Tagged “exploit-available”
CVEs tagged exploit-available, newest first.
9202 CVEsRSS
CVE-2026-54293High· 7.5PoCNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path tr…
CVE-2026-48746Critical· 9.1PoCvLLM is an inference and serving engine for large language models (LLMs)
vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API Authenti…
CVE-2026-55388High· 8.1PoCpiscina: Prototype Pollution Gadget → RCE via inherited options.filename
piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's…
CVE-2025-67303High· 7.5PoCComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)
ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)
CVE-2026-56229Medium· 6.5PoCCapgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs
Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched app_id and job_i…
CVE-2026-56239High· 7.6PoCCapgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overage
Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs sensitive billing operations without enforcing internal authorization checks (no va…
CVE-2026-56253High· 7.5PoCCapgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC
Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the …
CVE-2026-56242High· 7.5PoCCapgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPC
Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys, creating an API key validity oracle and user identity disclosure primitive. A…
CVE-2026-56316Medium· 5.3PoCCap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*
Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through observable response discrepancies. At…
CVE-2026-56382High· 7.2PoCCraft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController
Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly…
CVE-2026-56383Medium· 4.8PoCCraft CMS - Stored XSS in Table Field via Row Heading Column Type
Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an att…
CVE-2026-56381Medium· 4.8PoCCraft CMS - Stored XSS via User Group Name in User Permissions Page
Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScr…
CVE-2026-56396High· 8.8PoCphpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()
phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is…
CVE-2026-56393Medium· 4.8PoCCraft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options
Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via t…
CVE-2026-12780High· 7.8PoCA vulnerability was determined in AOMEI Backupper up to 8.3.0
A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.sys of the component Kernel Driver. Executing a manipulation can lead to improper access controls. The attack needs to…
CVE-2026-56236Medium· 6.1PoCCapgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation
Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can create malicious symlinks in repositories to overwrite arbitrary…
CVE-2026-56397Critical· 9.6PoCSiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user bro…
CVE-2026-56265Critical· 9.8PoCCrawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing a…
CVE-2025-71348High· 8.1PoCpicklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods
picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but execut…
CVE-2025-71378High· 8.1PoCpicklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded v…
CVE-2025-71357High· 8.1PoCpicklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by vict…
CVE-2025-71351Medium· 7.6PoCpicklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution
picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbit…
CVE-2025-71331Medium· 6.1PoCFlowise - Cross-Site Scripting in Chat Messages and Agent Workflows
Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., …
CVE-2026-56215High· 8.3PoCCapgo - Account Merge via Poisoned public.users.email in SSO Provisioning
Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an account-merge key. Attackers can pre-position their account with a vict…
CVE-2026-56213Medium· 5.3PoCCapgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPC
Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, allowing unauthenticated attackers to insert arbitrary rows into version_meta for…
CVE-2026-56227Medium· 5.4PoCCapgo - Server-Side Request Forgery via Webhook URL Validation
Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when tri…
CVE-2026-56218Medium· 5.3PoCCapgo - EXIF Metadata Exposure via Image Upload
Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download uploaded images and extract precise latitude and longitude coordinates reveal…
CVE-2026-56214High· 7.5PoCCapgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPC
Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org and is_paying_org that allows unauthenticated attackers to enumerate organizations and disclose billing status using …
CVE-2026-56216High· 8.8PoCCapgo - Scope Escalation via API Key Creation in /functions/v1/apikey
Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API keys to mint unrestricted keys by setting empty limits. Attackers with a compromised app-limited key ca…
CVE-2026-56235Medium· 5.3PoCCapgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions
Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metrics, get_global_metrics, get_total_metrics) that are granted to the anon role without enforcing org membership or perm…