Latest public exploits (page 20)
Page 20 of 20 of CVEs with public exploit evidence (CISA KEV, Metasploit, CVE-specific PoCs), newest evidence first.
CVEs with public exploits, newest evidence first (page 20 of 20)
| CVE | Severity | Exploitation evidence | Evidence date | Summary |
|---|---|---|---|---|
CVE-2026-112071 | — | 1 PoC | The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. | |
CVE-2026-105810 | — | 1 PoC | Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. | |
CVE-2025-5243 | Critical 10.0 | 1 PoC | Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMG Software Information Portal allows Cod… | |
CVE-2024-11142 | High 8.8 | 1 PoC | Cross-Site Request Forgery (CSRF) vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. | |
CVE-2023-24329 | High 7.5 | 6 PoCs | An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. | |
CVE-2026-93300 | High 7.5 | 1 PoC | The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user sup… | |
CVE-2026-85314 | Medium 6.5 | 1 PoC | Improper Input Validation vulnerability in Apache Camel Mail component. | |
CVE-2026-85313 | Medium 4.3 | 1 PoC | Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. | |
CVE-2026-85312 | Medium 4.8 | 1 PoC | Improper Input Validation vulnerability in Apache Camel Core component. | |
CVE-2026-85301 | Medium 4.8 | 1 PoC | Improper Authentication vulnerability in Apache Camel Keycloak component. | |
CVE-2026-85300 | Medium 5.5 | 1 PoC | Incorrect Default Permissions vulnerability in Apache Camel PQC component. | |
CVE-2026-85260 | Medium 5.5 | 1 PoC | Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. | |
CVE-2026-85296 | Medium 6.5 | 1 PoC | Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. | |
CVE-2026-112195 | Medium 4.7 | 1 PoC | A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. | |
CVE-2026-105484 | Critical 10.0 | 1 PoC | A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. | |
CVE-2025-31324 | Critical 10.0 | CISA KEV, 24 PoCs | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely ha… | |
CVE-2022-3509 | High 7.5 | 1 PoC | A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. | |
CVE-2026-111058 | Critical 9.8 | 1 PoC | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. | |
CVE-2017-8176 | High 7.5 | 1 PoC | Huawei IPTV STB with earlier than IPTV STB V100R003C01LMYTa6SPC001 versions has an authentication bypass vulnerability. | |
CVE-2026-85257 | Medium 5.3 | 1 PoC | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. | |
CVE-2026-107083 | Critical 9.8 | 1 PoC | SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID. | |
CVE-2026-107084 | High 8.8 | 1 PoC | Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter… | |
CVE-2026-107082 | High 8.8 | 1 PoC | Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index… | |
CVE-2026-107081 | Critical 9.8 | 1 PoC | SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control… | |
CVE-2026-103663 | — | 1 PoC | Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. | |
CVE-2026-0006 | Critical 9.8 | 2 PoCs | In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. | |
CVE-2017-7494 | Critical 9.8 | CISA KEV, Metasploit, 29 PoCs | Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and the… | |
CVE-2026-96656 | High 7.2 | CISA KEV, 1 PoC | Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. | |
CVE-2026-96655 | Medium 4.3 | CISA KEV | Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. | |
CVE-2026-96654 | Medium 6.5 | CISA KEV | Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters. | |
CVE-2026-106931 | High 7.8 | CISA KEV | SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected… | |
CVE-2026-85254 | Medium 6.5 | 1 PoC | Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. | |
CVE-2026-85251 | High 7.5 | 1 PoC | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. | |
CVE-2026-52856 | High 7.5 | 1 PoC | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. | |
CVE-2026-105105 | Critical 9.8 | 1 PoC | CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker w… | |
CVE-2026-104715 | High 7.8 | 1 PoC | A flaw was found in cifs-utils. | |
CVE-2024-58299 | Critical 9.8 | 1 PoC | PCMan FTP Server 2.0 contains a buffer overflow vulnerability in the 'pwd' command that allows remote attackers to execute arbitrary code. | |
CVE-2024-35250 | High 7.8 | CISA KEV, Metasploit, 8 PoCs | Windows Kernel-Mode Driver Elevation of Privilege Vulnerability | |
CVE-2024-27198 | Critical 9.8 | CISA KEV, Metasploit, 30 PoCs | In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible | |
CVE-2024-12603 | Critical 9.8 | 1 PoC | A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password. | |
CVE-2017-7529 | High 7.5 | 19 PoCs | Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered… | |
CVE-2026-85250 | High 7.5 | 1 PoC | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. | |
CVE-2026-85249 | Medium 6.5 | 1 PoC | Improper Input Validation vulnerability in Apache Camel Tika component. | |
CVE-2026-85248 | Medium 5.9 | 1 PoC | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component. | |
CVE-2026-85247 | Medium 5.9 | 1 PoC | Improper Certificate Validation vulnerability in Apache Camel Knative component. | |
CVE-2026-85246 | Medium 5.3 | 1 PoC | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. | |
CVE-2026-85245 | Medium 5.9 | 1 PoC | Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. | |
CVE-2026-85243 | Medium 5.9 | 1 PoC | Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. | |
CVE-2026-84181 | Medium 5.9 | 1 PoC | Improper Authentication vulnerability in Apache Camel Shiro component. | |
CVE-2026-84180 | Medium 5.3 | 1 PoC | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. |