Latest public exploits (page 14)
Page 14 of 20 of CVEs with public exploit evidence (CISA KEV, Metasploit, CVE-specific PoCs), newest evidence first.
CVEs with public exploits, newest evidence first (page 14 of 20)
| CVE | Severity | Exploitation evidence | Evidence date | Summary |
|---|---|---|---|---|
CVE-2017-11882 | High 7.8 | CISA KEV, Metasploit, 46 PoCs | Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of t… | |
CVE-2013-1690 | High 8.8 | CISA KEV, Metasploit, 2 PoCs | Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with pag… | |
CVE-2026-97785 | Critical 10.0 | 2 PoCs | Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network. | |
CVE-2026-97555 | High 8.8 | 1 PoC | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a buf… | |
CVE-2026-95664 | Medium 5.4 | 1 PoC | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. | |
CVE-2026-95663 | Medium 4.8 | 1 PoC | Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. | |
CVE-2026-95629 | Medium 5.4 | 1 PoC | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. | |
CVE-2026-95628 | Medium 5.4 | 1 PoC | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. | |
CVE-2026-94300 | High 8.1 | 3 PoCs | Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". | |
CVE-2026-94386 | Medium 4.8 | 1 PoC | Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component. | |
CVE-2026-90885 | High 7.5 | 1 PoC | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. | |
CVE-2026-89035 | High 7.4 | 2 PoCs | MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new E… | |
CVE-2026-88804 | Critical 9.6 | 1 PoC | An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2… | |
CVE-2026-83938 | Critical 10.0 | 2 PoCs | Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network. | |
CVE-2026-76475 | Critical 9.3 | 2 PoCs | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Ma… | |
CVE-2026-76474 | Critical 9.8 | 2 PoCs | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Ma… | |
CVE-2026-76473 | Critical 9.8 | 2 PoCs | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Ma… | |
CVE-2026-71569 | Medium 4.8 | 1 PoC | Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. | |
CVE-2026-71195 | Critical 9.9 | 2 PoCs | In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. | |
CVE-2026-50053 | High 8.7 | 1 PoC | A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. | |
CVE-2026-43664 | Medium 5.5 | 1 PoC | This issue was addressed with improved data protection. | |
CVE-2026-15723 | High 8.2 | 2 PoCs | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enab… | |
CVE-2026-115889 | Critical 9.9 | 2 PoCs | Wasmtime is a runtime for WebAssembly. | |
CVE-2026-113870 | High 8.8 | 2 PoCs | MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. | |
CVE-2026-110311 | Medium 4.3 | 1 PoC | Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. | |
CVE-2026-110063 | Critical 10.0 | 2 PoCs | Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network. | |
CVE-2026-105014 | Critical 9.1 | 2 PoCs | Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network. | |
CVE-2026-101259 | Medium 5.3 | 1 PoC | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. | |
CVE-2025-4960 | High 7.8 | 1 PoC | The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege escalation vulnerability due to multiple flaws in its implementation. | |
CVE-2024-23897 | Critical 9.8 | CISA KEV, Metasploit, 75 PoCs | Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents… | |
CVE-2023-7356 | High 8.8 | 2 PoCs | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID Copy the content of a Periodic Advertisement Report to BAS… | |
CVE-2019-18980 | High 7.5 | 1 PoC | On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. | |
CVE-2026-42533 | High 8.1 | 15 PoCs | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map out… | |
CVE-2026-24090 | High 7.1 | 2 PoCs | Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow. | |
CVE-2026-109722 | High 8.1 | 1 PoC | JIT miscompilation in the JavaScript Engine: JIT component. | |
CVE-2023-4622 | High 7.8 | 4 PoCs | A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. | |
CVE-2022-20186 | High 7.8 | 6 PoCs | In kbase_mem_alias of mali_kbase_mem_linux.c, there is a possible arbitrary code execution due to improper input validation. | |
CVE-2026-87690 | High 8.8 | 2 PoCs | The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). | |
CVE-2026-115905 | — | 2 PoCs | zip is a zip library for Rust that supports reading and writing simple ZIP files. | |
CVE-2024-4223 | Critical 9.8 | 2 PoCs | The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and… | |
CVE-2024-3552 | Critical 9.8 | 5 PoCs | The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQ… | |
CVE-2024-2771 | Critical 9.8 | 3 PoCs | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/… | |
CVE-2026-76418 | High 8.6 | CISA KEV | A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthe… | |
CVE-2026-93903 | — | 1 PoC | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in… | |
CVE-2026-84383 | Critical 9.8 | 2 PoCs | libheif is a HEIF and AVIF file format decoder and encoder. | |
CVE-2026-63286 | High 7.1 | 1 PoC | Database backups are vulnerable to offline attacks. | |
CVE-2026-35223 | Critical 9.8 | 1 PoC | An improper access check allows unauthorized access to com_config webservice endpoints. | |
CVE-2026-0013 | High 8.4 | 3 PoCs | In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. | |
CVE-2025-10035 | Critical 10.0 | CISA KEV, 6 PoCs | A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object… | |
CVE-2015-8522 | Critical 9.8 | 2 PoCs | Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability t… |