Latest public exploits
15,073 CVEs with public exploit evidence, newest first: 1,780 on CISA KEV, 3,191 with a Metasploit module, 12,173 with a CVE-specific PoC.
What this list is
Every CVE listed here has exploitation evidence that CVE Explore collects itself: a listing on the CISA Known Exploited Vulnerabilities catalog, a Metasploit module, or a public proof-of-concept repository written for that CVE. A repository that lists many CVEs (a feed, an awesome-list, a scanner template dump) is not counted as evidence for any of them.
15,073 CVEs qualify: 1,780 on CISA KEV, 3,191 with a Metasploit module and 12,173 with a CVE-specific PoC. The list is ordered by the newest evidence (a KEV addition or a newly discovered PoC), is rebuilt hourly, and shows the most recent 1,000 entries.
CVEs with public exploits, newest evidence first (page 1 of 20)
| CVE | Severity | Exploitation evidence | Evidence date | Summary |
|---|---|---|---|---|
CVE-2026-126170 | Critical 9.8 | 1 PoC | A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud… | |
CVE-2026-98260 | High 7.8 | 62 PoCs | In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attach… | |
CVE-2026-89324 | Critical 9.8 | 1 PoC | The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. | |
CVE-2026-70054 | High 7.8 | 1 PoC | Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally. | |
CVE-2026-44212 | Critical 9.3 | 1 PoC | PrestaShop is an open source e-commerce web application. | |
CVE-2026-33050 | High 8.8 | 2 PoCs | GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. | |
CVE-2026-19803 | Critical 9.8 | 1 PoC | The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. | |
CVE-2026-124194 | Medium 6.5 | CISA KEV, 2 PoCs | Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. | |
CVE-2026-123158 | High 8.1 | CISA KEV, 33 PoCs | sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be… | |
CVE-2026-121529 | Critical 9.6 | 4 PoCs | A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, F… | |
CVE-2026-119948 | High 7.5 | 1 PoC | Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network. | |
CVE-2026-112174 | — | 1 PoC | Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privile… | |
CVE-2026-111497 | Critical 9.8 | CISA KEV, 103 PoCs | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent deco… | |
CVE-2026-109618 | Critical 9.8 | CISA KEV, 859 PoCs | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. | |
CVE-2024-4442 | Critical 9.1 | 2 PoCs | The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. | |
CVE-2024-36779 | Critical 9.8 | 2 PoCs | Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php. | |
CVE-2024-3495 | Critical 9.8 | 4 PoCs | The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' parameters in versions up to, and including, 2.7.2 due to insufficient escaping on the… | |
CVE-2023-46604 | Critical 10.0 | CISA KEV, Metasploit, 50 PoCs | The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. | |
CVE-2020-24186 | Critical 10.0 | Metasploit, 11 PoCs | A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via th… | |
CVE-2009-2265 | — | Metasploit, 24 PoCs | Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to u… | |
CVE-2026-76466 | Critical 9.8 | 3 PoCs | A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operat… | |
CVE-2026-68982 | — | 1 PoC | Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. | |
CVE-2026-67176 | Medium 5.4 | 1 PoC | Chargemap contains an open redirect vulnerability in the authentication login endpoint. | |
CVE-2026-67175 | Medium 4.6 | 1 PoC | Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in the user profile page that executes when another user views… | |
CVE-2026-60137 | Medium 5.9 | CISA KEV, Metasploit, 15 PoCs | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme pa… | |
CVE-2026-43499 | High 7.8 | 253 PoCs | In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also use… | |
CVE-2026-43284 | High 8.8 | Metasploit, 64 PoCs | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. | |
CVE-2026-116606 | — | CISA KEV, 2 PoCs | An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted… | |
CVE-2026-115252 | Critical 10.0 | 1 PoC | The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone P… | |
CVE-2026-110264 | Critical 10.0 | 14 PoCs | An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and… | |
CVE-2026-105425 | High 7.2 | 1 PoC | OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker wi… | |
CVE-2024-6387 | High 8.1 | 128 PoCs | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). | |
CVE-2024-47176 | Medium 5.3 | Metasploit, 18 PoCs | CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. | |
CVE-2021-30563 | High 8.8 | CISA KEV, 1 PoC | Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
CVE-2018-19320 | High 7.8 | CISA KEV, 6 PoCs | The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionalit… | |
CVE-2013-1453 | — | 1 PoC | plugins/system/highlight/highlight.php in Joomla! | |
CVE-2026-76964 | Critical 10.0 | 1 PoC | SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. | |
CVE-2026-126187 | — | 1 PoC | React is a JavaScript library for building user interfaces. | |
CVE-2026-125753 | Medium 5.9 | 1 PoC | ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files o… | |
CVE-2026-125350 | High 8.8 | CISA KEV, 3 PoCs | Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. | |
CVE-2026-124079 | Critical 9.8 | 1 PoC | rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by push… | |
CVE-2026-123618 | Medium 6.8 | 1 PoC | ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. | |
CVE-2026-118383 | Critical 9.0 | 1 PoC | A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. | |
CVE-2026-117635 | Medium 6.5 | 1 PoC | The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. | |
CVE-2026-105437 | High 7.5 | 1 PoC | Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. | |
CVE-2025-32432 | Critical 10.0 | CISA KEV, Metasploit, 20 PoCs | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. | |
CVE-2023-36845 | Critical 9.8 | CISA KEV, Metasploit, 28 PoCs | A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. | |
CVE-2022-3653 | High 8.8 | 2 PoCs | Heap buffer overflow in Vulkan in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
CVE-2022-23131 | Critical 9.1 | CISA KEV, 25 PoCs | In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. | |
CVE-2026-97799 | High 7.8 | 1 PoC | Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally. |