Latest public exploits (page 13)
Page 13 of 20 of CVEs with public exploit evidence (CISA KEV, Metasploit, CVE-specific PoCs), newest evidence first.
CVEs with public exploits, newest evidence first (page 13 of 20)
| CVE | Severity | Exploitation evidence | Evidence date | Summary |
|---|---|---|---|---|
CVE-2026-26080 | Low 3.7 | 1 PoC | HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. | |
CVE-2026-112396 | Medium 5.9 | 1 PoC | Pillow is a Python imaging library. | |
CVE-2026-105445 | — | 6 PoCs | An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled… | |
CVE-2026-102826 | High 8.1 | 6 PoCs | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. | |
CVE-2023-27524 | High 8.9 | CISA KEV, Metasploit, 22 PoCs | Session Validation attacks in Apache Superset versions up to and including 2.0.1. | |
CVE-2021-40444 | High 8.8 | CISA KEV, Metasploit, 51 PoCs | Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. | |
CVE-2026-118527 | Medium 4.3 | CISA KEV | Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location… | |
CVE-2026-111357 | High 7.0 | CISA KEV | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026. | |
CVE-2026-97631 | — | 3 PoCs | EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. | |
CVE-2026-92935 | Critical 9.0 | 5 PoCs | vm2 is a sandbox for running untrusted Node.js code. | |
CVE-2026-92424 | Medium 6.8 | 1 PoC | The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author'… | |
CVE-2026-88778 | High 7.5 | 5 PoCs | Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. | |
CVE-2026-88777 | Critical 9.8 | 5 PoCs | Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. | |
CVE-2026-88776 | Critical 9.8 | 6 PoCs | Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. | |
CVE-2026-88775 | Critical 9.8 | 5 PoCs | Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. | |
CVE-2026-88774 | High 7.2 | 5 PoCs | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. | |
CVE-2026-69254 | High 8.8 | 5 PoCs | Flowise is a drag & drop user interface to build a customized large language model flow. | |
CVE-2026-58044 | Low 3.7 | 5 PoCs | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the orig… | |
CVE-2026-58043 | High 8.4 | 5 PoCs | A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse b… | |
CVE-2026-58045 | Medium 6.2 | 5 PoCs | A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. | |
CVE-2026-58042 | Medium 5.9 | 5 PoCs | A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. … | |
CVE-2026-58041 | Medium 5.3 | 5 PoCs | A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound… | |
CVE-2026-58040 | Medium 6.3 | 5 PoCs | An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects… | |
CVE-2026-58039 | Low 3.3 | 5 PoCs | A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. | |
CVE-2026-56850 | Medium 4.4 | 5 PoCs | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client ce… | |
CVE-2026-56848 | High 7.5 | 6 PoCs | A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerabil… | |
CVE-2026-56847 | Medium 6.1 | 5 PoCs | A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the… | |
CVE-2026-56846 | High 7.5 | 5 PoCs | A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**. | |
CVE-2026-26026 | Critical 9.1 | 4 PoCs | GLPI is a free asset and IT management software package. | |
CVE-2026-19490 | Critical 9.8 | CISA KEV, 7 PoCs | Vulnerability in NetScaler ADC and NetScaler Gateway. | |
CVE-2026-19489 | — | 5 PoCs | Vulnerability in NetScaler ADC and NetScaler Gateway. | |
CVE-2026-17106 | — | 8 PoCs | The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. | |
CVE-2026-106074 | Medium 4.8 | 5 PoCs | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-s… | |
CVE-2026-106073 | Low 3.3 | 5 PoCs | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. | |
CVE-2026-106072 | Medium 6.7 | 5 PoCs | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`… | |
CVE-2026-106071 | Low 3.6 | 5 PoCs | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. | |
CVE-2026-106070 | Low 3.7 | 5 PoCs | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. | |
CVE-2026-106069 | High 7.4 | 5 PoCs | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 l… | |
CVE-2026-105483 | High 7.4 | 5 PoCs | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters… | |
CVE-2026-105482 | High 7.4 | 7 PoCs | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). | |
CVE-2026-105481 | Medium 6.5 | 5 PoCs | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. | |
CVE-2026-104935 | High 8.6 | CISA KEV, 9 PoCs | Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. | |
CVE-2026-104849 | — | 5 PoCs | Tinypool is a minimal Node.js worker thread pool implementation. | |
CVE-2026-104286 | Critical 9.8 | CISA KEV, 10 PoCs | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8… | |
CVE-2026-102764 | Critical 9.8 | CISA KEV, 7 PoCs | The vulnerability exists within internal components of BeyondTrust’s Remote Support product. | |
CVE-2026-102258 | Medium 6.1 | 5 PoCs | Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remot… | |
CVE-2026-102257 | High 7.2 | 5 PoCs | A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted ar… | |
CVE-2026-102256 | High 7.8 | 5 PoCs | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions… | |
CVE-2026-102255 | Critical 10.0 | 7 PoCs | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. | |
CVE-2018-17463 | High 8.8 | CISA KEV, Metasploit, 3 PoCs | Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |