|
2026-08-17
|
|
flyto_core 2.26.7 - Server-Side Request Forgery
|
3 |
WEB
|
Jorge González Milla
|
|
2026-08-17
|
|
Probo 0.222.2 - IDOR
|
1 |
WEB
|
Jorge González Milla
|
|
2026-08-17
|
|
webpack_devserver 5.2.5 - CSRF
|
0 |
WEB
|
Jorge González Milla
|
|
2026-08-17
|
|
Duplicati 2.2.0.3 - JWT Signing Key Leak
|
0 |
WEB
|
Gabriel Rodrigues
|
|
2026-08-17
|
|
Joomla JCE_2.9.15 - Remote Code Execution
|
3 |
WEB
|
Jared Brits
|
|
2026-08-17
|
|
WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
|
2 |
WEB
|
Mohammad Hossein Sadeghian
|
|
2026-08-11
|
|
Apache Gravitino 1.2.1 - SSRF
|
31 |
WEB
|
Ajay Rajpurohit
|
|
2026-08-11
|
|
Blocksy Companion 2.1.46 - RCE
|
21 |
WEB
|
banyamer
|
|
2026-08-11
|
|
Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF
|
24 |
WEB
|
Balachandar Gowrisankar
|
|
2026-08-11
|
|
Ray 2.56.0 - Directory Traversal & Local File Inclusion
|
18 |
WEB
|
Richard Howe
|
|
2026-08-10
|
|
OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution
|
17 |
WEB
|
banyamer
|
|
2026-08-10
|
|
CorgetGpsDget 2_3.2 - OS Command Injection
|
16 |
WEB
|
Bytetobreach
|
|
2026-08-10
|
|
Joomla 2.9.99.4 - Unauthenticated Remote Code Execution
|
31 |
WEB
|
Jared Brits
|
|
2026-07-08
|
|
Krayin CRM v2.2.x - Authenticated Remote Code Execution
|
70 |
WEB
|
Diamorphine
|
|
2026-07-08
|
|
Atarim WordPress Plugin 4.2.2 - Sensitive Information Exposure
|
59 |
WEB
|
Mohammad Hossein Sadeghian
|
|
2026-07-08
|
|
Langflow 1.9.0 - RCE
|
86 |
WEB
|
Diamorphine
|
|
2026-07-08
|
|
Joomla Page Builder CK 3.5.10 - Arbitrary File Upload
|
53 |
WEB
|
M@rAz Ali
|
|
2026-07-07
|
|
MCPJam Inspector - Remote Code Execution
|
47 |
WEB
|
Diamorphine
|
|
2026-07-07
|
|
Flowise 3.1.3 - arbitrary code execution
|
42 |
WEB
|
banyamer
|
|
2026-07-07
|
|
Discuz! X5.0 - Authentication Bypass
|
58 |
WEB
|
banyamer
|
|
2026-07-07
|
|
Tenable Nessus 10.12.1 - SQL Injection
|
39 |
WEB
|
banyamer
|
|
2026-07-07
|
|
WordPress Bricks Builder Theme - RCE
|
79 |
WEB
|
Jared Brits
|
|
2026-07-06
|
|
Joomla Extension 4.1.4 - PHP Object injection
|
55 |
WEB
|
Amin İsayev
|
|
2026-07-06
|
|
Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass
|
34 |
WEB
|
Onur BILICI
|
|
2026-07-06
|
|
KeepInMind 0.8.4.2 - Stored XSS
|
28 |
WEB
|
Pavan N
|
|
2026-07-06
|
|
KNX visualisering - Broken Access Control
|
25 |
WEB
|
Parsa Rezaie Khiabanloo
|
|
2026-07-06
|
|
WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)
|
35 |
WEB
|
Kent Apostol
|
|
2026-06-08
|
|
OpenEMR 7.0.2 - Arbitrary File Read
|
62 |
WEB
|
doany1
|
|
2026-06-05
|
|
WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection
|
73 |
WEB
|
cardosource
|
|
2026-06-01
|
|
Drupal Core 10.5.5 - Error-Based SQL Injection
|
89 |
WEB
|
cardosource
|
|
2026-06-01
|
|
WordPress OrderConvo 14 - Path Traversal
|
67 |
WEB
|
Diamorphine
|
|
2026-05-30
|
|
YAMCS yamcs-core 5.12.7 - No Rate Limiting
|
60 |
WEB
|
Daniel Miranda
|
|
2026-05-30
|
|
YAMCS yamcs-core 5.12.7 - User Enumeration
|
55 |
WEB
|
Daniel Miranda
|
|
2026-05-30
|
|
YAMCS yamcs-core 5.12.7 - LDAP Injection
|
62 |
WEB
|
Daniel Miranda
|
|
2026-05-29
|
|
MikroORM 7.0.13 - SQL Injection
|
53 |
WEB
|
cardosource
|
|
2026-05-29
|
|
Prodigy Commerce 3.3.0 - Local File Inclusion
|
57 |
WEB
|
Diamorphine
|
|
2026-05-29
|
|
Langflow 1.3.0 - Remote Code Execution
|
74 |
WEB
|
Diamorphine
|
|
2026-05-29
|
|
Quick Playground for WordPress 1.3.1 - Unauthenticated Remote Code Execution
|
64 |
WEB
|
cardosource
|
|
2026-05-29
|
|
MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution
|
57 |
WEB
|
cardosource
|
|
2026-05-29
|
|
CubeCart < 6.7.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
|
51 |
WEB
|
Th3-SAx11
|
|
2026-05-27
|
|
Casdoor 3.54.1 - Arbitrary File Write via Path Traversal
|
44 |
WEB
|
sixpain
|
|
2026-05-27
|
|
EspoCRM 9.3.3 - SSRF
|
47 |
WEB
|
Max Gabriel
|
|
2026-05-27
|
|
scramble - Remote Code Execution
|
40 |
WEB
|
joshua
|
|
2026-05-27
|
|
MeiG Smart FORGE_SLT711 - OS Command Injection
|
43 |
WEB
|
Daniil Gordeev
|
|
2026-05-27
|
|
OpenCATS 0.9.7.4 - SQL Injection
|
42 |
WEB
|
Gabriel Rodrigues
|
|
2026-05-26
|
|
Grav CMS 2.0.0-beta.2 - Remote Code Execution
|
44 |
WEB
|
Mustafa Murat Akgül
|
|
2026-05-26
|
|
Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service
|
40 |
WEB
|
alisunbul
|
|
2026-05-26
|
|
D-Link DSL2600U - 'rom-0' Admin Password Disclosure
|
40 |
WEB
|
Amir Hossein Jamshidi
|
|
2026-05-26
|
|
Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeov
|
43 |
WEB
|
Amir Hossein Jamshidi
|
|
2026-05-26
|
|
cPanel - CRLF Injection
|
59 |
WEB
|
nu11secur1ty
|
|
2026-05-21
|
|
Cockpit 359 - RCE
|
58 |
WEB
|
Abdelazim Mohammed
|
|
2026-05-21
|
|
BookStack 25.12.1 - Denial of Service
|
44 |
WEB
|
Gabriel Rodrigues
|
|
2026-05-21
|
|
solaredge - (CSRF-OOB-Injection)
|
47 |
WEB
|
nu11secur1ty
|
|
2026-05-21
|
|
FUXA 1.2.9 - RCE
|
60 |
WEB
|
Anthony Cihan
|
|
2026-05-14
|
|
WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI
|
48 |
WEB
|
bootstrapbool
|
|
2026-05-14
|
|
Apache HertzBeat 1.8.0 - Remote Code Execution
|
48 |
WEB
|
Brett Gervasoni
|
|
2026-05-14
|
|
ePati Antikor NGFW 2.0.1301 - Authentication Bypass
|
40 |
WEB
|
sadik
|
|
2026-05-14
|
|
PJPROJECT 2.16 - Heap Bufferoverflow
|
34 |
WEB
|
vabismo452
|
|
2026-05-13
|
|
Ninja Forms Uploads - Unauthenticated PHP File Upload
|
54 |
WEB
|
selim.lanouar
|
|
2026-05-13
|
|
glances 4.5.2 - command injection
|
51 |
WEB
|
best.sell
|
|
2026-05-13
|
|
coreruleset 4.21.0 - Firewall Bypass
|
43 |
WEB
|
anonimicerum
|
|
2026-05-13
|
|
Flowise < 3.0.5 - Missing Authentication for Critical Function
|
46 |
WEB
|
andersoncezar048
|
|
2026-05-07
|
|
Ghost CMS 6.19.0 - SQLi
|
65 |
WEB
|
Maksim Rogov
|
|
2026-05-07
|
|
LuaJIT 2.1.1774638290 - Arbitrary Code Execution
|
47 |
WEB
|
Taurus Omar
|
|
2026-05-07
|
|
Bludit CMS 3.18.4 - RCE
|
52 |
WEB
|
yahia
|
|
2026-05-07
|
|
ThingsBoard IoT Platform 4.2.0 - Server-Side Request Forgery (SSRF)
|
47 |
WEB
|
9tamilmathi
|
|
2026-05-04
|
|
Linksys E1200 2.0.04 - Authenticated Stack Buffer Overflow (RCE)
|
46 |
WEB
|
jarrett
|
|
2026-05-04
|
|
MindsDB 25.9.1.1 - Path Traversal
|
48 |
WEB
|
thewhiteh4t
|
|
2026-05-04
|
|
Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)
|
36 |
WEB
|
hazar
|
|
2026-04-30
|
|
FUXA 1.2.8 - Authentication Bypass + RCE Exploit
|
62 |
WEB
|
joshua
|
|
2026-04-30
|
|
Python-Multipart 0.0.22 - Path Traversal
|
48 |
WEB
|
jefersoncardoso.dev
|
|
2026-04-30
|
|
Repetier-Server 1.4.10 - Path Traversal
|
33 |
WEB
|
banyamer
|
|
2026-04-30
|
|
HUSTOJ Zip-Slip v26.01.24 - RCE
|
33 |
WEB
|
Marshall Whittaker
|
|
2026-04-30
|
|
BusyBox 1.37.0 - Path Traversal
|
42 |
WEB
|
Calil Khalil
|
|
2026-04-30
|
|
JUNG Smart Visu Server 1.1.1050 - Dos
|
36 |
WEB
|
banyamer
|
|
2026-04-30
|
|
SumatraPDF 3.5.2 - Remote Code Execution
|
51 |
WEB
|
banyamer
|
|
2026-04-30
|
|
NiceGUI 3.6.1 - Path Traversal
|
28 |
WEB
|
banyamer
|
|
2026-04-30
|
|
Frigate NVR 0.16.3 - Remote Code Execution
|
22 |
WEB
|
jduardo2704
|
|
2026-04-30
|
|
Js2Py 0.74 - RCE
|
37 |
WEB
|
alisunbul
|
|
2026-04-30
|
|
Camaleon CMS v2.9.0 - Path Traversal
|
21 |
WEB
|
velampudisakshi
|
|
2026-04-30
|
|
Cybersecurity AI (CAI) Framework 0.5.10 - Command Injection
|
29 |
WEB
|
banyamer
|
|
2026-04-30
|
|
Erugo 0.2.14 - Remote Code Execution (RCE)
|
29 |
WEB
|
abdulmoiz
|
|
2026-04-30
|
|
deephas 1.0.7 - Prototype Pollution
|
30 |
WEB
|
banyamer
|
|
2026-04-30
|
|
SUSE Manager 4.3.15 - Code Execution
|
22 |
WEB
|
wjmaj98
|
|
2026-04-29
|
|
HAX CMS 24.x - Stored Cross-Site Scripting (XSS)
|
26 |
WEB
|
banyamer
|
|
2026-04-29
|
|
Craft CMS 5.6.16 - RCE
|
50 |
WEB
|
banyamer
|
|
2026-04-29
|
|
phpMyFAQ 4.0.16 - Improper Authorization
|
39 |
WEB
|
contact
|
|
2026-04-29
|
|
GeographicLib v2.5.1 - stack buffer overflow
|
39 |
WEB
|
rosario
|
|
2026-04-29
|
|
OpenKM 6.3.12 - Multiple
|
27 |
WEB
|
skumar
|
|
2026-04-29
|
|
GUnet OpenEclass E-learning platform < 4.2 - Remote Code Execution (RCE)
|
25 |
WEB
|
unico007x
|
|
2026-04-29
|
|
JuzaWeb CMS 3.4.2 - Authenticated Remote Code Execution
|
36 |
WEB
|
sardordev02
|
|
2026-04-29
|
|
FacturaScripts 2025.43 - XSS
|
25 |
WEB
|
uvettrivel007
|
|
2026-04-29
|
|
Xibo CMS 4.3.0 - RCE via SSTI
|
31 |
WEB
|
Cristian Branet
|
|
2026-04-29
|
|
LangChain Core 1.2.4 - SSTI/RCE
|
28 |
WEB
|
banyamer
|
|
2026-04-22
|
|
WordPress Plugin 5.2.0 - Broken Access Control
|
40 |
WEB
|
cydev.turing
|
|
2026-04-10
|
|
D-Link DIR-650IN - Authenticated Command Injection
|
38 |
WEB
|
Sanjay Singh
|
|
2026-04-09
|
|
React Server 19.2.0 - Remote Code Execution
|
45 |
WEB
|
danieljavanrad
|
|
2026-04-09
|
|
RomM 4.4.0 - XSS_CSRF Chain
|
32 |
WEB
|
mmohammedheshamm
|
|
2026-04-09
|
|
Jumbo Website Manager - Remote Code Execution
|
33 |
WEB
|
Mirabbas Ağalarov
|
|
2026-04-08
|
|
FortiWeb 8.0.2 - Remote Code Execution
|
67 |
WEB
|
Mohammed Idrees Banyamer
|
|
2026-04-08
|
|
xibocms 3.3.4 - RCE
|
43 |
WEB
|
complexusprada
|
|
2026-04-08
|
|
Horilla v1.3 - RCE
|
40 |
WEB
|
nakleh
|
|
2026-04-06
|
|
Fortinet FortiWeb v8.0.1 - Auth Bypass
|
41 |
WEB
|
nu11secur1ty
|
|
2026-04-06
|
|
ASP.net 8.0.10 - Bypass
|
38 |
WEB
|
Mohammed Idrees Banyamer
|
|
2026-04-06
|
|
Grafana 11.6.0 - SSRF
|
41 |
WEB
|
Beatriz Fresno Naumova
|
|
2026-04-06
|
|
Zhiyuan OA - arbitrary file upload leading
|
51 |
WEB
|
Beatriz Fresno Naumova
|
|
2026-04-06
|
|
WBCE CMS 1.6.4 - Remote Code Execution
|
26 |
WEB
|
red
|
|
2026-04-06
|
|
RiteCMS 3.1.0 - Authenticated Remote Code Execution
|
22 |
WEB
|
red
|
|
2026-04-06
|
|
WordPress Madara - Local File Inclusion
|
33 |
WEB
|
Beatriz Fresno Naumova
|
|
2026-03-03
|
|
WordPress Backup Migration 1.3.7 - Remote Command Execution
|
106 |
WEB
|
dangwenjing
|
|
2026-03-03
|
|
mailcow 2025-01a - Host Header Password Reset Poisoning
|
50 |
WEB
|
alvarez
|
|
2026-03-03
|
|
Easy File Sharing Web Server v7.2 - Buffer Overflow
|
48 |
WEB
|
diogo
|
|
2026-03-03
|
|
WeGIA 3.5.0 - SQL Injection
|
64 |
WEB
|
onurdemir
|
|
2026-03-03
|
|
Boss Mini v1.4.0 - Local File Inclusion (LFI)
|
46 |
WEB
|
andersoncezar048
|
|
2026-02-11
|
|
motionEye 0.43.1b4 - RCE
|
84 |
WEB
|
prabhat
|
|
2026-02-04
|
|
OctoPrint 1.11.2 - File Upload
|
112 |
WEB
|
prabhat
|
|
2026-02-04
|
|
aiohttp 3.9.1 - directory traversal PoC
|
72 |
WEB
|
Beatriz Fresno Naumova
|
|
2026-02-04
|
|
FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution
|
71 |
WEB
|
Milad Karimi (Ex3ptionaL)
|
|
2026-02-02
|
|
Piranha CMS 12.0 - Stored XSS in Text Block
|
68 |
WEB
|
terminalvenoms
|
|
2026-02-02
|
|
RPi-Jukebox-RFID 2.8.0 - Stored Cross-Site Scripting (XSS)
|
46 |
WEB
|
Beatriz Fresno Naumova
|
|
2026-02-02
|
|
D-Link DIR-825 Rev.B 2.10 - Stack Buffer Overflow (DoS)
|
50 |
WEB
|
Beatriz Fresno Naumova
|
|
2026-01-17
|
|
RPi-Jukebox-RFID 2.8.0 - Remote Command Execution
|
75 |
WEB
|
Beatriz Fresno Naumova
|
|
2026-01-17
|
|
Siklu EtherHaul Series EH-8010 - Arbitrary File Upload
|
57 |
WEB
|
semaja2
|
|
2026-01-17
|
|
Siklu EtherHaul Series EH-8010 - Remote Command Execution
|
50 |
WEB
|
semaja2
|
|
2025-12-25
|
|
WordPress Quiz Maker 6.7.0.56 - SQL Injection
|
127 |
WEB
|
Rahul Sreenivasan
|
