Latest public exploits (page 7)
Page 7 of 20 of CVEs with public exploit evidence (CISA KEV, Metasploit, CVE-specific PoCs), newest evidence first.
CVEs with public exploits, newest evidence first (page 7 of 20)
| CVE | Severity | Exploitation evidence | Evidence date | Summary |
|---|---|---|---|---|
CVE-2026-31635 | High 7.5 | 9 PoCs | In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgk_verify_response() decodes auth_len from the packet and is supposed … | |
CVE-2026-31431 | High 7.8 | CISA KEV, Metasploit, 374 PoCs | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the assoc… | |
CVE-2026-31402 | Critical 9.8 | 3 PoCs | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_… | |
CVE-2026-3055 | Critical 9.8 | CISA KEV, Metasploit, 7 PoCs | Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread | |
CVE-2026-28289 | Critical 10.0 | Metasploit, 3 PoCs | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. | |
CVE-2026-27876 | Critical 9.1 | 4 PoCs | A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). | |
CVE-2026-2699 | Critical 9.8 | 4 PoCs | Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. | |
CVE-2026-25769 | Critical 9.1 | 6 PoCs | Wazuh is a free and open source platform used for threat prevention, detection, and response. | |
CVE-2026-25089 | Critical 9.8 | CISA KEV, 4 PoCs | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox… | |
CVE-2026-25049 | Critical 9.9 | 4 PoCs | n8n is an open source workflow automation platform. | |
CVE-2026-24061 | Critical 9.8 | CISA KEV, Metasploit, 82 PoCs | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. | |
CVE-2026-23760 | Critical 9.8 | CISA KEV, 3 PoCs | SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. | |
CVE-2026-23111 | High 7.8 | 14 PoCs | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted eleme… | |
CVE-2026-22812 | High 8.8 | 11 PoCs | OpenCode is an open source AI coding agent. | |
CVE-2026-22765 | High 8.8 | 1 PoC | Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability. | |
CVE-2026-22557 | Critical 10.0 | 7 PoCs | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to… | |
CVE-2026-22241 | High 7.2 | 5 PoCs | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. | |
CVE-2026-21962 | Critical 10.0 | CISA KEV, 12 PoCs | Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Pro… | |
CVE-2026-21858 | Critical 10.0 | 21 PoCs | n8n is an open source workflow automation platform. | |
CVE-2026-21643 | Critical 9.8 | CISA KEV, 4 PoCs | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized co… | |
CVE-2026-21589 | High 7.5 | CISA KEV, 19 PoCs | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. | |
CVE-2026-20841 | High 7.8 | 16 PoCs | Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally. | |
CVE-2026-20253 | Critical 9.8 | CISA KEV, 10 PoCs | In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. | |
CVE-2026-20245 | High 7.8 | CISA KEV, 5 PoCs | A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vB… | |
CVE-2026-20131 | Critical 10.0 | CISA KEV, 8 PoCs | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root&… | |
CVE-2026-20127 | Critical 10.0 | CISA KEV, Metasploit, 11 PoCs | A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator… | |
CVE-2026-20079 | Critical 10.0 | CISA KEV, Metasploit, 5 PoCs | A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an… | |
CVE-2026-19586 | Critical 9.8 | 2 PoCs | A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during… | |
CVE-2026-19219 | High 8.1 | 1 PoC | In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certai… | |
CVE-2026-18470 | High 7.5 | 1 PoC | The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its resp… | |
CVE-2026-15409 | Critical 10.0 | CISA KEV, Metasploit, 9 PoCs | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. | |
CVE-2026-13684 | Critical 9.8 | 2 PoCs | An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to rea… | |
CVE-2026-1357 | Critical 9.8 | 13 PoCs | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. | |
CVE-2026-12485 | Critical 10.0 | 3 PoCs | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. | |
CVE-2026-122006 | Critical 9.8 | 1 PoC | The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagi… | |
CVE-2026-120491 | Medium 5.4 | 1 PoC | Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/maket… | |
CVE-2026-120232 | High 8.8 | 2 PoCs | A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. | |
CVE-2026-120209 | Critical 9.8 | 1 PoC | AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. | |
CVE-2026-120019 | Medium 5.4 | 1 PoC | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization an… | |
CVE-2026-118570 | Medium 6.5 | 1 PoC | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. | |
CVE-2026-118569 | Medium 5.4 | 1 PoC | Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. | |
CVE-2026-118306 | Critical 9.6 | 1 PoC | Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. | |
CVE-2026-116512 | Critical 9.8 | 3 PoCs | The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1… | |
CVE-2026-11645 | High 8.8 | CISA KEV, 6 PoCs | Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | |
CVE-2026-116214 | Critical 9.1 | 1 PoC | MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. | |
CVE-2026-115596 | High 7.1 | 1 PoC | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue aff… | |
CVE-2026-115290 | High 7.5 | 1 PoC | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). | |
CVE-2026-11499 | Critical 9.8 | 3 PoCs | A vulnerability was determined in Tenda HG7, HG9 and HG10 300001138_en_xpon. | |
CVE-2026-114612 | Critical 9.9 | 2 PoCs | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. | |
CVE-2026-114595 | Critical 9.8 | 3 PoCs | In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. |