Latest public exploits (page 8)
Page 8 of 20 of CVEs with public exploit evidence (CISA KEV, Metasploit, CVE-specific PoCs), newest evidence first.
CVEs with public exploits, newest evidence first (page 8 of 20)
| CVE | Severity | Exploitation evidence | Evidence date | Summary |
|---|---|---|---|---|
CVE-2026-114550 | High 8.1 | 1 PoC | libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. | |
CVE-2026-112869 | High 7.1 | 1 PoC | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! | |
CVE-2026-112611 | Medium 6.1 | 2 PoCs | An out-of-bounds write issue was addressed with improved bounds checking. | |
CVE-2026-112222 | Medium 5.4 | 1 PoC | Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744. | |
CVE-2026-111967 | Medium 6.8 | 1 PoC | The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level acce… | |
CVE-2026-111943 | Medium 6.8 | 6 PoCs | On most platforms, Go uses the given system root certificates. | |
CVE-2026-110912 | — | 4 PoCs | In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address le… | |
CVE-2026-109619 | High 8.1 | CISA KEV, 32 PoCs | PHP has various global state that temporarily points into request memory. | |
CVE-2026-109518 | — | 3 PoCs | On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server trig… | |
CVE-2026-107441 | High 8.8 | 1 PoC | An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentia… | |
CVE-2026-106173 | Critical 9.8 | 7 PoCs | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4 all versions, FortiSIEM 7.3 all versions, FortiSIEM 7.2 all v… | |
CVE-2026-10520 | Critical 10.0 | CISA KEV, 11 PoCs | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution | |
CVE-2026-102334 | High 7.4 | 1 PoC | Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. | |
CVE-2026-101767 | Critical 9.8 | 8 PoCs | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). | |
CVE-2026-101678 | Medium 4.3 | 1 PoC | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). | |
CVE-2026-0770 | Critical 9.8 | CISA KEV, Metasploit, 9 PoCs | Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. | |
CVE-2026-0300 | Critical 9.8 | CISA KEV, 14 PoCs | A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code w… | |
CVE-2026-0264 | Critical 9.8 | 1 PoC | A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (Do… | |
CVE-2026-0257 | Critical 9.1 | CISA KEV, 14 PoCs | Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized… | |
CVE-2026-0073 | High 8.8 | 25 PoCs | In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. | |
CVE-2025-68645 | High 8.8 | CISA KEV, 12 PoCs | A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFil… | |
CVE-2025-64446 | Critical 9.8 | CISA KEV, Metasploit, 16 PoCs | A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0… | |
CVE-2025-5777 | High 7.5 | CISA KEV, 34 PoCs | Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server | |
CVE-2025-55182 | Critical 10.0 | CISA KEV, Metasploit, 525 PoCs | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react… | |
CVE-2025-54236 | Critical 9.1 | CISA KEV, Metasploit, 8 PoCs | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. | |
CVE-2025-50579 | Medium 5.3 | 1 PoC | A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validation of the Origin header. | |
CVE-2025-49844 | Critical 9.9 | 23 PoCs | Redis is an open source, in-memory database that persists on disk. | |
CVE-2025-49132 | Critical 10.0 | Metasploit, 35 PoCs | Pterodactyl is a free, open-source game server management panel. | |
CVE-2025-32463 | Critical 9.3 | CISA KEV, Metasploit, 101 PoCs | Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. | |
CVE-2025-32433 | Critical 10.0 | CISA KEV, Metasploit, 55 PoCs | Erlang/OTP is a set of libraries for the Erlang programming language. | |
CVE-2025-31161 | Critical 9.8 | CISA KEV, 27 PoCs | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2… | |
CVE-2025-14847 | High 7.5 | CISA KEV, Metasploit, 47 PoCs | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. | |
CVE-2025-13315 | Critical 9.8 | Metasploit, 3 PoCs | Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. | |
CVE-2024-5716 | Critical 9.8 | 1 PoC | Logsign Unified SecOps Platform Authentication Bypass Vulnerability. | |
CVE-2024-4367 | High 8.8 | 42 PoCs | A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. | |
CVE-2024-34102 | Critical 9.8 | CISA KEV, Metasploit, 36 PoCs | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary c… | |
CVE-2024-3094 | Critical 10.0 | 107 PoCs | Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. | |
CVE-2024-26229 | High 7.8 | 12 PoCs | Windows CSC Service Elevation of Privilege Vulnerability | |
CVE-2024-24919 | High 8.6 | CISA KEV, Metasploit, 80 PoCs | Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. | |
CVE-2024-24576 | Critical 10.0 | 11 PoCs | Rust is a programming language. | |
CVE-2024-23222 | High 8.8 | CISA KEV, 7 PoCs | A type confusion issue was addressed with improved checks. | |
CVE-2024-21762 | Critical 9.8 | CISA KEV, 37 PoCs | A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, For… | |
CVE-2023-6931 | High 7.8 | 3 PoCs | A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. | |
CVE-2023-48795 | Medium 5.9 | 10 PoCs | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from… | |
CVE-2023-46071 | High 7.1 | 1 PoC | Unauth. | |
CVE-2023-44487 | High 7.5 | CISA KEV, 31 PoCs | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. | |
CVE-2023-41974 | High 7.8 | CISA KEV, 1 PoC | A use-after-free issue was addressed with improved memory management. | |
CVE-2023-36664 | High 7.8 | 6 PoCs | Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). | |
CVE-2023-34468 | High 8.8 | Metasploit, 10 PoCs | The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver tha… | |
CVE-2023-26360 | High 8.6 | CISA KEV, Metasploit, 8 PoCs | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the co… |