CVE Intelligence Dashboard

Last updated: May 17, 2026 at 02:03:03 PM Pacific

Exploitable This Week

High-severity CVEs with known proof-of-concept exploits available

About This Section

This table shows CVEs that have publicly available proof-of-concept (POC) exploits, cross-referenced with severity scores from CISA. These vulnerabilities represent the highest risk as attackers can readily exploit them. Priority should be given to Critical and High severity items with Network attack vectors. GitHub links point to POC repositories, while Ref links provide additional technical details.

Total with POC

50

Critical Severity

50

High Severity

0

Network Exploitable

50

CVE ID Product Description Score Severity Attack Vector POC Links
CVE-2026-21962 Oracle HTTP Server%2C Oracle Weblogic Server Proxy Plug-in Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusi... 10.0 CRITICAL NETWORK [Ref1]
CVE-2026-22686 enclave Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, th... 10.0 CRITICAL NETWORK [Ref1]
CVE-2025-60219 WooCommerce Designer Pro Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme WooCommerce Designer Pro ... 10.0 CRITICAL NETWORK -
CVE-2025-50002 Energia Unrestricted Upload of File with Dangerous Type vulnerability in Farost Energia energia allows Uploa... 10.0 CRITICAL NETWORK -
CVE-2025-9962 P series (P07%2C P10%2C P12%2C P15) A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without... 10.0 CRITICAL NETWORK [Ref1] [Ref2]
CVE-2026-24054 kata-containers Kata Containers is an open source project focusing on a standard implementation of lightweight Virtu... 10.0 CRITICAL NETWORK [Ref1]
CVE-2026-23830 SandboxJS SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnera... 10.0 CRITICAL NETWORK [Ref1]
CVE-2024-57521 n/a SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrar... 10.0 CRITICAL NETWORK [Ref1] [Ref2]
CVE-2025-61937 Process Optimization The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code exe... 10.0 CRITICAL NETWORK [Ref1]
CVE-2024-58338 Flamingo XL Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to e... 10.0 CRITICAL NETWORK [Ref1] [Ref2]
CVE-2025-65108 md-to-pdf md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prio... 10.0 CRITICAL NETWORK [Ref1]
CVE-2025-63414 n/a A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated ... 10.0 CRITICAL NETWORK [Ref1]
CVE-2025-63216 n/a The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper J... 10.0 CRITICAL NETWORK [Ref1]
CVE-2025-63224 n/a The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JW... 10.0 CRITICAL NETWORK [Ref1]
CVE-2025-61481 n/a An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over ... 10.0 CRITICAL NETWORK [Ref1]
CVE-2025-59528 Flowise Flowise is a drag & drop user interface to build a customized large language model flow. In version ... 10.0 CRITICAL NETWORK [Ref1]
CVE-2025-58384 n/a In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code exe... 10.0 CRITICAL NETWORK -
CVE-2025-55182 react-server-dom-webpack A pre-authentication remote code execution vulnerability exists in React Server Components versions ... 10.0 CRITICAL NETWORK [Ref1] [Ref2] [Ref3]
CVE-2025-3450 Automation Runtime An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions b... 10.0 CRITICAL NETWORK -
CVE-2025-10363 Topal Finanzbuchhaltung Deserialization of Untrusted Data vulnerability in Topal Solutions AG Topal Finanzbuchhaltung on Win... 10.0 CRITICAL NETWORK -
CVE-2025-10230 Red Hat Enterprise Linux 8 A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration pack... 10.0 CRITICAL NETWORK [Ref1] [Ref2]
CVE-2018-25118 GeoVision embedded IP devices GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injec... 10.0 CRITICAL NETWORK [Ref1] [Ref2] [Ref3] [Ref4]
CVE-2026-22039 kyverno Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1... 9.9 CRITICAL NETWORK [Ref1]
CVE-2026-23885 alchemy_cms Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versio... 9.9 CRITICAL NETWORK [Ref1]
CVE-2026-1470 null n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluat... 9.9 CRITICAL NETWORK [Ref1]
CVE-2026-24841 dokploy Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critic... 9.9 CRITICAL NETWORK [Ref1]
CVE-2026-24740 dozzle Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s ag... 9.9 CRITICAL NETWORK [Ref1]
CVE-2025-46066 n/a An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges... 9.9 CRITICAL NETWORK [Ref1]
CVE-2025-68668 n8n n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox by... 9.9 CRITICAL NETWORK [Ref1]
CVE-2025-61913 Flowise Flowise is a drag & drop user interface to build a customized large language model flow. In versions... 9.9 CRITICAL NETWORK [Ref1] [Ref2]
CVE-2025-60957 n/a OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6... 9.9 CRITICAL NETWORK -
CVE-2025-60306 n/a code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users c... 9.9 CRITICAL NETWORK -
CVE-2025-59832 horilla Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, t... 9.9 CRITICAL NETWORK [Ref1]
CVE-2025-55343 n/a Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via busqued... 9.9 CRITICAL NETWORK [Ref1]
CVE-2025-55315 Microsoft Visual Studio 2022 version 17.10 Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core all... 9.9 CRITICAL NETWORK [Ref1]
CVE-2025-55187 n/a In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gai... 9.9 CRITICAL NETWORK -
CVE-2025-49844 redis Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an... 9.9 CRITICAL NETWORK -
CVE-2025-34267 Flowise Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authentica... 9.9 CRITICAL NETWORK [Ref1] [Ref2]
CVE-2025-20333 Cisco Secure Firewall Threat Defense (FTD) Software A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof... 9.9 CRITICAL NETWORK -
CVE-2025-12421 Mattermost Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail... 9.9 CRITICAL NETWORK [Ref1]
CVE-2025-12419 Mattermost Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail... 9.9 CRITICAL NETWORK [Ref1]
CVE-2025-11539 grafana-image-renderer Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnera... 9.9 CRITICAL NETWORK -
CVE-2025-10725 Red Hat OpenShift AI 2.22 A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authen... 9.9 CRITICAL NETWORK -
CVE-2023-53739 Tinycontrol LAN Controller v Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allow... 9.9 CRITICAL NETWORK [Ref1] [Ref2]
CVE-2025-70892 n/a Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user mana... 9.8 CRITICAL NETWORK [Ref1]
CVE-2025-70457 n/a A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 w... 9.8 CRITICAL NETWORK [Ref1] [Ref2]
CVE-2025-34516 EVE X1 Server Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerab... 9.8 CRITICAL NETWORK [Ref1]
CVE-2025-34515 EVE X1 Server Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privile... 9.8 CRITICAL NETWORK [Ref1]
CVE-2025-34513 EVE X1 Server Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an OS command injection vulnerability... 9.8 CRITICAL NETWORK [Ref1]
CVE-2025-34223 Print Virtual Appliance Host Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Applicati... 9.8 CRITICAL NETWORK [Ref1]