CVEs: Public PoC, page 8

907 CVEs with public proof-of-concept code on GitHub that meets the quality bar, sorted by threat level then EPSS. Showing 841-907. Use search to combine filters.

Public proof-of-concept code can be fake or malicious. Verify before running, and only in an isolated lab. A PoC means exploit code is public, not that the CVE is exploited in the wild.

CVEs: Public PoC, page 8

CVE-2021-1931: Possible buffer overflow due to improper validation of buffer length while processing fast…

CVE-2021-30327: Buffer overflow in sahara protocol while processing commands leads to overwrite of secure …

CVE-2026-72844: The Lean 4 kernel does not verify that the structure named in a projection expression matc…

CVE-2023-20696: In preloader, there is a possible out of bounds write due to a missing bounds check. This …

CVE-2025-53392: In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading …

CVE-2026-2256: A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier …

CVE-2024-7595: GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet …

CVE-2025-31258: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Seq…

CVE-2026-36425: An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL han…

CVE-2023-52271: The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers t…

CVE-2022-37418: The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles…

CVE-2025-65640: Cross Site Scripting (XSS) vulnerability in the "Task in Progress / Recent" page in Arket …

CVE-2026-25262: Memory corruption while processing a crafted ELF file in the Primary Bootloader.

CVE-2025-39946: In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abo…

CVE-2026-23631: Redis is an in-memory data structure store. In all versions of redis-server with Lua scrip…

CVE-2025-26529: Description information displayed in the site administration live log required additional…

CVE-2025-70849: Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arb…

CVE-2026-28867: This issue was addressed with improved authentication. This issue is fixed in iOS 18.7.7 a…

CVE-2026-20637: A use after free issue was addressed with improved memory management. This issue is fixed …

CVE-2026-33320: Dasel is a command-line tool and library for querying, modifying, and transforming data st…

CVE-2026-15430: Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunte…

CVE-2025-2825: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2025-31161. Reason: This Reco…

CVE-2025-66478: Rejected reason: This CVE is a duplicate of CVE-2025-55182.

CVE-1999-0524: ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.

CVE-2026-0075: In multiple functions, there is a possible way to access the contacts database due to a SQ…

CVE-2023-1206: A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s …

CVE-2025-24104: This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18…

CVE-2025-53136: Exposure of sensitive information to an unauthorized actor in Windows NT OS Kernel allows …

CVE-2025-38001: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Addr…

CVE-2024-27876: A race condition was addressed with improved locking. This issue is fixed in iOS 17.7 and …

CVE-2026-2636: This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special El…

CVE-2025-40040: In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-drop…

CVE-2023-3280: A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Window…

CVE-2026-83991: Missing authentication for critical function in Windows Cloud Files Mini Filter Driver all…

CVE-2025-61155: The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an ac…

CVE-2025-70795: STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privil…

CVE-2025-1055: A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, al…

CVE-2025-39965: In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi …

CVE-2026-53365: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zer…

CVE-2026-84616: A type confusion issue was addressed with improved memory handling. This issue is fixed in…

CVE-2025-48561: In multiple locations, there is a possible way to access data displayed on the screen due …

CVE-2025-0133: A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and por…

CVE-2020-28042: ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has …

CVE-2024-54772: An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43…

CVE-2026-94545: Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior t…

CVE-2024-38828: Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable …

CVE-2026-20643: A cross-origin issue in the Navigation API was addressed with improved input validation. T…

CVE-2026-30368: A client-side authorization flaw in Lightspeed Systems Classroom v5.1.2.1763770643 allows …

CVE-2012-2459: Unspecified vulnerability in bitcoind and Bitcoin-Qt before 0.4.6, 0.5.x before 0.5.5, 0.6…

CVE-2025-0087: In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different …

CVE-2025-59501: Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized …

CVE-2026-40175: Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0…

CVE-2025-24203: The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 1…

CVE-2026-80844: In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate r…

CVE-2026-34990: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operatin…

CVE-2026-111943: On most platforms, Go uses the given system root certificates. However, in some narrower c…

CVE-2025-34085: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority…

CVE-2026-28992: A memory corruption vulnerability was addressed with improved locking. This issue is fixed…

CVE-2025-4664: Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed…

CVE-2024-38143: Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability

CVE-2026-24332: Discord through 2026-01-16 allows gathering information about whether a user's client stat…

CVE-2026-2002: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPre…

CVE-2024-9506: Improper regular expression in Vue's parseHTML function leads to a potential regular expre…

CVE-2025-54352: WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft p…

CVE-2025-55188: 7-Zip before 25.01 does not always properly handle symbolic links during extraction.

CVE-2026-50416: Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an aut…

CVE-2025-8191: A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1…