Vulnerability & Exploit Database

This is the list of vulnerabilities you can detect with Pentest-Tools.com and the exploits currently available in the platform.

We detect more than 17.411 vulnerabilities with multiple tools (Network Scanner, Website Scanner, Wordpress Scanner, and more) and we also have 199 exploit modules in Sniper to validate the risk level of critical CVEs.

Display

Displaying 1 - 25 results out of 17.411

Pentest-Tools.com Vulnerabilities
Name	Detectable with	Detection added	CVSSv3	EPSS Score	EPSS Percentile	Exploitable with Sniper
ESPHome Device Builder <1.0.10 - Unauthenticated Dashboard Access CVE-2026-59177	Network Scanner	Sep 15, 2026	High(8.8)	N/A	N/A	No
Ruby on Rails Active Storage - Remote Code Execution CVE-2026-66066	Network Scanner	Sep 15, 2026	Critical(10)	0.28	0.98	Yes
Discourse - Private User Field Disclosure via Directory Items IDOR CVE-2026-26265	Network Scanner	Sep 15, 2026	High(7.5)	0.01	0.19	No
JetBrains TeamCity - Remote Code Execution CVE-2026-63077	Network Scanner	Sep 15, 2026	Critical(9.8)	0.87	1	Yes
LightRAG <= 1.5.3 - Credentialed CORS Wildcard CVE-2026-61736	Network Scanner	Sep 15, 2026	Critical(9.3)	0.01	0.44	No
HSC MailInspector - Unauthenticated Arbitrary File Read CVE-2026-29963	Network Scanner	Sep 15, 2026	High(7.5)	0.01	0.47	No
NextGEN Gallery <= 4.2.3 - Reflected Cross-Site Scripting CVE-2026-28141	Network Scanner	Sep 15, 2026	High(7.1)	0.01	0.08	No
Docmost 0.2.1-0.21.0 - Arbitrary File Read CVE-2025-57231	Network Scanner	Sep 15, 2026	High(7.5)	0.01	0.33	No
Langflow <=1.2.x - Unauthenticated Remote Code Execution via validate_code CVE-2026-0768	Network Scanner	Sep 15, 2026	Critical(9.8)	0.03	0.83	No
Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting CVE-2026-58191	Network Scanner	Sep 15, 2026	Medium(6.5)	0.01	0.17	No
Divi Form Builder <=5.1.8 - Unauthenticated Arbitrary File Upload RCE CVE-2026-5524	Network Scanner	Sep 15, 2026	Critical(9.8)	0.01	0.59	No
Discourse <=2026.2.0 - Hidden Post Revision Disclosure via revert_to Authorization Bypass CVE-2026-27454	Network Scanner	Sep 15, 2026	Medium(5.3)	0.01	0.39	No
PasswordPusher v1.45.11-v2.9.5 - Unauthenticated Anonymous Push Deletion via Ownership Bypass CVE-2026-62382	Network Scanner	Sep 15, 2026	Medium(6.9)	0.01	0.2	No
GEO my WP <=4.5.5.3 - Unauthenticated Local File Inclusion CVE-2026-85200	Network Scanner	Sep 15, 2026	High(7.5)	0.01	0.54	No
OmniRoute < 3.8.49 - Unauthenticated RCE CVE-2026-88062	Network Scanner	Sep 15, 2026	Critical(9.5)	0.01	0.34	No
Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal CVE-2026-41948	Network Scanner	Sep 15, 2026	Critical(9.4)	0.08	0.95	No
CtrlPanel <= 1.1.1 - Remote Code Execution CVE-2026-34234	Network Scanner	Sep 15, 2026	Critical(10)	0.01	0.56	No
Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection CVE-2026-1281	Network Scanner	Sep 15, 2026	Critical(9.8)	0.82	1	No
PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct CVE-2026-81578	Network Scanner	Sep 15, 2026	Critical(9.8)	0.02	0.75	No
cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection CVE-2026-59509	Network Scanner	Sep 15, 2026	Critical(9.2)	0.01	0.44	No
ruflo MCP Bridge - Unauthenticated RCE via terminal_execute CVE-2026-59726	Network Scanner	Sep 15, 2026	Critical(9.8)	0.07	0.94	No
Provectus kafka-ui <=0.7.2 - Remote Code Execution CVE-2026-5562	Network Scanner	Sep 14, 2026	Critical(9.8)	0.01	0.48	No
GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read CVE-2026-85706	Network Scanner	Sep 14, 2026	Critical(10)	0.12	0.96	No
FreeScout < 1.8.224 - Invite Hash Authorization Bypass CVE-2026-53595	Network Scanner	Sep 11, 2026	Critical(9.4)	0.02	0.8	No
Apache Livy - Logs Exposed	Network Scanner	Sep 11, 2026	Medium	N/A	N/A	No

Vulnerability & Exploit Database

One of EMEA's fastest-growing tech companies

Independently audited company-wide ISMS

50,000+ security folks are here. Are you?

Security leaders trust what they can prove