Vulnerability & Exploit Database

This is the list of vulnerabilities you can detect with Pentest-Tools.com and the exploits currently available in the platform.

We detect more than 17.414 vulnerabilities with multiple tools (Network Scanner, Website Scanner, Wordpress Scanner, and more) and we also have 199 exploit modules in Sniper to validate the risk level of critical CVEs.

Display

Is exploitable with Sniper

Is in CISA catalog

Detectable with

Displaying 1 - 25 results out of 17.272

Pentest-Tools.com Vulnerabilities
Name	Detectable with	Detection added	CVSSv3	EPSS Score	EPSS Percentile	Exploitable with Sniper
Flowise AI - Unauthenticated Chatflows API Exposure	Network Scanner	Sep 16, 2026	High	N/A	N/A	No
Langflow - Unauthenticated API Exposure	Network Scanner	Sep 16, 2026	High	N/A	N/A	No
OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation CVE-2026-27960	Network Scanner	Sep 16, 2026	Critical(9.8)	0.01	0.47	No
HSC MailInspector - Unauthenticated Arbitrary File Read CVE-2026-29963	Network Scanner	Sep 15, 2026	High(7.5)	0.01	0.47	No
PasswordPusher v1.45.11-v2.9.5 - Unauthenticated Anonymous Push Deletion via Ownership Bypass CVE-2026-62382	Network Scanner	Sep 15, 2026	Medium(6.9)	0.01	0.21	No
Discourse - Private User Field Disclosure via Directory Items IDOR CVE-2026-26265	Network Scanner	Sep 15, 2026	High(7.5)	0.01	0.58	No
PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct CVE-2026-81578	Network Scanner	Sep 15, 2026	Critical(9.8)	0.02	0.75	No
Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection CVE-2026-1281	Network Scanner	Sep 15, 2026	Critical(9.8)	0.82	1	No
Divi Form Builder <=5.1.8 - Unauthenticated Arbitrary File Upload RCE CVE-2026-5524	Network Scanner	Sep 15, 2026	Critical(9.8)	0.01	0.59	No
ruflo MCP Bridge - Unauthenticated RCE via terminal_execute CVE-2026-59726	Network Scanner	Sep 15, 2026	Critical(9.8)	0.07	0.94	No
GEO my WP <=4.5.5.3 - Unauthenticated Local File Inclusion CVE-2026-85200	Network Scanner	Sep 15, 2026	High(7.5)	0.01	0.54	No
Discourse <=2026.2.0 - Hidden Post Revision Disclosure via revert_to Authorization Bypass CVE-2026-27454	Network Scanner	Sep 15, 2026	Medium(5.3)	0.01	0.39	No
OmniRoute < 3.8.49 - Unauthenticated RCE CVE-2026-88062	Network Scanner	Sep 15, 2026	Critical(9.5)	0.01	0.34	No
Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal CVE-2026-41948	Network Scanner	Sep 15, 2026	Critical(9.4)	0.15	0.97	No
cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection CVE-2026-59509	Network Scanner	Sep 15, 2026	Critical(9.2)	0.01	0.44	No
Langflow <=1.2.x - Unauthenticated Remote Code Execution via validate_code CVE-2026-0768	Network Scanner	Sep 15, 2026	Critical(9.8)	0.03	0.83	No
LightRAG <= 1.5.3 - Credentialed CORS Wildcard CVE-2026-61736	Network Scanner	Sep 15, 2026	Critical(9.3)	0.02	0.72	No
CtrlPanel <= 1.1.1 - Remote Code Execution CVE-2026-34234	Network Scanner	Sep 15, 2026	Critical(10)	0.04	0.88	No
Docmost 0.2.1-0.21.0 - Arbitrary File Read CVE-2025-57231	Network Scanner	Sep 15, 2026	High(7.5)	0.02	0.68	No
Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting CVE-2026-58191	Network Scanner	Sep 15, 2026	Medium(6.5)	0.01	0.38	No
ESPHome Device Builder <1.0.10 - Unauthenticated Dashboard Access CVE-2026-59177	Network Scanner	Sep 15, 2026	High(8.8)	N/A	N/A	No
NextGEN Gallery <= 4.2.3 - Reflected Cross-Site Scripting CVE-2026-28141	Network Scanner	Sep 15, 2026	High(7.1)	0.01	0.08	No
JetBrains TeamCity - Remote Code Execution CVE-2026-63077	Network Scanner	Sep 15, 2026	Critical(9.8)	0.87	1	Yes
Ruby on Rails Active Storage - Remote Code Execution CVE-2026-66066	Network Scanner	Sep 15, 2026	Critical(10)	0.28	0.98	Yes
Provectus kafka-ui <=0.7.2 - Remote Code Execution CVE-2026-5562	Network Scanner	Sep 14, 2026	Critical(9.8)	0.03	0.8	No

Vulnerability & Exploit Database

One of EMEA's fastest-growing tech companies

Independently audited company-wide ISMS

50,000+ security folks are here. Are you?

Security leaders trust what they can prove