CVERadar

CVEs: Public PoC, page 2

907 CVEs with public proof-of-concept code on GitHub that meets the quality bar, sorted by threat level then EPSS. Showing 121-240. Use search to combine filters.

Public proof-of-concept code can be fake or malicious. Verify before running, and only in an isolated lab. A PoC means exploit code is public, not that the CVE is exploited in the wild.

CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-48908

JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

JoomShaper · SP Page Builder · EPSS 88.51% · Threat 92
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-20079

Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management · EPSS 88.47% · Threat 92
CRITICAL 9.3Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-50751

Check Point Security Gateway Improper Authentication Vulnerability

Check Point · Security Gateway · EPSS 85.34% · Threat 92
HIGH 8.2RansomwareTop #6
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-21893

Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

Ivanti · Connect Secure, Policy Secure, and Neurons · EPSS 100.00% · Threat 91
HIGH 8.2RansomwareTop #64
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-46805

Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

Ivanti · Connect Secure and Policy Secure · EPSS 99.99% · Threat 91
CRITICAL 9.3Top #80
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2024-4879

ServiceNow Improper Input Validation Vulnerability

ServiceNow · Utah, Vancouver, and Washington DC Now Platform · EPSS 99.98% · Threat 91
CRITICAL 9.2
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-9465

Palo Alto Networks Expedition SQL Injection Vulnerability

Palo Alto Networks · Expedition · EPSS 99.63% · Threat 91
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-34028

Commvault Command Center Path Traversal Vulnerability

Commvault · Command Center · EPSS 97.60% · Threat 91
CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-56145

Craft CMS Code Injection Vulnerability

Craft CMS · Craft CMS · EPSS 97.41% · Threat 91
CRITICAL 9.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2017-3066

Adobe ColdFusion Deserialization Vulnerability

Adobe · ColdFusion · EPSS 90.60% · Threat 91
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-37164

Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability

Hewlett Packard Enterprise (HPE) · OneView · EPSS 90.19% · Threat 91
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-54253

Adobe Experience Manager Forms Code Execution Vulnerability

Adobe · Experience Manager (AEM) Forms · EPSS 88.26% · Threat 91
HIGH 8RansomwareTop #84
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2022-41082

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · EPSS 99.97% · Threat 90
CRITICAL 9.1Top #94
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-38475

Apache HTTP Server Improper Escaping of Output Vulnerability

Apache · HTTP Server · EPSS 99.96% · Threat 90
CRITICAL 9.2
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-54068

Laravel Livewire Code Injection Vulnerability

Laravel · Livewire · EPSS 96.28% · Threat 90
HIGH 8.4Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-8088

RARLAB WinRAR Path Traversal Vulnerability

RARLAB · WinRAR · EPSS 94.51% · Threat 90
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-24858

Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Fortinet · Multiple Products · EPSS 85.80% · Threat 90
HIGH 8.8Top #15
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2023-1389

TP-Link Archer AX-21 Command Injection Vulnerability

TP-Link · Archer AX21 · EPSS 100.00% · Threat 89
HIGH 8.8Top #76
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2023-4863

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Google · Chromium WebP · EPSS 99.98% · Threat 89
HIGH 7.8RansomwareTop #100
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2017-11882

Microsoft Office Memory Corruption Vulnerability

Microsoft · Office · EPSS 99.94% · Threat 89
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2022-42889

CVE-2022-42889: Apache Commons Text performs variable interpolation, allowing properties to be dynamically…

apache · commons text · EPSS 99.93% · Threat 89
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-68613

n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

n8n · n8n · EPSS 98.99% · Threat 89
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-49113

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube · Webmail · EPSS 98.97% · Threat 89
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-0108

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Palo Alto Networks · PAN-OS · EPSS 98.45% · Threat 89
CRITICAL 9.1
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-54236

Adobe Commerce and Magento Improper Input Validation Vulnerability

Adobe · Commerce and Magento · EPSS 94.66% · Threat 89
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-9242

WatchGuard Firebox Out-of-Bounds Write Vulnerability

WatchGuard · Firebox · EPSS 91.80% · Threat 89
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2021-23758

Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

Ajax.NET Professional · Ajax.NET Professional · EPSS 82.58% · Threat 89
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-6553

CVE-2023-6553: The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all ve…

backupbliss · backup migration · EPSS 97.85% · Threat 88
HIGH 7.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-0257

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Palo Alto Networks · PAN-OS · EPSS 96.89% · Threat 88
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-0204

CVE-2024-0204: Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized use…

fortra · goanywhere managed file transfer · EPSS 95.09% · Threat 88
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-43468

Microsoft Configuration Manager SQL Injection Vulnerability

Microsoft · Configuration Manager · EPSS 81.04% · Threat 88
HIGH 7.5RansomwareTop #11
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-4966

Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

Citrix · NetScaler ADC and NetScaler Gateway · EPSS 100.00% · Threat 87
HIGH 7.5RansomwareTop #49
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-10271

Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server · EPSS 99.99% · Threat 87
HIGH 7.5Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-57727

SimpleHelp Path Traversal Vulnerability

SimpleHelp · SimpleHelp · EPSS 96.83% · Threat 87
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-30258

CVE-2023-30258: Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote …

magnussolution · magnusbilling · EPSS 94.25% · Threat 87
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-8856

CVE-2024-8856: The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary …

revmakx · backup and staging by wp time capsule · EPSS 94.14% · Threat 87
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-21962

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in · EPSS 73.19% · Threat 87
HIGH 7.2RansomwareTop #17
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2023-0669

Fortra GoAnywhere MFT Remote Code Execution Vulnerability

Fortra · GoAnywhere MFT · EPSS 100.00% · Threat 86
CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-1974

CVE-2025-1974: A security issue was discovered in Kubernetes where under certain conditions, an unauthent…

Unknown · · EPSS 99.38% · Threat 86
CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-66516

CVE-2025-66516: Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika…

apache · tika · EPSS 88.98% · Threat 86
CRITICAL 10
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-25600

CVE-2024-25600: Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited …

Unknown · · EPSS 88.23% · Threat 86
CRITICAL 10
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-59528

CVE-2025-59528: Flowise is a drag & drop user interface to build a customized large language model flow. I…

flowiseai · flowise · EPSS 86.22% · Threat 86
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-42009

RoundCube Webmail Cross-Site Scripting Vulnerability

Roundcube · Webmail · EPSS 82.88% · Threat 86
HIGH 8.1Top #50
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-11776

Apache Struts Remote Code Execution Vulnerability

Apache · Struts · EPSS 99.99% · Threat 85
HIGH 8.1Top #85
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-12617

Apache Tomcat Remote Code Execution Vulnerability

Apache · Tomcat · EPSS 99.97% · Threat 85
CRITICAL 9.1
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-29927

CVE-2025-29927: Next.js is a React framework for building full-stack web applications. Starting in version…

vercel · next.js · EPSS 99.22% · Threat 85
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2025-33053

Microsoft Windows External Control of File Name or Path Vulnerability

Microsoft · Windows · EPSS 87.02% · Threat 85
CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-24799

CVE-2025-24799: GLPI is a free asset and IT management software package. An unauthenticated user can perfo…

glpi-project · glpi · EPSS 86.69% · Threat 85
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-5360

CVE-2023-5360: The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly …

royal-elementor-addons · royal elementor addons · EPSS 86.35% · Threat 85
CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-16232

Check Point SmartConsole Improper Authentication Vulnerability

Check Point · SmartConsole · EPSS 77.97% · Threat 85
HIGH 7.8Top #73
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-22204

ExifTool Remote Code Execution Vulnerability

Perl · Exiftool · EPSS 99.98% · Threat 84
HIGH 7.8Top #90
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-3156

Sudo Heap-Based Buffer Overflow Vulnerability

Sudo · Sudo · EPSS 99.96% · Threat 84
HIGH 8.6
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-20230

Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

Cisco · Unified Communications Manager · EPSS 88.20% · Threat 84
HIGH 8.7
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-8110

Gogs Path Traversal Vulnerability

Gogs · Gogs · EPSS 85.20% · Threat 84
HIGH 8.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2025-33073

Microsoft Windows SMB Client Improper Access Control Vulnerability

Microsoft · Windows · EPSS 82.70% · Threat 84
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-44000

CVE-2024-44000: Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cac…

litespeedtech · litespeed cache · EPSS 82.34% · Threat 84
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-10924

CVE-2024-10924: The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulner…

really-simple-plugins · really simple security · EPSS 82.22% · Threat 84
HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-8291

Artifex Ghostscript Type Confusion Vulnerability

Artifex · Ghostscript · EPSS 96.97% · Threat 83
MEDIUM 6.9Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-9474

Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

Palo Alto Networks · PAN-OS · EPSS 94.82% · Threat 83
CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2018-1207

CVE-2018-1207: Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability …

dell · emc idrac7 · EPSS 90.09% · Threat 83
HIGH 8.7
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-14847

MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

MongoDB · MongoDB and MongoDB Server · EPSS 83.22% · Threat 83
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-0770

Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Langflow · Langflow · EPSS 62.56% · Threat 83
CRITICAL 10Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-20131

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

Cisco · Secure Firewall Management Center (FMC) · EPSS 43.17% · Threat 83
HIGH 7.5Top #19
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2014-0160

OpenSSL Information Disclosure Vulnerability

OpenSSL · OpenSSL · EPSS 100.00% · Threat 82
HIGH 7.5Top #13
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-32315

Ignite Realtime Openfire Path Traversal Vulnerability

Ignite Realtime · Openfire · EPSS 100.00% · Threat 82
HIGH 7.5Top #12
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2023-44487

HTTP/2 Rapid Reset Attack Vulnerability

IETF · HTTP/2 · EPSS 100.00% · Threat 82
HIGH 7.5Top #52
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-13159

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti · Endpoint Manager (EPM) · EPSS 99.99% · Threat 82
HIGH 7.5Top #54
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2020-3452

Cisco ASA and FTD Read-Only Path Traversal Vulnerability

Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) · EPSS 99.99% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2025-4427

Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) · EPSS 99.93% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-28995

SolarWinds Serv-U Path Traversal Vulnerability

SolarWinds · Serv-U · EPSS 99.61% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2015-5477

ISC BIND Data Processing Errors Vulnerability

ISC · BIND · EPSS 99.41% · Threat 82
MEDIUM 6.5Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2025-49706

Microsoft SharePoint Improper Authentication Vulnerability

Microsoft · SharePoint · EPSS 99.09% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-29059

Microsoft .NET Framework Information Disclosure Vulnerability

Microsoft · .NET Framework · EPSS 98.62% · Threat 82
HIGH 7.4
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-20767

Adobe ColdFusion Improper Access Control Vulnerability

Adobe · ColdFusion · EPSS 98.51% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-5418

Rails Ruby on Rails Path Traversal Vulnerability

Rails · Ruby on Rails · EPSS 98.51% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2020-25078

D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability

D-Link · DCS-2530L and DCS-2670L Devices · EPSS 97.51% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2021-41277

Metabase GeoJSON API Local File Inclusion Vulnerability

Metabase · Metabase · EPSS 97.18% · Threat 82
CRITICAL 9.2
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-10914

CVE-2024-10914: A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 2024102…

dlink · dns-320 firmware · EPSS 96.28% · Threat 82
HIGH 8.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-43284

CVE-2026-43284: In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-p…

linux · linux kernel · EPSS 94.19% · Threat 82
CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-48827

CVE-2025-48827: vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invo…

vbulletin · vbulletin · EPSS 75.64% · Threat 82
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2015-7755

Juniper ScreenOS Improper Authentication Vulnerability

Juniper · ScreenOS · EPSS 61.14% · Threat 82
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-58360

OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

OSGeo · GeoServer · EPSS 60.01% · Threat 82
HIGH 7.2
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2021-21311

Adminer Server-Side Request Forgery Vulnerability

Adminer · Adminer · EPSS 98.46% · Threat 81
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2024-9047

CVE-2024-9047: The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all vers…

iptanus · wordpress file upload · EPSS 93.34% · Threat 81
HIGH 7.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-6218

RARLAB WinRAR Path Traversal Vulnerability

RARLAB · WinRAR · EPSS 90.48% · Threat 81
HIGH 8.9
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-73570

Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 71.66% · Threat 81
CRITICAL 9.1
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-55040

Microsoft SharePoint Weak Authentication Vulnerability

Microsoft · SharePoint · EPSS 69.54% · Threat 81
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-11371

Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

Gladinet · CentreStack and Triofox · EPSS 92.14% · Threat 80
CRITICAL 9.3
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-32429

CVE-2025-32429: XWiki Platform is a generic wiki platform offering runtime services for applications built…

xwiki · xwiki · EPSS 87.90% · Threat 80
CRITICAL 9.9
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-42327

CVE-2024-42327: A non-admin user account on the Zabbix frontend with the default User role, or with any ot…

zabbix · zabbix · EPSS 79.11% · Threat 80
CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-2294

CVE-2025-2294: The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in al…

Unknown · · EPSS 78.36% · Threat 80
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-43798

Grafana Path Traversal Vulnerability

Grafana Labs · Grafana · EPSS 88.50% · Threat 79
CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-13486

CVE-2025-13486: The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Exe…

Unknown · · EPSS 67.62% · Threat 79
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-23744

CVE-2026-23744: MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 a…

mcpjam · inspector · EPSS 67.52% · Threat 79
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-34910

Ubiquiti UniFi OS Improper Input Validation Vulnerability

Ubiquiti · UniFi OS · EPSS 45.77% · Threat 79
HIGH 8.1
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-1094

CVE-2025-1094: Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(),…

Unknown · · EPSS 90.03% · Threat 78
CRITICAL 9.9
Public PoCATT&CK inferred
CVE-2025-49844

CVE-2025-49844: Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and belo…

redis · redis · EPSS 82.64% · Threat 78
HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-22555

Linux Kernel Heap Out-of-Bounds Write Vulnerability

Linux · Kernel · EPSS 78.68% · Threat 78
CRITICAL 9.3
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-34299

CVE-2025-34299: Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated a…

monstaftp · monsta ftp · EPSS 72.68% · Threat 78
CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2023-3460

CVE-2023-3460: The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating …

ultimatemember · ultimate member · EPSS 72.31% · Threat 78
CRITICAL 9
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-53690

Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Sitecore · Multiple Products · EPSS 60.60% · Threat 78
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-39808

Fortinet FortiSandbox OS Command Injection Vulnerability

Fortinet · FortiSandbox · EPSS 47.36% · Threat 78
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-48282

Adobe ColdFusion Path Traversal Vulnerability

Adobe · ColdFusion · EPSS 42.39% · Threat 78
HIGH 8.1
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-6387

CVE-2024-6387: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is …

sonicwall · sma 6200 firmware · EPSS 99.51% · Threat 77
HIGH 8.1
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-43425

CVE-2024-43425: A flaw was found in Moodle. Additional restrictions are required to avoid a remote code ex…

moodle · moodle · EPSS 87.54% · Threat 77
HIGH 7.2
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2018-9276

Paessler PRTG Network Monitor OS Command Injection Vulnerability

Paessler · PRTG Network Monitor · EPSS 87.00% · Threat 77
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-9621

Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 81.04% · Threat 77
CRITICAL 10
Public PoCATT&CK inferred
CVE-2026-21858

CVE-2026-21858: n8n is an open source workflow automation platform. Versions starting with 1.65.0 and belo…

n8n · n8n · EPSS 78.19% · Threat 77
HIGH 7.8Ransomware
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2024-21338

Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

Microsoft · Windows · EPSS 59.81% · Threat 77
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2023-49105

ownCloud Improper Authentication Vulnerability

ownCloud · ownCloud · EPSS 43.19% · Threat 77
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-26794

CVE-2025-26794: Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote …

exim · exim · EPSS 77.49% · Threat 76
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-6389

CVE-2025-6389: The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all ve…

Unknown · · EPSS 76.14% · Threat 76
HIGH 8.7
Metasploit modulePublic PoCATT&CK inferred
CVE-2026-22200

CVE-2026-22200: Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an…

enhancesoft · osticket · EPSS 73.59% · Threat 76
CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-28000

CVE-2024-28000: Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache lit…

litespeedtech · litespeed cache · EPSS 68.27% · Threat 76
CRITICAL 9.9
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-55315

CVE-2025-55315: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NE…

microsoft · asp.net core · EPSS 66.53% · Threat 76
CRITICAL 10
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-49132

CVE-2025-49132: Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11,…

Unknown · · EPSS 54.46% · Threat 76
HIGH 8.1
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-25094

CVE-2021-25094: The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior …

brandexponents · tatsu · EPSS 83.23% · Threat 75
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-21298

CVE-2025-21298: Windows OLE Remote Code Execution Vulnerability

microsoft · windows 10 1507 · EPSS 74.37% · Threat 75
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-21182

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server · EPSS 74.16% · Threat 75
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2024-12084

CVE-2024-12084: A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to impr…

samba · rsync · EPSS 72.51% · Threat 75