CVEs: Metasploit module, page 2
373 CVEs with a public Metasploit Framework module, sorted by threat level then EPSS. Showing 121-240. Use search to combine filters.
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-0204CVE-2024-0204: Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized use…
fortra · goanywhere managed file transfer · EPSS 95.09% · Threat 88HIGH 7.5RansomwareTop #11
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-4966Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Citrix · NetScaler ADC and NetScaler Gateway · EPSS 100.00% · Threat 87HIGH 7.5RansomwareTop #49
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-10271Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Oracle · WebLogic Server · EPSS 99.99% · Threat 87HIGH 7.5Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-57727SimpleHelp Path Traversal Vulnerability
SimpleHelp · SimpleHelp · EPSS 96.83% · Threat 87CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-30258CVE-2023-30258: Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote …
magnussolution · magnusbilling · EPSS 94.25% · Threat 87CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-8856CVE-2024-8856: The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary …
revmakx · backup and staging by wp time capsule · EPSS 94.14% · Threat 87HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2010-0249Microsoft Internet Explorer Use-After-Free Vulnerability
Microsoft · Internet Explorer · EPSS 91.94% · Threat 87HIGH 7.2RansomwareTop #17
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2023-0669Fortra GoAnywhere MFT Remote Code Execution Vulnerability
Fortra · GoAnywhere MFT · EPSS 100.00% · Threat 86HIGH 8.7
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2026-42271BerriAI LiteLLM Command Injection Vulnerability
BerriAI · LiteLLM · EPSS 92.57% · Threat 86CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-66516CVE-2025-66516: Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika…
apache · tika · EPSS 88.98% · Threat 86CRITICAL 10
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-25600CVE-2024-25600: Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited …
Unknown · · EPSS 88.23% · Threat 86CRITICAL 10
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-59528CVE-2025-59528: Flowise is a drag & drop user interface to build a customized large language model flow. I…
flowiseai · flowise · EPSS 86.22% · Threat 86CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2025-40536SolarWinds Web Help Desk Security Control Bypass Vulnerability
SolarWinds · Web Help Desk · EPSS 73.56% · Threat 86HIGH 8.1Top #50
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-11776Apache Struts Remote Code Execution Vulnerability
Apache · Struts · EPSS 99.99% · Threat 85HIGH 8.1Top #85
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-12617Apache Tomcat Remote Code Execution Vulnerability
Apache · Tomcat · EPSS 99.97% · Threat 85CRITICAL 9.1
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-29927CVE-2025-29927: Next.js is a React framework for building full-stack web applications. Starting in version…
vercel · next.js · EPSS 99.22% · Threat 85HIGH 8.1
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2010-3962Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
Microsoft · Internet Explorer · EPSS 96.83% · Threat 85HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleCTID-mapped
CVE-2025-4428Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM) · EPSS 88.00% · Threat 85HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2013-3893Microsoft Internet Explorer Resource Management Errors Vulnerability
Microsoft · Internet Explorer · EPSS 87.64% · Threat 85HIGH 8.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2025-33053Microsoft Windows External Control of File Name or Path Vulnerability
Microsoft · Windows · EPSS 87.02% · Threat 85CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-24799CVE-2025-24799: GLPI is a free asset and IT management software package. An unauthenticated user can perfo…
glpi-project · glpi · EPSS 86.69% · Threat 85HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2009-3459Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Adobe · Acrobat and Reader · EPSS 86.65% · Threat 85CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-5360CVE-2023-5360: The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly …
royal-elementor-addons · royal elementor addons · EPSS 86.35% · Threat 85HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2026-81578PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
PaperCut · NG/MF · EPSS 85.58% · Threat 85CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-16232Check Point SmartConsole Improper Authentication Vulnerability
Check Point · SmartConsole · EPSS 77.97% · Threat 85HIGH 7.8Top #73
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-22204ExifTool Remote Code Execution Vulnerability
Perl · Exiftool · EPSS 99.98% · Threat 84HIGH 7.8Top #90
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-3156Sudo Heap-Based Buffer Overflow Vulnerability
Sudo · Sudo · EPSS 99.96% · Threat 84HIGH 8.1
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2016-3081Apache Struts Command Injection Vulnerability
Apache · Struts · EPSS 96.05% · Threat 84CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2025-47916CVE-2025-47916: Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template st…
invisioncommunity · invisioncommunity · EPSS 84.32% · Threat 84CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-44000CVE-2024-44000: Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cac…
litespeedtech · litespeed cache · EPSS 82.34% · Threat 84HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2010-0806Microsoft Internet Explorer Use-After-Free Vulnerability
Microsoft · Internet Explorer · EPSS 82.24% · Threat 84CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-10924CVE-2024-10924: The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulner…
really-simple-plugins · really simple security · EPSS 82.22% · Threat 84CRITICAL 10
Metasploit moduleATT&CK inferred
CVE-2025-34300CVE-2025-34300: A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio version…
Unknown · · EPSS 81.26% · Threat 84CRITICAL 10
Metasploit moduleExploit-DBATT&CK inferred
CVE-2024-20419CVE-2024-20419: A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM …
cisco · smart software manager on-prem · EPSS 80.64% · Threat 84HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-8291Artifex Ghostscript Type Confusion Vulnerability
Artifex · Ghostscript · EPSS 96.97% · Threat 83MEDIUM 6.9Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-9474Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
Palo Alto Networks · PAN-OS · EPSS 94.82% · Threat 83CRITICAL 9.4
Metasploit moduleATT&CK inferred
CVE-2025-34152CVE-2025-34152: An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 W…
Unknown · · EPSS 86.84% · Threat 83HIGH 8.6
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2025-64328Sangoma FreePBX OS Command Injection Vulnerability
Sangoma · FreePBX · EPSS 84.62% · Threat 83HIGH 8.7
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-14847MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
MongoDB · MongoDB and MongoDB Server · EPSS 83.22% · Threat 83CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2024-2054CVE-2024-2054: The Artica-Proxy administrative web application will deserialize arbitrary PHP objects sup…
articatech · artica proxy · EPSS 81.26% · Threat 83CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-0770Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Langflow · Langflow · EPSS 62.56% · Threat 83HIGH 7.5Top #19
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2014-0160OpenSSL Information Disclosure Vulnerability
OpenSSL · OpenSSL · EPSS 100.00% · Threat 82HIGH 7.5Top #13
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-32315Ignite Realtime Openfire Path Traversal Vulnerability
Ignite Realtime · Openfire · EPSS 100.00% · Threat 82HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2025-4427Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM) · EPSS 99.93% · Threat 82HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-28995SolarWinds Serv-U Path Traversal Vulnerability
SolarWinds · Serv-U · EPSS 99.61% · Threat 82HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2015-5477ISC BIND Data Processing Errors Vulnerability
ISC · BIND · EPSS 99.41% · Threat 82MEDIUM 6.5Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2025-49706Microsoft SharePoint Improper Authentication Vulnerability
Microsoft · SharePoint · EPSS 99.09% · Threat 82HIGH 7.4
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-20767Adobe ColdFusion Improper Access Control Vulnerability
Adobe · ColdFusion · EPSS 98.51% · Threat 82HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-5418Rails Ruby on Rails Path Traversal Vulnerability
Rails · Ruby on Rails · EPSS 98.51% · Threat 82HIGH 8.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-43284CVE-2026-43284: In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-p…
linux · linux kernel · EPSS 94.19% · Threat 82CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2024-3408CVE-2024-3408: man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code e…
man · d-tale · EPSS 77.97% · Threat 82HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2019-15949Nagios XI Remote Code Execution Vulnerability
Nagios · Nagios XI · EPSS 77.04% · Threat 82HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2008-0015Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability
Microsoft · Windows · EPSS 76.58% · Threat 82CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-48827CVE-2025-48827: vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invo…
vbulletin · vbulletin · EPSS 75.64% · Threat 82CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2025-8943CVE-2025-8943: The Custom MCPs feature is designed to execute OS commands, for instance, using tools like…
flowiseai · flowise · EPSS 75.20% · Threat 82CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2015-7755Juniper ScreenOS Improper Authentication Vulnerability
Juniper · ScreenOS · EPSS 61.14% · Threat 82CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-58360OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
OSGeo · GeoServer · EPSS 60.01% · Threat 82CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2025-11749CVE-2025-11749: The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all …
Unknown · · EPSS 74.66% · Threat 81HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2013-3918Microsoft Windows Out-of-Bounds Write Vulnerability
Microsoft · Windows · EPSS 73.69% · Threat 81CRITICAL 9.4
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2026-82078PaperCut NG/MF Unsafe Reflection Vulnerability
PaperCut · NG/MF · EPSS 63.53% · Threat 81HIGH 7.2
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBCTID-mapped
CVE-2022-43769Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
Hitachi Vantara · Pentaho Business Analytics (BA) Server · EPSS 97.67% · Threat 80HIGH 7.5
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-11371Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
Gladinet · CentreStack and Triofox · EPSS 92.14% · Threat 80HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-43798Grafana Path Traversal Vulnerability
Grafana Labs · Grafana · EPSS 88.50% · Threat 79CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-13486CVE-2025-13486: The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Exe…
Unknown · · EPSS 67.62% · Threat 79CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-23744CVE-2026-23744: MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 a…
mcpjam · inspector · EPSS 67.52% · Threat 79CRITICAL 10
Metasploit moduleATT&CK inferred
CVE-2024-47407CVE-2024-47407: A parameter within a command does not properly validate input within myPRO Manager which c…
Unknown · · EPSS 63.77% · Threat 79CRITICAL 10
Metasploit moduleATT&CK inferred
CVE-2024-46506CVE-2024-46506: NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection v…
netalertx · netalertx · EPSS 62.67% · Threat 79HIGH 8.1
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-1094CVE-2025-1094: Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(),…
Unknown · · EPSS 90.03% · Threat 78HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-22555Linux Kernel Heap Out-of-Bounds Write Vulnerability
Linux · Kernel · EPSS 78.68% · Threat 78CRITICAL 9.3
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-34299CVE-2025-34299: Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated a…
monstaftp · monsta ftp · EPSS 72.68% · Threat 78HIGH 8.1
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-43425CVE-2024-43425: A flaw was found in Moodle. Additional restrictions are required to avoid a remote code ex…
moodle · moodle · EPSS 87.54% · Threat 77HIGH 7.2
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2018-9276Paessler PRTG Network Monitor OS Command Injection Vulnerability
Paessler · PRTG Network Monitor · EPSS 87.00% · Threat 77HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-9621Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 81.04% · Threat 77HIGH 8.7
Metasploit modulePublic PoCATT&CK inferred
CVE-2026-22200CVE-2026-22200: Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an…
enhancesoft · osticket · EPSS 73.59% · Threat 76CRITICAL 10
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-49132CVE-2025-49132: Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11,…
Unknown · · EPSS 54.46% · Threat 76HIGH 8.1
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-25094CVE-2021-25094: The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior …
brandexponents · tatsu · EPSS 83.23% · Threat 75CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2025-27007CVE-2025-27007: Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allo…
Unknown · · EPSS 54.19% · Threat 75CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2025-32375CVE-2025-32375: BentoML is a Python library for building online serving systems optimized for AI apps and …
bentoml · bentoml · EPSS 52.41% · Threat 75CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2025-7441CVE-2025-7441: The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all version…
Unknown · · EPSS 49.89% · Threat 74HIGH 8.1
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-3102CVE-2025-3102: The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an …
Unknown · · EPSS 76.24% · Threat 73HIGH 8.6
Metasploit moduleATT&CK inferred
CVE-2024-48766CVE-2024-48766: NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP clie…
netalertx · netalertx · EPSS 67.91% · Threat 73HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-4911GNU C Library Buffer Overflow Vulnerability
GNU · GNU C Library · EPSS 63.77% · Threat 73CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2024-51568CVE-2024-51568: CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the…
cyberpanel · cyberpanel · EPSS 47.67% · Threat 73CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2024-48760CVE-2024-48760: An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the fil…
gestioip · gestioip · EPSS 45.78% · Threat 73CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-9198IBM Langflow Code Injection Vulnerability
IBM · Langflow · EPSS 28.66% · Threat 73MEDIUM 6.5
Metasploit moduleATT&CK inferred
CVE-2025-53771CVE-2025-53771: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to …
microsoft · sharepoint server · EPSS 99.89% · Threat 72MEDIUM 6.9
Metasploit moduleATT&CK inferred
CVE-2024-11320CVE-2024-11320: Arbitrary commands execution on the server by exploiting a command injection vulnerability…
pandorafms · pandora fms · EPSS 91.20% · Threat 72HIGH 7.2
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-25641CVE-2024-25641: Cacti provides an operational monitoring and fault management framework. Prior to version …
cacti · cacti · EPSS 86.30% · Threat 72CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2024-55556CVE-2024-55556: A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the…
Unknown · · EPSS 43.91% · Threat 72CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2020-36847CVE-2020-36847: The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versio…
simplefilelist · simple file list · EPSS 43.52% · Threat 72CRITICAL 10Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
SonicWall · SMA1000 Appliances · EPSS 6.79% · Threat 72HIGH 8.6
Metasploit moduleATT&CK inferred
CVE-2024-12971CVE-2024-12971: Improper Neutralization of Special Elements used in a Command vulnerability allows OS Comm…
artica · pandora fms · EPSS 61.49% · Threat 71HIGH 8.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-2945CVE-2025-2945: Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deploymen…
pgadmin · pgadmin 4 · EPSS 56.30% · Threat 71HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-32463Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Sudo · Sudo · EPSS 55.50% · Threat 71CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2026-0769CVE-2026-0769: Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. Th…
langflow · langflow · EPSS 41.22% · Threat 71CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-27520CVE-2025-27520: BentoML is a Python library for building online serving systems optimized for AI apps and …
bentoml · bentoml · EPSS 40.62% · Threat 71HIGH 8.7
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-24367CVE-2025-24367: Cacti is an open source performance and fault management framework. An authenticated Cacti…
cacti · cacti · EPSS 54.02% · Threat 70CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-48907Widget Factory Joomla Content Editor Improper Access Control Vulnerability
Widget Factory · Joomla Content Editor · EPSS 16.19% · Threat 70CRITICAL 9.3
Metasploit moduleATT&CK inferred
CVE-2026-2329CVE-2026-2329: An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoi…
grandstream · gxp1610 firmware · EPSS 41.72% · Threat 69CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-4257CVE-2026-4257: The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template I…
Unknown · · EPSS 32.78% · Threat 69CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-33017Langflow Code Injection Vulnerability
Langflow · Langflow · EPSS 24.75% · Threat 69CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-9082Drupal Core SQL Injection Vulnerability
Drupal · Core · EPSS 15.70% · Threat 69CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-86218N-able N-central Static Code Injection Vulnerability
N-able · N-central · EPSS 13.35% · Threat 69HIGH 8.1
Metasploit moduleATT&CK inferred
CVE-2025-48828CVE-2025-48828: Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing …
vbulletin · vbulletin · EPSS 57.30% · Threat 68CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-3891CVE-2026-3891: The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due t…
Unknown · · EPSS 29.73% · Threat 68HIGH 7.2
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2025-58034Fortinet FortiWeb OS Command Injection Vulnerability
Fortinet · FortiWeb · EPSS 54.72% · Threat 67CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2026-59774CVE-2026-59774: Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository m…
Unknown · · EPSS 28.31% · Threat 67CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-63030WordPress Core Interpretation Conflict Vulnerability
WordPress · Core · EPSS 10.65% · Threat 67CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-83548SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
SonicWall · SMA1000 Appliances · EPSS 8.04% · Threat 67HIGH 7.5
Metasploit moduleExploit-DBATT&CK inferred
CVE-2024-8522CVE-2024-8522: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection …
thimpress · learnpress · EPSS 62.88% · Threat 66HIGH 7.1
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2025-14611Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability
Gladinet · CentreStack and Triofox · EPSS 53.30% · Threat 66HIGH 8.4
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-54988CVE-2025-54988: Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and inclu…
apache · tika · EPSS 47.95% · Threat 66HIGH 8.6
Metasploit moduleATT&CK inferred
CVE-2025-61678CVE-2025-61678: FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. …
Unknown · · EPSS 44.01% · Threat 66CRITICAL 9.2
Metasploit moduleATT&CK inferred
CVE-2026-0826CVE-2026-0826: In certain scenarios when the admin has enabled Interactive Connectivity Establishment (IC…
Unknown · · EPSS 32.23% · Threat 66CRITICAL 9.5
Metasploit modulePublic PoCATT&CK inferred
CVE-2026-66066CVE-2026-66066: Action Pack is a framework for handling and responding to web requests. In versions prior …
Unknown · · EPSS 27.86% · Threat 66CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2026-0768CVE-2026-0768: Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allow…
langflow · langflow · EPSS 23.09% · Threat 66HIGH 8.1
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-2563CVE-2025-2563: The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users t…
wpeverest · user registration \& membership · EPSS 49.08% · Threat 65HIGH 8.6
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-61675CVE-2025-61675: FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. …
Unknown · · EPSS 38.76% · Threat 65CRITICAL 10
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-34077CVE-2025-34077: An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1…
Unknown · · EPSS 16.38% · Threat 65CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2026-22778