Latest public exploits (page 3)
Page 3 of 20 of CVEs with public exploit evidence (CISA KEV, Metasploit, CVE-specific PoCs), newest evidence first.
CVEs with public exploits, newest evidence first (page 3 of 20)
| CVE | Severity | Exploitation evidence | Evidence date | Summary |
|---|---|---|---|---|
CVE-2026-73577 | High 7.5 | 1 PoC | Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view… | |
CVE-2026-69137 | High 7.7 | 1 PoC | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. | |
CVE-2026-4961 | High 8.8 | 1 PoC | A vulnerability was identified in Tenda AC6 15.03.05.16. | |
CVE-2026-34157 | — | 1 PoC | Wails is a framework for building desktop applications using Go and web technologies. | |
CVE-2026-19868 | High 7.5 | CISA KEV, 2 PoCs | An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. | |
CVE-2026-124040 | High 8.1 | 1 PoC | CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. | |
CVE-2026-123753 | — | 1 PoC | Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. | |
CVE-2026-123025 | — | 1 PoC | An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. | |
CVE-2026-123014 | — | 1 PoC | iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by induci… | |
CVE-2026-122675 | Medium 5.4 | 1 PoC | Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.2.3. | |
CVE-2026-122158 | Medium 4.7 | 1 PoC | A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. | |
CVE-2026-122056 | Medium 5.9 | 1 PoC | A flaw was found in OpenSCAP. | |
CVE-2026-121265 | Critical 9.8 | 1 PoC | SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update. | |
CVE-2026-118423 | Critical 10.0 | 3 PoCs | The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible locati… | |
CVE-2026-117691 | Critical 9.1 | 1 PoC | A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. | |
CVE-2026-116779 | Critical 9.8 | CISA KEV, 2 PoCs | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. | |
CVE-2026-114630 | Critical 9.1 | 1 PoC | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all ver… | |
CVE-2026-113615 | Critical 9.8 | 1 PoC | The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allow… | |
CVE-2026-111770 | High 7.7 | 1 PoC | The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. | |
CVE-2026-100109 | Critical 9.8 | 1 PoC | The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller… | |
CVE-2025-4609 | Critical 9.6 | 1 PoC | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious fi… | |
CVE-2023-6241 | High 7.0 | 4 PoCs | Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a lo… | |
CVE-2023-33107 | High 8.4 | CISA KEV, 3 PoCs | Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. | |
CVE-2021-41773 | Critical 9.8 | CISA KEV, Metasploit, 216 PoCs | A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. | |
CVE-2026-20320 | High 7.5 | CISA KEV | A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. … | |
CVE-2026-111793 | Medium 4.3 | CISA KEV | Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. | |
CVE-2026-111560 | — | CISA KEV | Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject… | |
CVE-2026-56712 | High 8.5 | 1 PoC | Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with… | |
CVE-2026-93399 | Critical 9.1 | 4 PoCs | The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calenda… | |
CVE-2026-83844 | High 7.0 | 7 PoCs | Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code locally. | |
CVE-2026-83681 | Medium 5.5 | 1 PoC | Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally. | |
CVE-2026-63686 | High 7.5 | 2 PoCs | A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied… | |
CVE-2026-57845 | High 8.8 | 2 PoCs | Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the de… | |
CVE-2026-124576 | High 7.3 | 1 PoC | A security flaw has been discovered in BeikeShop up to 2.0.0.31. | |
CVE-2025-62023 | Critical 9.0 | 2 PoCs | Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through 250905. | |
CVE-2024-51482 | Critical 9.9 | 14 PoCs | ZoneMinder is a free, open source closed-circuit television software application. | |
CVE-2021-44228 | Critical 10.0 | CISA KEV, Metasploit, 550 PoCs | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker contro… | |
CVE-2012-0694 | Critical 9.8 | Metasploit, 1 PoC | SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code. | |
CVE-2026-96760 | Critical 9.8 | 3 PoCs | Authlib (v1.8.0 and below) contains a signature verification bypass vulnerability. | |
CVE-2026-94434 | High 8.8 | 1 PoC | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Comman… | |
CVE-2026-92606 | Medium 6.0 | 1 PoC | Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) R… | |
CVE-2026-92080 | Medium 4.3 | 1 PoC | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal. | |
CVE-2026-84380 | Medium 5.6 | 1 PoC | HTTPX2 is a next generation HTTP client for Python. | |
CVE-2026-79657 | Critical 9.8 | 1 PoC | NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. | |
CVE-2026-75037 | High 7.0 | 1 PoC | Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. | |
CVE-2026-73858 | Medium 5.3 | 1 PoC | Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. | |
CVE-2026-73802 | High 8.8 | 1 PoC | Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. | |
CVE-2026-72422 | Critical 9.8 | 1 PoC | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE conn->preauth_info is shared connection state (struc… | |
CVE-2026-65600 | Medium 5.3 | 1 PoC | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. | |
CVE-2026-64849 | Critical 9.3 | CISA KEV, 6 PoCs | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. |