CVEs: Exploit-DB, page 2
582 CVEs with a public exploit on Exploit-DB, sorted by threat level then EPSS. Showing 121-240. Use search to combine filters.
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2013-3918Microsoft Windows Out-of-Bounds Write Vulnerability
Microsoft · Windows · EPSS 73.69% · Threat 81HIGH 7.2
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBCTID-mapped
CVE-2022-43769Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
Hitachi Vantara · Pentaho Business Analytics (BA) Server · EPSS 97.67% · Threat 80CRITICAL 9.3
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-32429CVE-2025-32429: XWiki Platform is a generic wiki platform offering runtime services for applications built…
xwiki · xwiki · EPSS 87.90% · Threat 80CRITICAL 9.9
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-42327CVE-2024-42327: A non-admin user account on the Zabbix frontend with the default User role, or with any ot…
zabbix · zabbix · EPSS 79.11% · Threat 80CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-2294CVE-2025-2294: The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in al…
Unknown · · EPSS 78.36% · Threat 80HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-43798Grafana Path Traversal Vulnerability
Grafana Labs · Grafana · EPSS 88.50% · Threat 79CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2023-3643CVE-2023-3643: A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critica…
carel · boss mini firmware · EPSS 75.36% · Threat 79CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-23744CVE-2026-23744: MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 a…
mcpjam · inspector · EPSS 67.52% · Threat 79HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-22555Linux Kernel Heap Out-of-Bounds Write Vulnerability
Linux · Kernel · EPSS 78.68% · Threat 78CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2023-3460CVE-2023-3460: The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating …
ultimatemember · ultimate member · EPSS 72.31% · Threat 78HIGH 8.1
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-6387CVE-2024-6387: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is …
sonicwall · sma 6200 firmware · EPSS 99.51% · Threat 77HIGH 8.1
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-43425CVE-2024-43425: A flaw was found in Moodle. Additional restrictions are required to avoid a remote code ex…
moodle · moodle · EPSS 87.54% · Threat 77HIGH 7.2
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2018-9276Paessler PRTG Network Monitor OS Command Injection Vulnerability
Paessler · PRTG Network Monitor · EPSS 87.00% · Threat 77HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-9621Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 81.04% · Threat 77HIGH 7.8Ransomware
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2024-21338Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
Microsoft · Windows · EPSS 59.81% · Threat 77HIGH 8.8
Exploit-DBATT&CK inferred
CVE-2025-1098CVE-2025-1098: A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-ng…
Unknown · · EPSS 82.31% · Threat 76CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-28000CVE-2024-28000: Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache lit…
litespeedtech · litespeed cache · EPSS 68.27% · Threat 76CRITICAL 9.9
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-55315CVE-2025-55315: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NE…
microsoft · asp.net core · EPSS 66.53% · Threat 76CRITICAL 10
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-49132CVE-2025-49132: Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11,…
Unknown · · EPSS 54.46% · Threat 76HIGH 8.1
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-25094CVE-2021-25094: The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior …
brandexponents · tatsu · EPSS 83.23% · Threat 75CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2026-0740CVE-2026-0740: The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file upload…
Unknown · · EPSS 62.90% · Threat 75HIGH 8.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-2441Google Chromium CSS Use-After-Free Vulnerability
Google · Chromium · EPSS 54.96% · Threat 75CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2025-27007CVE-2025-27007: Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allo…
Unknown · · EPSS 54.19% · Threat 75CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2024-11972CVE-2024-11972: The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST AP…
themehunk · hunk companion · EPSS 59.05% · Threat 74CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2025-7441CVE-2025-7441: The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all version…
Unknown · · EPSS 49.89% · Threat 74CRITICAL 10
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-56290Joomlack Page Builder Improper Access Control Vulnerability
Joomlack · Page Builder · EPSS 30.87% · Threat 74HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-4911GNU C Library Buffer Overflow Vulnerability
GNU · GNU C Library · EPSS 63.77% · Threat 73CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2024-48760CVE-2024-48760: An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the fil…
gestioip · gestioip · EPSS 45.78% · Threat 73CRITICAL 9.3
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-39987Marimo Remote Code Execution Vulnerability
Marimo · Marimo · EPSS 37.87% · Threat 73CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-9198IBM Langflow Code Injection Vulnerability
IBM · Langflow · EPSS 28.66% · Threat 73HIGH 7.2
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-25641CVE-2024-25641: Cacti provides an operational monitoring and fault management framework. Prior to version …
cacti · cacti · EPSS 86.30% · Threat 72HIGH 8.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-4367CVE-2024-4367: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaSc…
mozilla · firefox · EPSS 70.66% · Threat 72CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2020-36847CVE-2020-36847: The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versio…
simplefilelist · simple file list · EPSS 43.52% · Threat 72MEDIUM 5.3Top #2
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2021-26086Atlassian Jira Server and Data Center Path Traversal Vulnerability
Atlassian · Jira Server and Data Center · EPSS 100.00% · Threat 71MEDIUM 6.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2020-11023JQuery Cross-Site Scripting (XSS) Vulnerability
JQuery · JQuery · EPSS 84.89% · Threat 71HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-32463Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Sudo · Sudo · EPSS 55.50% · Threat 71CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-58434CVE-2025-58434: Flowise is a drag & drop user interface to build a customized large language model flow. I…
flowiseai · flowise · EPSS 50.54% · Threat 71CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-29306CVE-2025-29306: An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case…
foxcms · foxcms · EPSS 46.58% · Threat 70CRITICAL 10
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-24085Apple Multiple Products Use-After-Free Vulnerability
Apple · Multiple Products · EPSS 17.51% · Threat 70CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-48907Widget Factory Joomla Content Editor Improper Access Control Vulnerability
Widget Factory · Joomla Content Editor · EPSS 16.19% · Threat 70CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-4257CVE-2026-4257: The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template I…
Unknown · · EPSS 32.78% · Threat 69CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-33017Langflow Code Injection Vulnerability
Langflow · Langflow · EPSS 24.75% · Threat 69CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-9082Drupal Core SQL Injection Vulnerability
Drupal · Core · EPSS 15.70% · Threat 69HIGH 7.5
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-23334CVE-2024-23334: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using…
aiohttp · aiohttp · EPSS 76.88% · Threat 68CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-42640CVE-2024-42640: angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execut…
Unknown · · EPSS 40.21% · Threat 68CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-3891CVE-2026-3891: The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due t…
Unknown · · EPSS 29.73% · Threat 68MEDIUM 6.1
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-4123CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client …
grafana · grafana · EPSS 97.08% · Threat 67HIGH 7.5
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-30208CVE-2025-30208: Vite, a provider of frontend development tooling, has a vulnerability in versions prior to…
vitejs · vite · EPSS 74.77% · Threat 67MEDIUM 6.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2024-37383RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
Roundcube · Webmail · EPSS 73.30% · Threat 67MEDIUM 6.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2019-9978WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
WordPress · Social Warfare Plugin · EPSS 72.95% · Threat 67HIGH 8.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-87902WordPress Core Remote File Inclusion Vulnerability
WordPress · Core · EPSS 39.98% · Threat 67HIGH 7.5
Metasploit moduleExploit-DBATT&CK inferred
CVE-2024-8522CVE-2024-8522: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection …
thimpress · learnpress · EPSS 62.88% · Threat 66HIGH 8.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2026-23918CVE-2026-23918: Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.…
apache · http server · EPSS 49.73% · Threat 66HIGH 7.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2023-29336Microsoft Win32K Privilege Escalation Vulnerability
Microsoft · Win32k · EPSS 41.19% · Threat 66HIGH 8.1
Exploited in the wild · CISA KEVExploit-DBATT&CK inferred
CVE-2008-4128Cisco IOS Cross-Site Request Forgery Vulnerability
Cisco · IOS · EPSS 33.87% · Threat 66HIGH 8.8
Exploited in the wild · CISA KEVExploit-DBATT&CK inferred
CVE-2020-24363TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability
TP-Link · TL-WA855RE · EPSS 22.19% · Threat 66HIGH 7.2
Exploit-DBATT&CK inferred
CVE-2025-6965CVE-2025-6965: There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregat…
sqlite · sqlite · EPSS 73.30% · Threat 65CRITICAL 10
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-34077CVE-2025-34077: An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1…
Unknown · · EPSS 16.38% · Threat 65MEDIUM 6.1
Exploit-DBPublic PoCATT&CK inferred
CVE-2019-11358CVE-2019-11358: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuer…
jquery · jquery · EPSS 86.82% · Threat 64HIGH 7Ransomware
Exploited in the wild · CISA KEVExploit-DBATT&CK inferred
CVE-2025-26633Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability
Microsoft · Windows · EPSS 30.39% · Threat 64CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2019-25024CVE-2019-25024: OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metachara…
alleghenycreative · openrepeater · EPSS 27.63% · Threat 64MEDIUM 6.1
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-4220CVE-2023-4220: Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/big…
chamilo · chamilo lms · EPSS 76.08% · Threat 63HIGH 7.5
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-31650CVE-2025-31650: Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for som…
apache · tomcat · EPSS 61.32% · Threat 63HIGH 8.8
Exploit-DBATT&CK inferred
CVE-2020-5504CVE-2020-5504: In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts…
phpmyadmin · phpmyadmin · EPSS 39.04% · Threat 63HIGH 7.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2024-38193Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability
Microsoft · Windows · EPSS 28.74% · Threat 63CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2021-44567CVE-2021-44567: An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the v…
rosariosis · rosariosis · EPSS 23.08% · Threat 63CRITICAL 9.2
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-86060MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
MikroTik · RouterOS · EPSS 6.39% · Threat 63HIGH 7.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2024-49138Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability
Microsoft · Windows · EPSS 26.21% · Threat 62CRITICAL 10
Exploit-DBATT&CK inferred
CVE-2025-34040CVE-2025-34040: An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssist…
Unknown · · EPSS 15.40% · Threat 62MEDIUM 5.4
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-24054Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
Microsoft · Windows · EPSS 62.27% · Threat 61HIGH 7.5
Exploit-DBATT&CK inferred
CVE-2023-0159CVE-2023-0159: The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not v…
wprealize · extensive vc addons for wpbakery page builder · EPSS 55.46% · Threat 61HIGH 7.5
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-2011CVE-2025-2011: The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL I…
Unknown · · EPSS 45.75% · Threat 61HIGH 8.2
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-68664CVE-2025-68664: LangChain is a framework for building agents and LLM-powered applications. Prior to versio…
langchain · langchain core · EPSS 42.93% · Threat 61HIGH 8.3
Exploit-DBATT&CK inferred
CVE-2024-0132CVE-2024-0132: NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) v…
nvidia · nvidia container toolkit · EPSS 40.84% · Threat 61HIGH 8.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-1097CVE-2025-1097: A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-ng…
Unknown · · EPSS 33.24% · Threat 61HIGH 7.5
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-30397Microsoft Windows Scripting Engine Type Confusion Vulnerability
Microsoft · Windows · EPSS 27.26% · Threat 61CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2023-26602CVE-2023-26602: ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code…
asus · asmb8-ikvm firmware · EPSS 17.40% · Threat 61CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2025-4094CVE-2025-4094: The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does …
unitedover · digits · EPSS 16.43% · Threat 61CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2026-29053CVE-2026-29053: Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically c…
ghost · ghost · EPSS 5.10% · Threat 61MEDIUM 6.5
Exploit-DBPublic PoCATT&CK inferred
CVE-2023-40028CVE-2023-40028: Ghost is an open source content management system. Versions prior to 5.59.1 are subject to…
ghost · ghost · EPSS 68.95% · Threat 60HIGH 8.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2019-13024CVE-2019-13024: Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows t…
centreon · centreon · EPSS 31.64% · Threat 60HIGH 8.8
Exploit-DBATT&CK inferred
CVE-2025-24514CVE-2025-24514: A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-ng…
Unknown · · EPSS 30.45% · Threat 60CRITICAL 9.4
Exploit-DBATT&CK inferred
CVE-2024-6298CVE-2024-6298: Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series …
abb · aspect-ent-12 firmware · EPSS 19.01% · Threat 60CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2021-33216CVE-2021-33216: An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocum…
commscope · ruckus iot controller · EPSS 13.77% · Threat 60HIGH 8.7
Exploit-DBATT&CK inferred
CVE-2024-55661CVE-2024-55661: Laravel Pulse is a real-time application performance monitoring tool and dashboard for Lar…
laravel · pulse · EPSS 29.54% · Threat 59HIGH 8.5
Metasploit moduleExploit-DBATT&CK inferred
CVE-2025-49619CVE-2025-49619: Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Promp…
Unknown · · EPSS 20.42% · Threat 59CRITICAL 9.4
Exploit-DBATT&CK inferred
CVE-2024-6209CVE-2024-6209: Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series …
abb · aspect-ent-12 firmware · EPSS 17.16% · Threat 59CRITICAL 9.3
Exploit-DBATT&CK inferred
CVE-2025-0868CVE-2025-0868: A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsG…
Unknown · · EPSS 17.09% · Threat 59CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2025-4524CVE-2025-4524: The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is …
Unknown · · EPSS 10.56% · Threat 59CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2026-0926CVE-2026-0926: The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all ver…
Unknown · · EPSS 9.30% · Threat 59HIGH 8.3
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-2783Google Chromium Mojo Sandbox Escape Vulnerability
Google · Chromium Mojo · EPSS 9.24% · Threat 59CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2026-4631CVE-2026-4631: Cockpit's remote login feature passes user-supplied hostnames and usernames from the web i…
Unknown · · EPSS 9.22% · Threat 59CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2023-33362CVE-2023-33362: Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
piwigo · piwigo · EPSS 9.06% · Threat 59CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2018-11736CVE-2018-11736: An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote att…
pluck-cms · pluck · EPSS 8.44% · Threat 59CRITICAL 9.3
Metasploit moduleExploit-DBATT&CK inferred
CVE-2026-24479CVE-2026-24479: HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP t…
hustoj · hustoj · EPSS 8.13% · Threat 59CRITICAL 9.9
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-39930CVE-2024-39930: The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/s…
gogs · gogs · EPSS 7.74% · Threat 59CRITICAL 9.9
Exploit-DBATT&CK inferred
CVE-2026-34156CVE-2026-34156: NocoBase is an AI-powered no-code/low-code platform for building business applications and…
nocobase · nocobase · EPSS 6.79% · Threat 59MEDIUM 5.4
Exploit-DBATT&CK inferred
CVE-2023-2745CVE-2023-2745: WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2,…
wordpress · wordpress · EPSS 79.39% · Threat 58HIGH 8.8
Exploit-DBATT&CK inferred
CVE-2025-26264CVE-2025-26264: GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Co…
Unknown · · EPSS 23.78% · Threat 58HIGH 8.8
Exploit-DBATT&CK inferred
CVE-2023-48292CVE-2023-48292: The XWiki Admin Tools Application provides tools to help the administration of XWiki. Star…
xwiki · admin tools · EPSS 22.94% · Threat 58CRITICAL 9.1
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-64459CVE-2025-64459: An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The…
djangoproject · django · EPSS 19.26% · Threat 58HIGH 7.8
Exploited in the wild · CISA KEVExploit-DBATT&CK inferred
CVE-2018-14634Linux Kernel Integer Overflow Vulnerability
Linux · Kernel · EPSS 14.69% · Threat 58CRITICAL 9.3
Exploit-DBPublic PoCATT&CK inferred
CVE-2026-58138CVE-2026-58138: Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vu…
Unknown · · EPSS 14.69% · Threat 58CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2024-50477CVE-2024-50477: Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mo…
stacksmarket · stacks mobile app builder · EPSS 8.12% · Threat 58CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2026-1830CVE-2026-1830: The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all ve…
Unknown · · EPSS 8.09% · Threat 58CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2019-19245CVE-2019-19245: NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the…
napc · xinet elegant 6 asset library · EPSS 7.94% · Threat 58CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2025-3605CVE-2025-3605: The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege…
Unknown · · EPSS 7.70% · Threat 58CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2022-2070CVE-2022-2070: In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since…
grandstream · gds3710 firmware · EPSS 5.84% · Threat 58CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2025-69985CVE-2025-69985: FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Cod…
frangoteam · fuxa · EPSS 5.49% · Threat 58CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2022-2025CVE-2022-2025: an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, c…
grandstream · gds3710 firmware · EPSS 5.45% · Threat 58CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2020-18662CVE-2020-18662: SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in inst…
sir · gnuboard · EPSS 5.38% · Threat 58CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2021-40617CVE-2021-40617: An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotP…
os4ed · opensis · EPSS 5.21% · Threat 58CRITICAL 10
Exploit-DBATT&CK inferred
CVE-2024-48841CVE-2024-48841: Network access can be used to execute arbitrary code with elevated privileges. This …
Unknown · · EPSS 4.40% · Threat 58CRITICAL 10
Exploit-DBATT&CK inferred
CVE-2026-61447CVE-2026-61447: PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execu…
Unknown · · EPSS 2.49% · Threat 58MEDIUM 6.1
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-41425CVE-2023-41425: Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote atta…
wondercms · wondercms · EPSS 54.31% · Threat 57HIGH 8.8
Exploit-DBATT&CK inferred
CVE-2025-47166CVE-2025-47166: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized atta…
microsoft · sharepoint enterprise server · EPSS 21.64% · Threat 57CRITICAL 9.2
Exploit-DBPublic PoCATT&CK inferred
CVE-2026-109618CVE-2026-109618: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort ha…
php · php · EPSS 11.84% · Threat 57CRITICAL 9.3
Exploit-DBATT&CK inferred
CVE-2025-46811CVE-2025-46811: A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability…
Unknown · · EPSS 11.28% · Threat 57HIGH 7.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-21333Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability
Microsoft · Windows · EPSS 10.07% · Threat 57CRITICAL 9.5
Exploit-DBATT&CK inferred
CVE-2026-25895