Skip to contentVulnerabilities with public exploits
- apache software foundation camelApache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token CacheCVE-2026-94386Public exploit4.8 Medium
- google mcp toolbox for databases (googleapis/mcp-toolbox)Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and WriteCVE-2026-93328Public exploit9.3 Critical
- nxp mcuxsdk-middleware-usbNXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class DriversCVE-2026-116488Public exploit7.0 High
- nxp mcuxsdk-middleware-usbNXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds ReadCVE-2026-116487Public exploit5.1 Medium
- maccmspro maccms10MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery CodeCVE-2026-116214Public exploit9.3 Critical
- apache camelApache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)CVE-2026-95628Public exploit5.4 Medium
- apache camelApache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary DirectoryCVE-2026-95629Public exploit5.4 Medium
- apache camelApache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token ExpiryCVE-2026-95663Public exploit4.8 Medium
- apache camelApache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple ExpressionsCVE-2026-95664Public exploit5.4 Medium
- apache camelApache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer ExceptionsCVE-2026-101259Public exploit5.3 Medium
- 2k games civilization v, 2k sid meiers civilization v +1 more2K Games Civilization V Lua Sandbox loadstring type confusionCVE-2026-116111Public exploit5.3 Medium
- No product listedHeyCyan App FileProvider access controlCVE-2026-116106Public exploit6.9 Medium
- No product listedHeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmissionCVE-2026-116105Public exploit6.3 Medium
- No product listedSQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote...CVE-2026-31158Public exploit9.8 Critical
- microsoft .net 10.0 installed on linux, .net 10.0 installed on mac os, .net 10.0 installed on windows +11 more +13 moreASP.NET Core Elevation of Privilege VulnerabilityCVE-2026-114148Public exploitFix available7.8 High
- No product listedNexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.CVE-2026-107092Public exploit9.8 Critical
- No product listedAn issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0...CVE-2026-106781Public exploit7.8 High
- No product listedDedeCMS update_guide.php require_once code injectionCVE-2026-116063Public exploit5.1 Medium
- rcloneRclone before 1.75.2 Path Traversal via serve webdav MKCOLCVE-2026-116191Public exploitFix available8.7 High
- onyx-dot-app onyxonyx-dot-app Onyx PreviewTab.tsx cross site scriptingCVE-2026-116004Public exploit5.1 Medium
- zylon privategptZylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgeryCVE-2026-116000Public exploit6.9 Medium
- oracle corporation graalvm enterprise edition, graalvm for jdk, java se +2 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...CVE-2026-114820Public exploitFix available9.1 Critical
- nationalsecurityagency ghidraGhidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler ParserCVE-2026-116012Public exploit2.0 Low
- crowcpp crowCrow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()CVE-2026-116011Public exploit8.7 High
- woobewoo product filter by wbwWordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerabilityCVE-2026-112866Public exploit9.3 Critical
- noah hearle we’re open!WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-112869Public exploit7.1 High
- nodejs nodeA flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not...CVE-2026-106071Public exploitFix available3.6 Low
- nodejs nodeA flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the...CVE-2026-106070Public exploitFix available3.7 Low
- huggingface datasetsHugging Face Datasets < 5.2.0 Pickle Deserialization RCE via Pandas BuilderCVE-2026-57845Public exploit8.7 High
- cactiCacti: Authenticated RCE on Data InputCVE-2026-39902Public exploitFix available7.2 High
- openwrt odhcpdodhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)CVE-2026-53921Public exploit9.8 Critical
- linuxperf/core: Check kernel access when kernel callchains are requestedCVE-2026-98937Public exploitFix availableNo score
- nodejs nodeA flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to...CVE-2026-106072Public exploitFix available6.7 Medium
- asus routerImproper Authentication in ASUS router modules allows an unauthenticated nearby user to send an...CVE-2026-93489Public exploit8.7 High
- No product listede-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption...CVE-2026-50787Public exploit7.5 High
- nodejs nodeA flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, ...CVE-2026-106074Public exploitFix available4.8 Medium
- nodejs nodeA flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the...CVE-2026-106073Public exploitFix available3.3 Low
- nodejs nodeA flaw in Node.js TLS hostname verification can cause a server certificate to be validated...CVE-2026-106069Public exploitFix available7.4 High
- nodejs nodeA flaw in Node.js TLS hostname verification allows a certificate without a matching IP address...CVE-2026-105483Public exploitFix available7.4 High
- nodejs nodeA flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated...CVE-2026-105482Public exploitFix available7.4 High
- nodejs nodeA flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response...CVE-2026-105481Public exploitFix available6.5 Medium
- arista velocloud orchestratorSecurity Advisory 0199CVE-2026-114625In KEVPublic exploit9.4 Critical
- berriai litellmLiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt KeyCVE-2026-114612Public exploitFix available9.9 Critical
- phpoffice phpspreadsheetPhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loadingCVE-2026-108360Public exploitFix available6.4 Medium
- tianocore edk2Pre-boot RCE in EDK II PXE driverCVE-2026-97631Public exploitFix available9.5 Critical
- jetbackupJetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup RestoreCVE-2026-104068Public exploit8.6 High
- expressjs multermulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownCVE-2026-113872Public exploitFix available7.5 High
- yootheme.com yootheme pro extension for joomlaJoomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52CVE-2026-102785Public exploit10.0 Critical
- traefikTraefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host MatcherCVE-2026-114656Public exploit6.9 Medium
- gitlabInteger Overflow or Wraparound in GitLabCVE-2026-110264Public exploitFix available10.0 Critical
- Show moreLoading…