Loading0%
SUBZER0
LIVE

SubZer0 · CVE briefing

Free CVE tracker: 19,505 CVEs from the last 30 days, 37 on CISA KEV, ranked by what to patch first with EPSS and public exploits. Updated every 6 hours.

Patch now

  • CVE-2026-109618 P1 · Metasploit/Nuclei can already hit it PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the…
  • CVE-2026-106931 P1 · on CISA KEV SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to…
  • CVE-2026-96656 P1 · on CISA KEV Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on…
  • CVE-2026-96654 P1 · on CISA KEV Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,'…
  • CVE-2026-96655 P1 · on CISA KEV Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external…
  • CVE-2026-96652 P1 · on CISA KEV Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'.
  • CVE-2026-110936 P1 · on CISA KEV A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8).
  • CVE-2026-110372 P1 · Metasploit/Nuclei can already hit it Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege…
  • CVE-2026-94169 P1 · Metasploit/Nuclei can already hit it Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid…
  • CVE-2026-102764 P1 · on CISA KEV The vulnerability exists within internal components of BeyondTrust’s Remote Support product.
  • CVE-2025-61624 P1 · on CISA KEV Fortinet Multiple Products Path Traversal Vulnerability
  • CVE-2026-21589 P1 · on CISA KEV This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data…
  • CVE-2026-111214 P1 · public exploit, high EPSS Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows…
  • CVE-2026-105134 P1 · on CISA KEV A flaw has been found in Ahsay AhsayCBS up to 10.3.2.
  • CVE-2026-59774 P1 · Metasploit/Nuclei can already hit it Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint…
  • CVE-2026-105133 P1 · on CISA KEV A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2.
  • CVE-2026-76519 P1 · on CISA KEV A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow…
  • CVE-2026-0322 P1 · on CISA KEV A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS®…
  • CVE-2026-85714 P1 · Metasploit/Nuclei can already hit it Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files.
  • CVE-2026-104935 P1 · on CISA KEV Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to…
  • CVE-2026-96951 P1 · on CISA KEV Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows…
  • CVE-2026-91136 P1 · Metasploit/Nuclei can already hit it The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including…
  • CVE-2015-3306 P1 · on CISA KEV ProFTPD Improper Access Control Vulnerability
  • CVE-2015-5477 P1 · on CISA KEV ISC BIND Data Processing Errors Vulnerability
  • CVE-2016-3081 P1 · on CISA KEV Apache Struts Command Injection Vulnerability
  • CVE-2021-3199 P1 · on CISA KEV ONLYOFFICE Docs Server Path Traversal Vulnerability
  • CVE-2023-22894 P1 · on CISA KEV Strapi Cleartext Storage of Sensitive Information Vulnerability
  • CVE-2026-85097 P1 · Metasploit/Nuclei can already hit it The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up…
  • CVE-2026-93674 P1 · Metasploit/Nuclei can already hit it IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to…
  • CVE-2026-76268 P1 · Metasploit/Nuclei can already hit it In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the…
  • CVE-2026-88779 P1 · on CISA KEV Vulnerability in NetScaler ADC and NetScaler Gateway.
  • CVE-2009-20011 P1 · Metasploit/Nuclei can already hit it ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are...
  • CVE-2009-20010 P1 · Metasploit/Nuclei can already hit it Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php...
  • CVE-2009-20009 P1 · Metasploit/Nuclei can already hit it Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability...
  • CVE-2009-20008 P1 · Metasploit/Nuclei can already hit it Green Dam Youth Escort version 3.17 is vulnerable to a stack-based buffer overflow when...
  • CVE-2026-102489 P1 · on CISA KEV Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code…
  • CVE-2026-102490 P1 · on CISA KEV Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had…
  • CVE-2026-103956 P1 · Metasploit/Nuclei can already hit it Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1…
  • CVE-2026-104286 P1 · on CISA KEV An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet…
  • CVE-2026-69085 P1 · Metasploit/Nuclei can already hit it SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook…
  • CVE-2026-76504 P1 · on CISA KEV A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could…
  • CVE-2026-55224 P1 · Metasploit/Nuclei can already hit it MineAdmin is a ready-to-use backend management system suitable for quickly building website backends…
  • CVE-2026-86950 P1 · on CISA KEV An out-of-bounds write issue was addressed with improved bounds checking.
  • CVE-2026-88772 P1 · on CISA KEV Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • CVE-2026-88771 P1 · on CISA KEV Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • CVE-2026-88773 P1 · Metasploit/Nuclei can already hit it Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix…
  • CVE-2026-18143 P1 · Metasploit/Nuclei can already hit it The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all…
  • CVE-2026-87902 P1 · on CISA KEV WordPress Core Remote File Inclusion Vulnerability
  • CVE-2026-65660 P1 · on CISA KEV Microsoft SharePoint Code Injection Vulnerability
  • CVE-2026-67279 P1 · on CISA KEV Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability