Latest public exploits (page 9)
Page 9 of 20 of CVEs with public exploit evidence (CISA KEV, Metasploit, CVE-specific PoCs), newest evidence first.
CVEs with public exploits, newest evidence first (page 9 of 20)
| CVE | Severity | Exploitation evidence | Evidence date | Summary |
|---|---|---|---|---|
CVE-2022-25236 | Critical 9.8 | 2 PoCs | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. | |
CVE-2022-25235 | Critical 9.8 | 2 PoCs | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. | |
CVE-2022-24765 | Medium 6.0 | 1 PoC | Git for Windows is a fork of Git containing Windows-specific patches. | |
CVE-2022-24713 | High 7.5 | 4 PoCs | regex is an implementation of regular expressions for the Rust language. | |
CVE-2022-22965 | Critical 9.8 | CISA KEV, Metasploit, 126 PoCs | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. | |
CVE-2022-0847 | High 7.8 | CISA KEV, Metasploit, 152 PoCs | A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus… | |
CVE-2022-0778 | High 7.5 | 13 PoCs | The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. | |
CVE-2021-42013 | Critical 9.8 | CISA KEV, Metasploit, 55 PoCs | It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. | |
CVE-2021-3712 | High 7.4 | 2 PoCs | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. | |
CVE-2021-32804 | High 8.2 | 2 PoCs | The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. | |
CVE-2021-28879 | Critical 9.8 | 1 PoC | In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. | |
CVE-2021-22911 | Critical 9.8 | 14 PoCs | A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE. | |
CVE-2021-21300 | High 8.0 | Metasploit, 19 PoCs | Git is an open-source distributed revision control system. | |
CVE-2020-5902 | Critical 9.8 | CISA KEV, Metasploit, 66 PoCs | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility… | |
CVE-2020-35489 | Critical 10.0 | 7 PoCs | The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters. | |
CVE-2020-26235 | Medium 5.3 | 1 PoC | In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. | |
CVE-2020-17103 | High 7.0 | 11 PoCs | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | |
CVE-2020-1350 | Critical 10.0 | CISA KEV, 20 PoCs | A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. | |
CVE-2020-13405 | High 7.5 | 3 PoCs | userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request. | |
CVE-2020-11651 | Critical 9.8 | CISA KEV, Metasploit, 18 PoCs | An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. | |
CVE-2019-9513 | High 7.5 | 1 PoC | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. | |
CVE-2019-9053 | High 8.1 | 70 PoCs | An issue was discovered in CMS Made Simple 2.2.8. | |
CVE-2019-6693 | Medium 6.5 | CISA KEV, 5 PoCs | Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge… | |
CVE-2019-10744 | Critical 9.1 | 3 PoCs | Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. | |
CVE-2018-4878 | High 7.8 | CISA KEV, 14 PoCs | A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. | |
CVE-2018-1000810 | Critical 9.8 | 1 PoC | The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard lib… | |
CVE-2017-7921 | Critical 9.8 | CISA KEV, Metasploit, 36 PoCs | An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2x… | |
CVE-2017-5689 | Critical 9.8 | CISA KEV, Metasploit, 7 PoCs | An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). | |
CVE-2017-18349 | Critical 9.8 | 3 PoCs | parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a… | |
CVE-2017-18078 | High 7.8 | 1 PoC | systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass… | |
CVE-2017-0144 | High 8.8 | CISA KEV, Metasploit, 32 PoCs | The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607… | |
CVE-2016-5195 | High 7.0 | CISA KEV, 79 PoCs | Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-… | |
CVE-2015-1201 | — | 1 PoC | Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors. | |
CVE-2014-6271 | Critical 9.8 | CISA KEV, Metasploit, 114 PoCs | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, a… | |
CVE-2014-0160 | High 7.5 | CISA KEV, Metasploit, 92 PoCs | The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process… | |
CVE-2011-2523 | Critical 9.8 | Metasploit, 88 PoCs | vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp. | |
CVE-2026-86596 | Critical 9.8 | 2 PoCs | The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. | |
CVE-2026-10795 | High 8.1 | 5 PoCs | The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp… | |
CVE-2026-102578 | Medium 5.5 | 1 PoC | A flaw was found in Moodle. | |
CVE-2023-36308 | Medium 5.5 | 2 PoCs | disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to the scan function of scanner.go. | |
CVE-2026-62911 | High 8.0 | 5 PoCs | Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | |
CVE-2026-58115 | Critical 10.0 | 2 PoCs | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2050 Advanced (6ES7647-0BA00-1… | |
CVE-2026-56190 | Critical 9.8 | 5 PoCs | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network. | |
CVE-2026-21440 | — | 5 PoCs | AdonisJS is a TypeScript-first web framework. | |
CVE-2026-110186 | Critical 9.8 | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | |
CVE-2022-23943 | Critical 9.8 | 1 PoC | Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. | |
CVE-2022-21675 | Critical 9.9 | 1 PoC | Bytecode Viewer (BCV) is a Java/Android reverse engineering suite. | |
CVE-2019-9506 | High 8.1 | 3 PoCs | The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. | |
CVE-2021-33644 | High 8.1 | 1 PoC | An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. | |
CVE-2020-10135 | Medium 5.4 | 3 PoCs | Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing crede… |