Latest public exploits (page 2)
Page 2 of 20 of CVEs with public exploit evidence (CISA KEV, Metasploit, CVE-specific PoCs), newest evidence first.
CVEs with public exploits, newest evidence first (page 2 of 20)
| CVE | Severity | Exploitation evidence | Evidence date | Summary |
|---|---|---|---|---|
CVE-2026-76844 | High 7.4 | 1 PoC | zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. | |
CVE-2026-66613 | Critical 9.8 | 1 PoC | Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions. | |
CVE-2026-26119 | High 8.8 | 4 PoCs | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. | |
CVE-2026-119905 | Medium 4.9 | 1 PoC | Improper input validation in Windows DNS allows an authorized attacker to perform spoofing over a network. | |
CVE-2026-92414 | Critical 9.1 | 1 PoC | : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. | |
CVE-2026-90436 | Critical 9.8 | 1 PoC | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. | |
CVE-2026-81963 | High 7.8 | CISA KEV, 2 PoCs | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. | |
CVE-2026-73665 | Critical 9.8 | 1 PoC | FreePBX is an open source IP PBX. | |
CVE-2026-73663 | Critical 9.8 | 1 PoC | FreePBX is an open source IP PBX. | |
CVE-2026-73373 | Critical 9.8 | 1 PoC | Joomla! | |
CVE-2026-68524 | High 7.5 | 1 PoC | An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. | |
CVE-2026-6735 | Medium 6.1 | 1 PoC | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause t… | |
CVE-2026-66738 | High 8.8 | 1 PoC | SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. | |
CVE-2026-32475 | Critical 9.0 | 10 PoCs | Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. | |
CVE-2026-125757 | Critical 9.1 | 1 PoC | mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious… | |
CVE-2026-11800 | High 8.1 | 3 PoCs | A flaw was found in Keycloak. | |
CVE-2026-114656 | High 7.5 | 1 PoC | Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as se… | |
CVE-2026-110468 | — | 1 PoC | WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. | |
CVE-2026-105761 | High 7.1 | 1 PoC | Dify is an open-source LLM app development platform. | |
CVE-2026-104711 | Critical 9.8 | 9 PoCs | Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. | |
CVE-2026-100204 | High 7.0 | 1 PoC | Use after free in HEIF Image Extensions allows an unauthorized attacker to execute code locally. | |
CVE-2025-6020 | High 7.8 | 1 PoC | A flaw was found in linux-pam. | |
CVE-2025-54136 | High 7.2 | 4 PoCs | Cursor is a code editor built for programming with AI. | |
CVE-2025-29927 | Critical 9.1 | Metasploit, 152 PoCs | Next.js is a React framework for building full-stack web applications. | |
CVE-2025-10891 | High 8.8 | 1 PoC | Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
CVE-2021-22205 | Critical 10.0 | CISA KEV, Metasploit, 38 PoCs | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. | |
CVE-2007-2447 | — | Metasploit, 76 PoCs | The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when th… | |
CVE-2026-98432 | Critical 9.8 | 88 PoCs | In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the ch… | |
CVE-2026-89052 | — | 1 PoC | A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. | |
CVE-2026-86829 | — | 1 PoC | Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. | |
CVE-2026-125399 | High 8.0 | 1 PoC | Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. | |
CVE-2026-125394 | Medium 5.4 | 1 PoC | FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. | |
CVE-2026-119977 | High 8.1 | CISA KEV, 9 PoCs | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. | |
CVE-2026-116111 | Medium 6.3 | 1 PoC | A vulnerability was determined in 2K Games Civilization V 1.0.3.144. | |
CVE-2022-38181 | High 8.8 | CISA KEV, 13 PoCs | The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. | |
CVE-2020-13671 | High 8.8 | CISA KEV, 4 PoCs | Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP f… | |
CVE-2019-13139 | High 8.4 | 1 PoC | In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. | |
CVE-2018-7602 | Critical 9.8 | CISA KEV, 6 PoCs | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. | |
CVE-2026-96652 | Medium 4.3 | CISA KEV, 8 PoCs | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. | |
CVE-2026-65400 | Critical 9.8 | CISA KEV, 4 PoCs | An authentication issue was addressed with improved state management. | |
CVE-2026-58882 | High 7.5 | 3 PoCs | In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. | |
CVE-2026-123218 | Critical 9.8 | CISA KEV, 1 PoC | IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges. | |
CVE-2026-1210 | Medium 6.4 | 2 PoCs | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_elementor_data' meta field in all versions up to, and including, 3.20.7 due to insufficient… | |
CVE-2024-42327 | Critical 9.9 | 12 PoCs | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. | |
CVE-2019-2215 | High 7.8 | CISA KEV, Metasploit, 42 PoCs | A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. | |
CVE-2026-99273 | — | 1 PoC | In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream info smb_strtoUTF16() always writes a terminating zero UTF-16 unit after… | |
CVE-2026-87008 | High 7.1 | 1 PoC | Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. | |
CVE-2026-84473 | Critical 9.8 | 1 PoC | Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessin… | |
CVE-2026-83542 | Critical 9.8 | 1 PoC | Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by st… | |
CVE-2026-77622 | — | 1 PoC | Sliver is a command and control framework. |