Latest public exploits (page 6)
Page 6 of 20 of CVEs with public exploit evidence (CISA KEV, Metasploit, CVE-specific PoCs), newest evidence first.
CVEs with public exploits, newest evidence first (page 6 of 20)
| CVE | Severity | Exploitation evidence | Evidence date | Summary |
|---|---|---|---|---|
CVE-2026-5173 | High 8.5 | 3 PoCs | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke u… | |
CVE-2026-50751 | Critical 9.3 | CISA KEV, 12 PoCs | A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish… | |
CVE-2026-50679 | High 7.8 | 1 PoC | Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |
CVE-2026-50656 | High 7.8 | 6 PoCs | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". | |
CVE-2026-5027 | High 8.8 | 11 PoCs | The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path trav… | |
CVE-2026-48908 | Critical 9.8 | CISA KEV, 16 PoCs | A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code. | |
CVE-2026-48907 | Critical 9.8 | CISA KEV, Metasploit, 29 PoCs | A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution. | |
CVE-2026-48356 | Critical 9.3 | CISA KEV, 4 PoCs | Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining el… | |
CVE-2026-47729 | Medium 6.5 | 3 PoCs | Squid is a caching proxy for the Web. | |
CVE-2026-46817 | Critical 9.8 | CISA KEV, 4 PoCs | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). | |
CVE-2026-46333 | High 7.1 | Metasploit, 8 PoCs | In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - t… | |
CVE-2026-46331 | High 7.8 | 18 PoCs | In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable(… | |
CVE-2026-46300 | High 7.8 | CISA KEV, Metasploit, 20 PoCs | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. | |
CVE-2026-46243 | High 7.1 | 7 PoCs | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid… | |
CVE-2026-46242 | High 7.8 | 7 PoCs | In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_l… | |
CVE-2026-45829 | Critical 10.0 | 4 PoCs | A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicio… | |
CVE-2026-45585 | Medium 6.8 | 30 PoCs | Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". | |
CVE-2026-45447 | High 8.8 | 4 PoCs | Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. | |
CVE-2026-4480 | Critical 9.0 | 12 PoCs | A flaw was found in the Samba printing subsystem. | |
CVE-2026-44578 | High 8.6 | 12 PoCs | Next.js is a React framework for building full-stack web applications. | |
CVE-2026-44277 | Critical 9.8 | 3 PoCs | A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6, FortiAuthentica… | |
CVE-2026-44267 | Critical 9.8 | 1 PoC | Elo is a purely functional expression language for no-code tools. | |
CVE-2026-43786 | High 7.8 | 4 PoCs | This issue was addressed with additional entitlement checks. | |
CVE-2026-43503 | High 8.8 | Metasploit, 11 PoCs | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_s… | |
CVE-2026-43494 | High 7.8 | 10 PoCs | In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinne… | |
CVE-2026-42945 | High 8.1 | 63 PoCs | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. | |
CVE-2026-42569 | Critical 9.4 | 3 PoCs | phpVMS is a PHP application to run and simulate an airline. | |
CVE-2026-42530 | High 8.1 | 6 PoCs | NGINX Open Source has a vulnerability in the ngx_http_v3_module module. | |
CVE-2026-42208 | Critical 9.8 | CISA KEV, Metasploit, 11 PoCs | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. | |
CVE-2026-42016 | High 8.1 | CISA KEV, 1 PoC | JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. | |
CVE-2026-41940 | Critical 9.8 | CISA KEV, Metasploit, 103 PoCs | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. | |
CVE-2026-41651 | High 8.8 | 18 PoCs | PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. | |
CVE-2026-41462 | Critical 9.8 | 3 PoCs | ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without para… | |
CVE-2026-41091 | High 7.8 | CISA KEV, 7 PoCs | Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally. | |
CVE-2026-41089 | Critical 9.8 | 37 PoCs | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. | |
CVE-2026-40369 | High 7.8 | 9 PoCs | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
CVE-2026-40175 | Medium 4.8 | 6 PoCs | Axios is a promise based HTTP client for the browser and Node.js. | |
CVE-2026-39987 | Critical 9.8 | CISA KEV, 37 PoCs | marimo is a reactive Python notebook. | |
CVE-2026-39813 | Critical 9.8 | 4 PoCs | A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP re… | |
CVE-2026-39808 | Critical 9.8 | CISA KEV, 9 PoCs | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code… | |
CVE-2026-39732 | Critical 9.3 | 1 PoC | Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. | |
CVE-2026-35616 | Critical 9.8 | CISA KEV, 12 PoCs | A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. | |
CVE-2026-35273 | Critical 9.8 | CISA KEV, 6 PoCs | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). | |
CVE-2026-34724 | High 7.2 | 3 PoCs | Zammad is a web based open source helpdesk/customer support system. | |
CVE-2026-34197 | High 8.8 | CISA KEV, Metasploit, 19 PoCs | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. | |
CVE-2026-34156 | Critical 9.9 | 5 PoCs | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. | |
CVE-2026-33871 | High 7.5 | 1 PoC | Netty is an asynchronous, event-driven network application framework. | |
CVE-2026-33825 | High 7.8 | CISA KEV, 10 PoCs | Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally. | |
CVE-2026-33439 | Critical 9.8 | 10 PoCs | Open Access Management (OpenAM) is an access management solution. | |
CVE-2026-33017 | Critical 9.8 | CISA KEV, Metasploit, 33 PoCs | Langflow is a tool for building and deploying AI-powered agents and workflows. |