AI Vulnerability Database
Known exploited
CVEs
The CVEs in our database that CISA lists as used in real attacks, newest first. US federal agencies must patch each one by CISA's deadline.
CVE-2026-116779
Exposed API Command Execution (CWE-749) in FreeSWITCH
Arbitrary API command execution, potentially leading to operating-system command execution
Critical
9.8
CVE-2026-102895
Authentication Bypass (CWE-287) in GPUStack API Auth
Unauthenticated Administrative Access and Potential Code Execution
Critical
9.8
CVE-2026-110447
OS Command Injection (CWE-78) in Collabora CODE Server
Remote Code Execution
Critical
9.8
CVE-2026-102490
Privilege Escalation (CWE-269) in Zammad DEB/RPM Packages
Local Root Privilege Escalation
High
7.8
CVE-2026-96656
Arbitrary File Write (CWE-73) in Plex Media Server
Potential Code Execution
High
7.2
CVE-2026-84869
Missing Authorization (CWE-862) in ScreenConnect Client
Unauthorized File Transfer and Remote Code Execution
Critical
9.9
CVE-2026-60004
Remote Code Injection (CWE-94) in Gitea Diffpatch API
Remote Code Execution
Critical
9.8
CVE-2026-64849
Server-Side Request Forgery (CWE-918) in MLflow Webhooks
Internal Service and Cloud Metadata Exposure
Critical
9.3
CVE-2026-72898
SQL Injection (CWE-89) in Metabase Password Reset API
Unauthorized administrative access and database compromise
Critical
10.0
CVE-2026-60137
SQL Injection (CWE-89) via author__not_in in WordPress
Database Compromise and Data Exfiltration
Critical
9.1
CVE-2026-59822
Broken Auth Fallback (CWE-287) in LiteLLM MCP HTTP
Unauthorized Access to MCP Tooling and Backend Capabilities
High
8.2
CVE-2026-49869
Auth Bypass & RCE (CWE-287) in Kestra Configs Paths
Unauthenticated Remote Code Execution as root in worker containers
Critical
10.0
CVE-2026-55255
IDOR (CWE-639) in Langflow /api/v1/responses Flows
Unauthorized Flow Execution and Data Exposure
High
8.4
CVE-2026-48939
Arbitrary File Upload (CWE-434) in iCagenda Joomla
Remote Code Execution and Site Compromise
Critical
9.8
CVE-2026-10520
OS Command Injection (CWE-78) in Ivanti Sentry
Unauthenticated Remote Code Execution as Root
Critical
10.0
CVE-2026-42271
Command Injection in LiteLLM AI Gateway
Remote Code Execution on LiteLLM Proxy Host
High
8.8
CVE-2026-42208
SQL Injection in LiteLLM API Key Verification Query
Unauthorized Data Access and Potential Database Compromise
Critical
9.8
CVE-2026-41940
Authentication Bypass in cPanel & WHM Login Flow
Unauthorized Administrative Access
Critical
9.8
CVE-2026-39808
OS Command Injection in Fortinet FortiSandbox
Remote Code Execution / System Compromise
Critical
9.8
CVE-2026-39987
Missing Authentication in marimo Reactive Python Notebook
Pre-Authentication Remote Code Execution
Critical
9.8
CVE-2026-33017
Dynamic Code Execution in Langflow Public Flow Builder API
Unauthenticated Remote Code Execution
Critical
9.8
CVE-2026-1731
OS Command Injection in BeyondTrust Remote Support and
Pre-authentication Remote Code Execution
Critical
9.8
CVE-2026-21643
SQL Injection in Fortinet FortiClientEMS HTTP Request
Remote Code Execution via SQL Injection
Critical
9.8
CVE-2026-21962
Improper Access Control in Oracle WebLogic Server Proxy
Unauthorized Data Access and Modification
Critical
10.0
exploitable in your codebase.