CVERadar

CVEs: Public PoC, page 5

907 CVEs with public proof-of-concept code on GitHub that meets the quality bar, sorted by threat level then EPSS. Showing 481-600. Use search to combine filters.

Public proof-of-concept code can be fake or malicious. Verify before running, and only in an isolated lab. A PoC means exploit code is public, not that the CVE is exploited in the wild.

CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-24204

CVE-2025-24204: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. A…

apple · macos · EPSS 2.29% · Threat 54
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-29384

CVE-2025-29384: In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has …

tenda · ac9 firmware · EPSS 1.94% · Threat 54
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-8732

CVE-2026-8732: The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrat…

Unknown · · EPSS 1.86% · Threat 54
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2024-51793

CVE-2024-51793: Unrestricted Upload of File with Dangerous Type vulnerability in Ateeq Rafeeq RepairBuddy …

webfulcreations · computer repair shop · EPSS 1.85% · Threat 54
CRITICAL 9.3
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-9074

CVE-2025-9074: A vulnerability was identified in Docker Desktop that allows local running Linux container…

Unknown · · EPSS 1.83% · Threat 54
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-33937

CVE-2026-33937: Handlebars provides the power necessary to let users build semantic templates. In versions…

handlebarsjs · handlebars · EPSS 1.80% · Threat 54
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-12735

CVE-2025-12735: The expr-eval library is a JavaScript expression parser and evaluator designed to safely e…

jorenbroekema · javascript expression evaluator · EPSS 1.76% · Threat 54
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-4408

CVE-2026-4408: A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file …

redhat · openshift container platform · EPSS 1.75% · Threat 54
HIGH 7.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-20700

Apple Multiple Buffer Overflow Vulnerability

Apple · Multiple Products · EPSS 1.39% · Threat 54
HIGH 7.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-38352

Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

Linux · Kernel · EPSS 1.36% · Threat 54
HIGH 8.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2024-32019

CVE-2024-32019: Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipp…

Unknown · · EPSS 1.17% · Threat 54
CRITICAL 9.9
Public PoCATT&CK inferred
CVE-2026-67401

CVE-2026-67401: A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution a…

Unknown · · EPSS 0.86% · Threat 54
CRITICAL 10
Public PoCATT&CK inferred
CVE-2026-58231

CVE-2026-58231: SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication cl…

Unknown · · EPSS 0.85% · Threat 54
CRITICAL 9.9
Public PoCATT&CK inferred
CVE-2026-32710

CVE-2026-32710: MariaDB server is a community developed fork of MySQL server. An authenticated user can cr…

mariadb · mariadb · EPSS 0.83% · Threat 54
CRITICAL 10
Public PoCATT&CK inferred
CVE-2026-22686

CVE-2026-22686: Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to…

agentfront · enclave · EPSS 0.75% · Threat 54
CRITICAL 10
Public PoCATT&CK inferred
CVE-2025-29009

CVE-2025-29009: Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescripti…

Unknown · · EPSS 0.62% · Threat 54
CRITICAL 10
Public PoCATT&CK inferred
CVE-2026-110264

CVE-2026-110264: An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.…

Unknown · · EPSS 0.51% · Threat 54
CRITICAL 10
Public PoCATT&CK inferred
CVE-2026-102255

CVE-2026-102255: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interfa…

Unknown · · EPSS 0.48% · Threat 54
HIGH 7.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-41091

Microsoft Defender Link Following Vulnerability

Microsoft · Defender · EPSS 0.44% · Threat 54
CRITICAL 9.9
Public PoCATT&CK inferred
CVE-2026-60206

CVE-2026-60206: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component…

oracle · weblogic server · EPSS 0.43% · Threat 54
CRITICAL 10
Public PoCATT&CK inferred
CVE-2026-28576

CVE-2026-28576: In Contacts Provider, there is a possible way to access the contacts database due to SQL i…

google · android · EPSS 0.18% · Threat 54
HIGH 7.5
Exploit-DBPublic PoCATT&CK inferred
CVE-2002-0082

CVE-2002-0082: The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1…

apache-ssl · apache-ssl · EPSS 29.66% · Threat 53
HIGH 8.8
Public PoCATT&CK inferred
CVE-2026-22812

CVE-2026-22812: OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically start…

anoma · opencode · EPSS 16.54% · Threat 53
HIGH 7.7
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-46987

CVE-2024-46987: Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A…

tuzitio · camaleon cms · EPSS 14.56% · Threat 53
CRITICAL 9
Public PoCATT&CK inferred
CVE-2026-4480

CVE-2026-4480: A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job d…

redhat · openshift container platform · EPSS 13.93% · Threat 53
CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2025-2620

CVE-2025-2620: A vulnerability has been found in D-Link DAP-1620 1.03 and classified as critical. This vu…

dlink · dap-1620 firmware · EPSS 8.85% · Threat 53
CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2026-33439

CVE-2026-33439: Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIde…

openidentityplatform · openam · EPSS 8.43% · Threat 53
HIGH 8.7
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-7771

CVE-2025-7771: ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary r…

Unknown · · EPSS 8.14% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-54957

CVE-2025-54957: An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process …

Unknown · · EPSS 1.59% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-64564

CVE-2026-64564: In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the …

Unknown · · EPSS 1.41% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-63353

CVE-2025-63353: A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default …

fiberhome · hg6145f1 firmware · EPSS 1.33% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-85097

CVE-2026-85097: The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file uploa…

Unknown · · EPSS 1.29% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-34159

CVE-2026-34159: llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC …

ggml · llama.cpp · EPSS 1.24% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-22738

CVE-2026-22738: In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-suppl…

vmware · spring ai · EPSS 1.11% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-0920

CVE-2026-0920: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrati…

Unknown · · EPSS 1.11% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-54424

CVE-2025-54424: 1Panel is a web interface and MCP Server that manages websites, files, containers, databas…

fit2cloud · 1panel · EPSS 1.01% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-27944

CVE-2026-27944: Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /ap…

nginxui · nginx ui · EPSS 1.01% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-41089

CVE-2026-41089: Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute…

microsoft · windows server 2012 · EPSS 0.97% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-41096

CVE-2026-41096: Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to exe…

microsoft · windows 11 23h2 · EPSS 0.97% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-45185

CVE-2026-45185: Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-f…

exim · exim · EPSS 0.94% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-63223

CVE-2026-63223: CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in up…

Unknown · · EPSS 0.80% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-8206

CVE-2026-8206: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vu…

Unknown · · EPSS 0.77% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-42779

CVE-2026-42779: The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the o…

apache · mina · EPSS 0.76% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-43682

CVE-2026-43682: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoi…

apple · macos · EPSS 0.72% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2023-45612

CVE-2023-45612: In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format…

jetbrains · ktor · EPSS 0.71% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-0006

CVE-2026-0006: In multiple locations, there is a possible out of bounds read and write due to a heap buff…

google · android · EPSS 0.68% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-4606

CVE-2025-4606: The Sala - Startup & SaaS WordPress Theme theme for WordPress is vulnerable to privilege e…

Unknown · · EPSS 0.66% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-54806

CVE-2026-54806: Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

Unknown · · EPSS 0.64% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-11551

CVE-2026-11551: The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover…

Unknown · · EPSS 0.62% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-63888

CVE-2025-63888: The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.…

thinkphp · thinkphp · EPSS 0.61% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-66034

CVE-2025-66034: fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 …

fonttools · fonttools · EPSS 0.55% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-14281

CVE-2026-14281: The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code…

Unknown · · EPSS 0.53% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-5118

CVE-2026-5118: The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versio…

Unknown · · EPSS 0.53% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-12793

CVE-2026-12793: The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Pri…

Unknown · · EPSS 0.52% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-18366

CVE-2026-18366: The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability m…

Unknown · · EPSS 0.50% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2026-106173

CVE-2026-106173: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerabi…

Unknown · · EPSS 0.46% · Threat 53
CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-55575

CVE-2025-55575: SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive i…

Unknown · · EPSS 0.45% · Threat 53
HIGH 8.1
Public PoCATT&CK inferred
CVE-2025-57833

CVE-2025-57833: An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2…

djangoproject · django · EPSS 26.11% · Threat 52
HIGH 7.2
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-60787

CVE-2025-60787: MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration para…

motioneye project · motioneye · EPSS 18.46% · Threat 52
HIGH 8.8
Public PoCATT&CK inferred
CVE-2021-44967

CVE-2021-44967: A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and i…

limesurvey · limesurvey · EPSS 13.50% · Threat 52
HIGH 8.9
Public PoCATT&CK inferred
CVE-2025-1302

CVE-2025-1302: Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Executio…

Unknown · · EPSS 10.39% · Threat 52
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2026-67276

CVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH authentication …

mikrotik · routeros · EPSS 6.45% · Threat 52
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2026-109619

CVE-2026-109619: PHP has various global state that temporarily points into request memory. In some scenario…

php · php · EPSS 6.22% · Threat 52
CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2026-61511

CVE-2026-61511: vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability…

Unknown · · EPSS 5.61% · Threat 52
HIGH 8.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2026-5027

CVE-2026-5027: The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the mult…

langflow · langflow · EPSS 4.76% · Threat 52
HIGH 8.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-32462

CVE-2025-32462: Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither …

sudo project · sudo · EPSS 4.48% · Threat 52
HIGH 8.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2026-59827

CVE-2026-59827: Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.5…

metabase · metabase · EPSS 3.79% · Threat 52
CRITICAL 9.4
Public PoCATT&CK inferred
CVE-2025-69212

CVE-2025-69212: OpenSTAManager is an open source management software for technical assistance and invoicin…

devcode · openstamanager · EPSS 1.94% · Threat 52
CRITICAL 9.4
Public PoCATT&CK inferred
CVE-2025-7783

CVE-2025-7783: Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollu…

Unknown · · EPSS 1.81% · Threat 52
HIGH 7
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2025-62215

Microsoft Windows Race Condition Vulnerability

Microsoft · Windows · EPSS 4.46% · Threat 51
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2026-55200

CVE-2026-55200: libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in …

libssh2 · libssh2 · EPSS 4.02% · Threat 51
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2026-42945

CVE-2026-42945: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module modul…

f5 · dos · EPSS 3.40% · Threat 51
CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2023-54391

CVE-2023-54391: Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnera…

Unknown · · EPSS 3.06% · Threat 51
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2026-9256

CVE-2026-9256: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module modul…

f5 · nginx open source · EPSS 2.70% · Threat 51
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2026-27886

CVE-2026-27886: Strapi is an open source headless content management system. Strapi versions starting in 4…

strapi · strapi · EPSS 2.52% · Threat 51
CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2025-32434

CVE-2025-32434: PyTorch is a Python package that provides tensor computation with strong GPU acceleration …

linuxfoundation · pytorch · EPSS 2.37% · Threat 51
CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2024-54152

CVE-2024-54152: Angular Expressions provides expressions for the Angular.JS web framework as a standalone …

Unknown · · EPSS 2.24% · Threat 51
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2025-68428

CVE-2025-68428: jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of…

parall · jspdf · EPSS 2.18% · Threat 51
CRITICAL 9.4
Public PoCATT&CK inferred
CVE-2025-4517

CVE-2025-4517: Allows arbitrary filesystem writes outside the extraction directory during extraction with…

Unknown · · EPSS 1.43% · Threat 51
CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2026-56121

CVE-2026-56121: Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthent…

Unknown · · EPSS 1.41% · Threat 51
HIGH 8.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-25198

CVE-2025-25198: mailcow: dockerized is an open source groupware/email suite based on docker. Prior to vers…

mailcow · mailcow\ · EPSS 1.12% · Threat 51
CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2025-48757

CVE-2025-48757: An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows re…

Unknown · · EPSS 0.83% · Threat 51
CRITICAL 9.4
Public PoCATT&CK inferred
CVE-2025-65964

CVE-2025-65964: n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do no…

n8n · n8n · EPSS 0.66% · Threat 51
CRITICAL 9.4
Public PoCATT&CK inferred
CVE-2025-2304

CVE-2025-2304: A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishe…

Unknown · · EPSS 0.63% · Threat 51
CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2026-29000

CVE-2026-29000: pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulne…

Unknown · · EPSS 0.51% · Threat 51
CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2026-99999

CVE-2026-99999: In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checks…

Unknown · · EPSS 0.32% · Threat 51
CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2026-59346

CVE-2026-59346: VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor…

Unknown · · EPSS 0.26% · Threat 51
MEDIUM 5.3
Public PoCATT&CK inferred
CVE-2025-55183

CVE-2025-55183: An information leak vulnerability exists in specific configurations of React Server Compon…

vercel · next.js · EPSS 64.23% · Threat 50
MEDIUM 5.3
Metasploit modulePublic PoCATT&CK inferred
CVE-2024-51977

CVE-2024-51977: An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTP…

Unknown · · EPSS 46.63% · Threat 50
HIGH 7.8
Public PoCATT&CK inferred
CVE-2024-11477

CVE-2024-11477: 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This …

7-zip · 7-zip · EPSS 22.39% · Threat 50
HIGH 7.8
Public PoCATT&CK inferred
CVE-2023-52440

CVE-2023-52440: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overf…

linux · linux kernel · EPSS 21.91% · Threat 50
HIGH 7.5
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-4956

CVE-2024-4956: Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read s…

Unknown · · EPSS 18.25% · Threat 50
HIGH 8.1
Exploit-DBPublic PoCATT&CK inferred
CVE-2026-42167

CVE-2026-42167: mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a u…

proftpd · proftpd · EPSS 7.31% · Threat 50
HIGH 8.7
Public PoCATT&CK inferred
CVE-2025-20029

CVE-2025-20029: Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save …

f5 · big-ip access policy manager · EPSS 7.15% · Threat 50
HIGH 8.8
Public PoCATT&CK inferred
CVE-2024-32114

CVE-2024-32114: In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (wher…

apache · activemq · EPSS 7.15% · Threat 50
MEDIUM 6.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-48710

Kludex Starlette HTTP Request/Response Smuggling Vulnerability

Kludex · Starlette · EPSS 7.06% · Threat 50
CRITICAL 9
Public PoCATT&CK inferred
CVE-2025-23266

CVE-2025-23266: NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to …

Unknown · · EPSS 3.32% · Threat 50
CRITICAL 9.1
Public PoCATT&CK inferred
CVE-2024-45337

CVE-2024-45337: Applications and libraries which misuse connection.serverAuthenticate (via callback field …

Unknown · · EPSS 3.18% · Threat 50
HIGH 7.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-46300

CVE-2026-46300: In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve…

linux · linux kernel · EPSS 2.43% · Threat 50
CRITICAL 9.1
Public PoCATT&CK inferred
CVE-2026-40281

CVE-2026-40281: Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier,…

thecodingmachine · gotenberg · EPSS 2.09% · Threat 50
CRITICAL 9
Public PoCATT&CK inferred
CVE-2026-32475

CVE-2026-32475: Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro a…

Unknown · · EPSS 1.99% · Threat 50
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2026-42530

CVE-2026-42530: NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open So…

f5 · nginx gateway fabric · EPSS 1.48% · Threat 50
MEDIUM 6.9
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-67279

Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

MikroTik · RouterOS · EPSS 1.05% · Threat 50
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2026-21440

CVE-2026-21440: AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS m…

Unknown · · EPSS 1.03% · Threat 50
CRITICAL 9.1
Public PoCATT&CK inferred
CVE-2026-25769

CVE-2026-25769: Wazuh is a free and open source platform used for threat prevention, detection, and respon…

wazuh · wazuh · EPSS 0.97% · Threat 50
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2026-42533

CVE-2026-42533: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex…

f5 · nginx gateway fabric · EPSS 0.89% · Threat 50
CRITICAL 9.1
Public PoCATT&CK inferred
CVE-2026-29145

CVE-2026-29145: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is …

apache · tomcat · EPSS 0.71% · Threat 50
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2026-111497

CVE-2026-111497: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli ve…

Unknown · · EPSS 0.71% · Threat 50
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2025-40634

CVE-2025-40634: Stack-based buffer overflow vulnerability in the 'conn-indicator' binary running as root o…

Unknown · · EPSS 0.69% · Threat 50
CRITICAL 9.1
Public PoCATT&CK inferred
CVE-2026-89274

CVE-2026-89274: The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in…

Unknown · · EPSS 0.68% · Threat 50
CRITICAL 9.1
Public PoCATT&CK inferred
CVE-2025-61922

CVE-2025-61922: PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. …

prestashop · prestashop checkout · EPSS 0.50% · Threat 50
CRITICAL 9.1
Public PoCATT&CK inferred
CVE-2026-22732

CVE-2026-22732: When applications specify HTTP response headers for servlet applications using Spring Secu…

vmware · spring security · EPSS 0.49% · Threat 50
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2026-114509

CVE-2026-114509: Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configure…

Unknown · · EPSS 0.40% · Threat 50
CRITICAL 9.1
Public PoCATT&CK inferred
CVE-2026-91403

CVE-2026-91403: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi…

Unknown · · EPSS 0.37% · Threat 50
HIGH 7
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-68820

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Microsoft · Windows Ancillary Function Driver for WinSock · EPSS 0.33% · Threat 50
MEDIUM 4.6
Public PoCATT&CK inferred
CVE-2025-9491

CVE-2025-9491: Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This …

microsoft · windows 11 23h2 · EPSS 73.03% · Threat 49
MEDIUM 6.9
Public PoCATT&CK inferred
CVE-2024-12986

CVE-2024-12986: A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and…

draytek · vigor300b firmware · EPSS 35.31% · Threat 49
HIGH 8.8
Public PoCATT&CK inferred
CVE-2025-54110

CVE-2025-54110: Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate …

microsoft · windows 10 1507 · EPSS 4.72% · Threat 49
HIGH 8.8
Public PoCATT&CK inferred
CVE-2026-26114

CVE-2026-26114: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized atta…

microsoft · sharepoint server · EPSS 2.55% · Threat 49
HIGH 8.8
Public PoCATT&CK inferred
CVE-2026-53435

CVE-2026-53435: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to hav…

jenkins · jenkins · EPSS 2.16% · Threat 49