CVERadar

CVEs: Public PoC, page 3

907 CVEs with public proof-of-concept code on GitHub that meets the quality bar, sorted by threat level then EPSS. Showing 241-360. Use search to combine filters.

Public proof-of-concept code can be fake or malicious. Verify before running, and only in an isolated lab. A PoC means exploit code is public, not that the CVE is exploited in the wild.

CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2024-49112

CVE-2024-49112: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

microsoft · windows 10 1507 · EPSS 72.17% · Threat 75
HIGH 7.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-21509

Microsoft Office Security Feature Bypass Vulnerability

Microsoft · Office · EPSS 70.80% · Threat 75
CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2026-0740

CVE-2026-0740: The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file upload…

Unknown · · EPSS 62.90% · Threat 75
HIGH 8.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-2441

Google Chromium CSS Use-After-Free Vulnerability

Google · Chromium · EPSS 54.96% · Threat 75
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-20393

Cisco Multiple Products Improper Input Validation Vulnerability

Cisco · Multiple Products · EPSS 32.39% · Threat 75
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-43300

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Apple · iOS, iPadOS, and macOS · EPSS 32.03% · Threat 75
HIGH 8.8
Public PoCATT&CK inferred
CVE-2022-41678

CVE-2022-41678: Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execut…

apache · activemq · EPSS 85.81% · Threat 74
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-85046

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · EPSS 48.88% · Threat 74
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-68645

Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 48.87% · Threat 74
CRITICAL 10
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-56290

Joomlack Page Builder Improper Access Control Vulnerability

Joomlack · Page Builder · EPSS 30.87% · Threat 74
MEDIUM 6.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-43451

Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability

Microsoft · Windows · EPSS 84.27% · Threat 73
HIGH 8.1
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-3102

CVE-2025-3102: The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an …

Unknown · · EPSS 76.24% · Threat 73
CRITICAL 9.5
Public PoCATT&CK inferred
CVE-2024-53677

CVE-2024-53677: File upload logic in Apache Struts is flawed. An attacker can manipulate file upload param…

apache · struts · EPSS 70.46% · Threat 73
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-25256

CVE-2025-25256: An improper neutralization of special elements used in an OS command ('OS Command Injectio…

fortinet · fortisiem · EPSS 65.30% · Threat 73
HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-4911

GNU C Library Buffer Overflow Vulnerability

GNU · GNU C Library · EPSS 63.77% · Threat 73
CRITICAL 9.3
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-39987

Marimo Remote Code Execution Vulnerability

Marimo · Marimo · EPSS 37.87% · Threat 73
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-32756

Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

Fortinet · Multiple Products · EPSS 30.94% · Threat 73
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-76461

Cisco Secure Email Gateway SQL Injection Vulnerability

Cisco · Secure Email Gateway · EPSS 29.54% · Threat 73
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-9198

IBM Langflow Code Injection Vulnerability

IBM · Langflow · EPSS 28.66% · Threat 73
HIGH 7.2
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-25641

CVE-2024-25641: Cacti provides an operational monitoring and fault management framework. Prior to version …

cacti · cacti · EPSS 86.30% · Threat 72
CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2024-27954

CVE-2024-27954: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili…

Unknown · · EPSS 72.77% · Threat 72
HIGH 8.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-4367

CVE-2024-4367: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaSc…

mozilla · firefox · EPSS 70.66% · Threat 72
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-31125

Vite Vitejs Improper Access Control Vulnerability

Vite · Vitejs · EPSS 65.76% · Threat 72
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2023-45878

CVE-2023-45878: GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_vis…

gibbonedu · gibbon · EPSS 63.11% · Threat 72
CRITICAL 10Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-15409

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

SonicWall · SMA1000 Appliances · EPSS 6.79% · Threat 72
MEDIUM 5.3Top #2
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2021-26086

Atlassian Jira Server and Data Center Path Traversal Vulnerability

Atlassian · Jira Server and Data Center · EPSS 100.00% · Threat 71
MEDIUM 6.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2020-11023

JQuery Cross-Site Scripting (XSS) Vulnerability

JQuery · JQuery · EPSS 84.89% · Threat 71
HIGH 8.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-2945

CVE-2025-2945: Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deploymen…

pgadmin · pgadmin 4 · EPSS 56.30% · Threat 71
HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-32463

Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Sudo · Sudo · EPSS 55.50% · Threat 71
CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-58434

CVE-2025-58434: Flowise is a drag & drop user interface to build a customized large language model flow. I…

flowiseai · flowise · EPSS 50.54% · Threat 71
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2023-33538

TP-Link Multiple Routers Command Injection Vulnerability

TP-Link · Multiple Routers · EPSS 41.61% · Threat 71
CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-27520

CVE-2025-27520: BentoML is a Python library for building online serving systems optimized for AI apps and …

bentoml · bentoml · EPSS 40.62% · Threat 71
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2021-26828

OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

OpenPLC · ScadaBR · EPSS 39.10% · Threat 71
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-0300

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Palo Alto Networks · PAN-OS · EPSS 31.72% · Threat 71
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-60004

Gitea Code Injection Vulnerability

Gitea · Gitea · EPSS 23.99% · Threat 71
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-48939

iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

iCagenda · iCagenda · EPSS 20.07% · Threat 71
HIGH 7
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-0411

7-Zip Mark of the Web Bypass Vulnerability

7-Zip · 7-Zip · EPSS 67.07% · Threat 70
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-1661

CVE-2025-1661: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerabl…

pluginus · husky - products filter professional for woocommerce · EPSS 56.38% · Threat 70
HIGH 8.7
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-24367

CVE-2025-24367: Cacti is an open source performance and fault management framework. An authenticated Cacti…

cacti · cacti · EPSS 54.02% · Threat 70
CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-29306

CVE-2025-29306: An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case…

foxcms · foxcms · EPSS 46.58% · Threat 70
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-31200

Apple Multiple Products Memory Corruption Vulnerability

Apple · Multiple Products · EPSS 20.90% · Threat 70
CRITICAL 10
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-24085

Apple Multiple Products Use-After-Free Vulnerability

Apple · Multiple Products · EPSS 17.51% · Threat 70
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-48907

Widget Factory Joomla Content Editor Improper Access Control Vulnerability

Widget Factory · Joomla Content Editor · EPSS 16.19% · Threat 70
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-34908

Ubiquiti UniFi OS Improper Access Control Vulnerability

Ubiquiti · UniFi OS · EPSS 15.21% · Threat 70
CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-59310

Broadcom VMware vCenter Path Traversal Vulnerability

Broadcom · VMware vCenter · EPSS 2.56% · Threat 70
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2024-50498

CVE-2024-50498: Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Q…

lubus · wp query console · EPSS 52.91% · Threat 69
HIGH 7.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2023-32434

Apple Multiple Products Integer Overflow Vulnerability

Apple · Multiple Products · EPSS 51.52% · Threat 69
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-4257

CVE-2026-4257: The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template I…

Unknown · · EPSS 32.78% · Threat 69
CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-33017

Langflow Code Injection Vulnerability

Langflow · Langflow · EPSS 24.75% · Threat 69
CRITICAL 9.6
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-7971

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · EPSS 21.10% · Threat 69
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-9082

Drupal Core SQL Injection Vulnerability

Drupal · Core · EPSS 15.70% · Threat 69
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-56291

Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

Balbooa · Forms · EPSS 14.85% · Threat 69
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-86218

N-able N-central Static Code Injection Vulnerability

N-able · N-central · EPSS 13.35% · Threat 69
HIGH 7.5
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-23334

CVE-2024-23334: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using…

aiohttp · aiohttp · EPSS 76.88% · Threat 68
CRITICAL 9.1
Public PoCATT&CK inferred
CVE-2026-19478

CVE-2026-19478: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.…

gitlab · gitlab · EPSS 60.20% · Threat 68
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-5394

CVE-2025-5394: The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnera…

Unknown · · EPSS 51.29% · Threat 68
CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-42640

CVE-2024-42640: angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execut…

Unknown · · EPSS 40.21% · Threat 68
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-3891

CVE-2026-3891: The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due t…

Unknown · · EPSS 29.73% · Threat 68
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-19490

Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Citrix · NetScaler · EPSS 23.16% · Threat 68
CRITICAL 9.6
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-4947

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · EPSS 15.24% · Threat 68
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-82329

JFrog Artifactory Improper Authentication Vulnerability

JFrog · Artifactory · EPSS 14.37% · Threat 68
HIGH 8.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-49039

Microsoft Windows Task Scheduler Privilege Escalation Vulnerability

Microsoft · Windows · EPSS 14.18% · Threat 68
CRITICAL 9.6Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-45321

TanStack Unspecified Vulnerability

TanStack · TanStack · EPSS 1.05% · Threat 68
MEDIUM 6.1
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-4123

CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client …

grafana · grafana · EPSS 97.08% · Threat 67
HIGH 7.5
Public PoCATT&CK inferred
CVE-2024-49113

CVE-2024-49113: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability

microsoft · windows 10 1507 · EPSS 83.78% · Threat 67
HIGH 7.5
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-30208

CVE-2025-30208: Vite, a provider of frontend development tooling, has a vulnerability in versions prior to…

vitejs · vite · EPSS 74.77% · Threat 67
MEDIUM 6.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2024-37383

RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

Roundcube · Webmail · EPSS 73.30% · Threat 67
MEDIUM 6.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2019-9978

WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability

WordPress · Social Warfare Plugin · EPSS 72.95% · Threat 67
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-64095

CVE-2025-64095: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the M…

dnnsoftware · dotnetnuke · EPSS 46.97% · Threat 67
CRITICAL 9.9
Public PoCATT&CK inferred
CVE-2024-8672

CVE-2024-8672: The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress i…

Unknown · · EPSS 45.40% · Threat 67
CRITICAL 10
Public PoCATT&CK inferred
CVE-2025-30065

CVE-2025-30065: Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions a…

apache · parquet java · EPSS 43.60% · Threat 67
HIGH 8.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-87902

WordPress Core Remote File Inclusion Vulnerability

WordPress · Core · EPSS 39.98% · Threat 67
CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2026-59774

CVE-2026-59774: Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository m…

Unknown · · EPSS 28.31% · Threat 67
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2023-28205

Apple Multiple Products WebKit Use-After-Free Vulnerability

Apple · Multiple Products · EPSS 27.08% · Threat 67
CRITICAL 9.2
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-7775

Citrix NetScaler Memory Overflow Vulnerability

Citrix · NetScaler · EPSS 20.28% · Threat 67
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-63030

WordPress Core Interpretation Conflict Vulnerability

WordPress · Core · EPSS 10.65% · Threat 67
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-83548

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

SonicWall · SMA1000 Appliances · EPSS 8.04% · Threat 67
HIGH 8.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2026-23918

CVE-2026-23918: Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.…

apache · http server · EPSS 49.73% · Threat 66
HIGH 8.4
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-54988

CVE-2025-54988: Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and inclu…

apache · tika · EPSS 47.95% · Threat 66
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-64155

CVE-2025-64155: An improper neutralization of special elements used in an os command ('os command injectio…

fortinet · fortisiem · EPSS 42.54% · Threat 66
HIGH 7.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2023-29336

Microsoft Win32K Privilege Escalation Vulnerability

Microsoft · Win32k · EPSS 41.19% · Threat 66
CRITICAL 10
Public PoCATT&CK inferred
CVE-2025-10230

CVE-2025-10230: A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registr…

Unknown · · EPSS 39.77% · Threat 66
CRITICAL 9.5
Metasploit modulePublic PoCATT&CK inferred
CVE-2026-66066

CVE-2026-66066: Action Pack is a framework for handling and responding to web requests. In versions prior …

Unknown · · EPSS 27.86% · Threat 66
HIGH 8.6
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-104935

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Ivanti · Connect Secure · EPSS 25.98% · Threat 66
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-14174

Google Chromium Out of Bounds Memory Access Vulnerability

Google · Chromium · EPSS 22.33% · Threat 66
HIGH 7.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2018-8639

Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability

Microsoft · Windows · EPSS 22.18% · Threat 66
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-10585

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · EPSS 6.06% · Threat 66
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-75650

Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Adobe · Commerce and Magento · EPSS 3.95% · Threat 66
HIGH 7.5
Public PoCATT&CK inferred
CVE-2023-22047

CVE-2023-22047: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo…

oracle · peoplesoft enterprise · EPSS 76.98% · Threat 65
HIGH 8.8
Public PoCATT&CK inferred
CVE-2025-15467

CVE-2025-15467: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously cra…

openssl · openssl · EPSS 55.85% · Threat 65
HIGH 8.1
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-2563

CVE-2025-2563: The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users t…

wpeverest · user registration \& membership · EPSS 49.08% · Threat 65
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-2775

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

SysAid · SysAid On-Prem · EPSS 42.61% · Threat 65
HIGH 8.6
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-61675

CVE-2025-61675: FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. …

Unknown · · EPSS 38.76% · Threat 65
CRITICAL 10
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-34077

CVE-2025-34077: An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1…

Unknown · · EPSS 16.38% · Threat 65
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-21589

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Atlassian · Multiple Products · EPSS 12.71% · Threat 65
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-64849

MLflow Server-Side Request Forgery Vulnerability

MLflow · MLflow · EPSS 10.02% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-50522

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft · SharePoint · EPSS 3.04% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-104286

Fortinet FortiMail Path Traversal Vulnerability

Fortinet · FortiMail · EPSS 2.20% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-76504

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Cisco · Catalyst SD-WAN Manager · EPSS 1.82% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-65400

Apple macOS Improper Authentication Vulnerability

Apple · macOS · EPSS 1.72% · Threat 65
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-48172

LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

LiteSpeed · cPanel Plugin · EPSS 1.01% · Threat 65
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-5430

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 · Multiple Products · EPSS 0.59% · Threat 65
MEDIUM 6.1
Exploit-DBPublic PoCATT&CK inferred
CVE-2019-11358

CVE-2019-11358: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuer…

jquery · jquery · EPSS 86.82% · Threat 64
CRITICAL 9.4
Public PoCATT&CK inferred
CVE-2025-49596

CVE-2025-49596: The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of M…

Unknown · · EPSS 44.45% · Threat 64
CRITICAL 9.9
Public PoCATT&CK inferred
CVE-2024-51482

CVE-2024-51482: ZoneMinder is a free, open source closed-circuit television software application. ZoneMind…

Unknown · · EPSS 36.61% · Threat 64
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2024-9932

CVE-2024-9932: The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to in…

Unknown · · EPSS 36.39% · Threat 64
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-1357

CVE-2026-1357: The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulner…

Unknown · · EPSS 35.12% · Threat 64
HIGH 8.1
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-27363

FreeType Out-of-Bounds Write Vulnerability

FreeType · FreeType · EPSS 27.77% · Threat 64
CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2024-39205

CVE-2024-39205: An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to…

Unknown · · EPSS 16.54% · Threat 64
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-34197

Apache ActiveMQ Improper Input Validation Vulnerability

Apache · ActiveMQ · EPSS 15.49% · Threat 64
CRITICAL 9.2
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-6543

Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

Citrix · NetScaler ADC and Gateway · EPSS 10.56% · Threat 64
CRITICAL 9.5
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-88772

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix · NetScaler · EPSS 5.30% · Threat 64
CRITICAL 9.5
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-88771

Citrix NetScaler Improper Input Validation Vulnerability

Citrix · NetScaler · EPSS 5.11% · Threat 64
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-56164

Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

Microsoft · SharePoint Server · EPSS 1.01% · Threat 64
MEDIUM 6.1
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-4220

CVE-2023-4220: Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/big…

chamilo · chamilo lms · EPSS 76.08% · Threat 63
HIGH 7.5
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-31650

CVE-2025-31650: Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for som…

apache · tomcat · EPSS 61.32% · Threat 63
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-6440

CVE-2025-6440: The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company &…

Unknown · · EPSS 33.34% · Threat 63
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-68926

CVE-2025-68926: RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-al…

rustfs · rustfs · EPSS 31.85% · Threat 63
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2024-50379

CVE-2024-50379: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in …

apache · tomcat · EPSS 31.82% · Threat 63
HIGH 7.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2024-38193

Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability

Microsoft · Windows · EPSS 28.74% · Threat 63