Vulnerability & Exploit Database

This is the list of vulnerabilities you can detect with Pentest-Tools.com and the exploits currently available in the platform.

We detect more than 17.428 vulnerabilities with multiple tools (Network Scanner, Website Scanner, Wordpress Scanner, and more) and we also have 199 exploit modules in Sniper to validate the risk level of critical CVEs.

Display

Displaying 1 - 25 results out of 17.428

Pentest-Tools.com Vulnerabilities
Name	Detectable with	Detection added	CVSSv3	EPSS Score	EPSS Percentile	Exploitable with Sniper
WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload CVE-2026-84434	Network Scanner	Sep 21, 2026	Critical(9.8)	0.01	0.52	No
Yamcs <=5.8.6 - Cross-Site Scripting CVE-2026-55549	Network Scanner	Sep 19, 2026	Medium(6.5)	0.01	0.58	No
argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access CVE-2026-82456	Network Scanner	Sep 19, 2026	Critical(10)	0.02	0.71	No
SiYuan <=3.7.2 - SQL Injection CVE-2026-69085	Network Scanner	Sep 18, 2026	Critical(10)	0.01	0.57	No
Essential Blocks < 6.4.0 - Information Disclosure CVE-2026-13153	Network Scanner	Sep 18, 2026	High(7.5)	0.01	0.59	No
JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass CVE-2026-42018	Network Scanner	Sep 18, 2026	High(7.5)	0.12	0.96	No
etcd v3 Unauthenticated API	Network Scanner	Sep 18, 2026	High	N/A	N/A	No
TEN Framework - Arbitrary File Read & Write CVE-2026-85688	Network Scanner	Sep 18, 2026	Critical(9.8)	0.02	0.73	No
Ivanti EPMM < 12.8.0.0 - Remote Code Execution CVE-2026-1340	Network Scanner	Sep 18, 2026	Critical(9.8)	0.99	1	No
etcd RAFT Unauthenticated API	Network Scanner	Sep 18, 2026	High	N/A	N/A	No
Langflow OSS - Superuser Token Issuance CVE-2026-9103	Network Scanner	Sep 18, 2026	Critical(9.8)	0.03	0.86	No
N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution CVE-2026-86218	Network Scanner	Sep 18, 2026	Critical(10)	0.08	0.95	No
H2 Database Console - JNDI Injection RCE CVE-2021-42392	Network Scanner	Sep 18, 2026	Critical(9.8)	0.84	1	No
Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass CVE-2026-18072	Network Scanner	Sep 17, 2026	Critical(9.8)	0.04	0.88	No
Langflow - Unauthenticated API Exposure	Network Scanner	Sep 16, 2026	High	N/A	N/A	No
Flowise AI - Unauthenticated Chatflows API Exposure	Network Scanner	Sep 16, 2026	High	N/A	N/A	No
OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation CVE-2026-27960	Network Scanner	Sep 16, 2026	Critical(9.8)	0.02	0.8	No
cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection CVE-2026-59509	Network Scanner	Sep 15, 2026	Critical(9.2)	0.02	0.72	No
Langflow <=1.2.x - Unauthenticated Remote Code Execution via validate_code CVE-2026-0768	Network Scanner	Sep 15, 2026	Critical(9.8)	0.08	0.95	No
ruflo MCP Bridge - Unauthenticated RCE via terminal_execute CVE-2026-59726	Network Scanner	Sep 15, 2026	Critical(9.8)	0.17	0.97	No
Discourse <=2026.2.0 - Hidden Post Revision Disclosure via revert_to Authorization Bypass CVE-2026-27454	Network Scanner	Sep 15, 2026	Medium(5.3)	0.01	0.58	No
Ruby on Rails Active Storage - Remote Code Execution CVE-2026-66066	Network Scanner	Sep 15, 2026	Critical(10)	0.28	0.99	Yes
JetBrains TeamCity - Remote Code Execution CVE-2026-63077	Network Scanner	Sep 15, 2026	Critical(9.8)	0.87	1	Yes
Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal CVE-2026-41948	Network Scanner	Sep 15, 2026	Critical(9.4)	0.15	0.97	No
OmniRoute < 3.8.49 - Unauthenticated RCE CVE-2026-88062	Network Scanner	Sep 15, 2026	Critical(9.5)	0.01	0.59	No

Vulnerability & Exploit Database

One of EMEA's fastest-growing tech companies

Independently audited company-wide ISMS

50,000+ security folks are here. Are you?

Security leaders trust what they can prove