Latest public exploits (page 5)
Page 5 of 20 of CVEs with public exploit evidence (CISA KEV, Metasploit, CVE-specific PoCs), newest evidence first.
CVEs with public exploits, newest evidence first (page 5 of 20)
| CVE | Severity | Exploitation evidence | Evidence date | Summary |
|---|---|---|---|---|
CVE-2026-97229 | Critical 10.0 | CISA KEV, Metasploit, 10 PoCs | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthe… | |
CVE-2026-96838 | High 8.8 | 1 PoC | Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 versions. | |
CVE-2026-95597 | Medium 6.5 | 1 PoC | Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 워드프레스 결제 심플페이: from n/… | |
CVE-2026-94641 | High 7.1 | 1 PoC | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73. | |
CVE-2026-94074 | Medium 6.5 | 1 PoC | Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions. | |
CVE-2026-93485 | High 7.1 | 6 PoCs | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a throug… | |
CVE-2026-91403 | Critical 9.1 | 7 PoCs | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). | |
CVE-2026-9082 | Critical 9.8 | CISA KEV, Metasploit, 18 PoCs | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. | |
CVE-2026-8932 | High 7.5 | 4 PoCs | libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. | |
CVE-2026-86950 | High 8.8 | CISA KEV, 9 PoCs | An out-of-bounds write issue was addressed with improved bounds checking. | |
CVE-2026-86583 | High 8.8 | 1 PoC | The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. | |
CVE-2026-8461 | High 8.8 | 8 PoCs | An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. | |
CVE-2026-8451 | High 7.5 | 7 PoCs | Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP | |
CVE-2026-81000 | High 7.8 | 5 PoCs | In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to ke… | |
CVE-2026-80914 | High 8.8 | 1 PoC | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready iso_conn_ready() looks up the BIS listener socket with is… | |
CVE-2026-80844 | — | 5 PoCs | In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. | |
CVE-2026-76461 | Critical 9.8 | CISA KEV, Metasploit, 6 PoCs | A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the… | |
CVE-2026-76142 | — | 1 PoC | Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions | |
CVE-2026-7574 | High 8.7 | 3 PoCs | Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and v1.2278.0) validates only file presence and a version marker strin… | |
CVE-2026-74469 | High 8.8 | 5 PoCs | In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every n… | |
CVE-2026-73570 | High 8.9 | CISA KEV, 11 PoCs | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. | |
CVE-2026-73296 | Critical 9.4 | 3 PoCs | Microsoft UFO open-source framework for intelligent automation across devices and platforms. | |
CVE-2026-72898 | Critical 10.0 | CISA KEV, 14 PoCs | Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance. | |
CVE-2026-72018 | High 7.8 | 3 PoCs | In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in move_data() The loopback move_data() performs a memcpy into the registered DMB withou… | |
CVE-2026-68121 | High 7.8 | 5 PoCs | In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_… | |
CVE-2026-66066 | — | Metasploit, 11 PoCs | Action Pack is a framework for handling and responding to web requests. | |
CVE-2026-6471 | High 7.2 | 4 PoCs | Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice… | |
CVE-2026-64638 | — | 34 PoCs | WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be es… | |
CVE-2026-64600 | High 7.8 | 12 PoCs | In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a… | |
CVE-2026-64560 | High 7.8 | 28 PoCs | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related… | |
CVE-2026-64531 | High 7.8 | 7 PoCs | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field… | |
CVE-2026-63292 | High 7.5 | 3 PoCs | Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially exec… | |
CVE-2026-63072 | High 7.5 | 3 PoCs | Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that que… | |
CVE-2026-63030 | Critical 9.8 | CISA KEV, Metasploit, 99 PoCs | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), cou… | |
CVE-2026-61989 | High 7.1 | 1 PoC | Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions. | |
CVE-2026-61082 | Medium 6.5 | 1 PoC | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). | |
CVE-2026-60623 | High 7.1 | 1 PoC | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). | |
CVE-2026-60586 | High 7.7 | 1 PoC | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). | |
CVE-2026-6023 | High 8.1 | 1 PoC | In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the c… | |
CVE-2026-60206 | Critical 9.9 | 6 PoCs | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). | |
CVE-2026-60004 | Critical 9.8 | CISA KEV, 16 PoCs | Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. | |
CVE-2026-58868 | Critical 9.8 | 2 PoCs | In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. | |
CVE-2026-58138 | Critical 9.8 | 9 PoCs | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow defin… | |
CVE-2026-55450 | Critical 9.3 | 3 PoCs | Langflow is a tool for building and deploying AI-powered agents and workflows. | |
CVE-2026-55200 | High 8.1 | 5 PoCs | libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. | |
CVE-2026-54161 | High 8.1 | 1 PoC | Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. | |
CVE-2026-54121 | High 8.8 | 21 PoCs | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network. | |
CVE-2026-53921 | Critical 9.8 | 5 PoCs | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. | |
CVE-2026-53362 | High 7.8 | CISA KEV, 2 PoCs | In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MOR… | |
CVE-2026-53359 | High 8.8 | 12 PoCs | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-fr… |