Medium
- mljar mercuryMercury: Unauthenticated Remote Code Execution via /api/kernelsCVE-2026-111058Public exploitFix available9.8 Critical
- surferWordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerabilityCVE-2026-112222Public exploit5.4 Medium
- bytecodealliance wasmtimeWasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionCVE-2026-115893Public exploitFix available9.9 Critical
- bytecodealliance wasmtimeWasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationCVE-2026-115889Public exploitFix available9.9 Critical
- go standard library crypto/x509Distrust compromised intermediate certificates in crypto/x509CVE-2026-111943Public exploitFix available6.8 Medium
- apache camelApache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code ExecutionCVE-2026-88900Public exploit8.8 High
- apache software foundation camelApache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is PresentCVE-2026-91858Public exploit6.5 Medium
- apache software foundation camelApache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by defaultCVE-2026-88901Public exploit8.2 High
- apache camelApache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token CacheCVE-2026-85317Public exploit4.8 Medium
- apache camelApache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path MatchingCVE-2026-85316Public exploit4.8 Medium
- apache camelApache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer ExceptionsCVE-2026-85315Public exploit5.3 Medium
- apache camelApache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)CVE-2026-85314Public exploit6.5 Medium
- apache camelApache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is SetCVE-2026-85313Public exploit4.3 Medium
- apache camelApache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action HeaderCVE-2026-85312Public exploit4.8 Medium
- apache software foundation camelApache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File PermissionsCVE-2026-85300Public exploit5.5 Medium
- apache software foundation camelApache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss ClaimCVE-2026-85301Public exploit4.8 Medium
- apache camelApache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request StateCVE-2026-85296Public exploit6.5 Medium
- apache camelApache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by DefaultCVE-2026-85260Public exploit5.5 Medium
- Show moreLoading…