Vulnerability & Exploit Database

This is the list of vulnerabilities you can detect with Pentest-Tools.com and the exploits currently available in the platform.

We detect more than 17.583 vulnerabilities with multiple tools (Network Scanner, Website Scanner, Wordpress Scanner, and more) and we also have 222 exploit modules in Sniper to validate the risk level of critical CVEs.

Display

Is exploitable with Sniper

Is in CISA catalog

Detectable with

Displaying 1 - 25 results out of 17.478

Pentest-Tools.com Vulnerabilities
Name	Detectable with	Detection added	CVSSv3	EPSS Score	EPSS Percentile	Exploitable with Sniper
ClickHouse Server - Brotli v1.2.0 Decoder DoS/OOB-Write CVE-2026-116366	Network Scanner	Nov 2, 2026	Critical(9.5)	0.01	0.34	No
Plex Media Server < 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell) CVE-2026-96652	Network Scanner	Nov 2, 2026	Medium(4.3)	0.02	0.79	No
Langchain-Chatchat <= 0.3.1.3 - Unauthenticated RCE CVE-2026-75128	Network Scanner	Nov 2, 2026	Critical(9.8)	0.01	0.51	No
NUUO Crystal Server - Unauthenticated File Upload Remote Code Execution	Network Scanner	Oct 30, 2026	Critical	N/A	N/A	No
Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID CVE-2026-116748	Network Scanner	Oct 30, 2026	Medium(8.8)	0.02	0.7	No
GeoNetwork - Server-Side Request Forgery (SSRF) CVE-2026-55864	Network Scanner	Oct 29, 2026	High(8.6)	0.02	0.74	No
XWiki Platform - Password Hash Disclosure CVE-2026-48048	Network Scanner	Oct 29, 2026	High(7.5)	0.03	0.81	No
XWiki Platform - Path Traversal CVE-2026-34151	Network Scanner	Oct 29, 2026	High(8.2)	0.03	0.85	No
Diafan CMS 6.0 - Cross-Site Scripting	Network Scanner	Oct 29, 2026	Medium	N/A	N/A	No
DVWA Exposed Setup Page	Network Scanner	Oct 29, 2026	High	N/A	N/A	No
eXtplorer <= 2.1.14 - Authentication Bypass CVE-2023-54335	Network Scanner	Oct 29, 2026	Critical(9.8)	0.14	0.97	No
LearnPress <= 4.4.9.1 - PHP Object Injection CVE-2026-104736	Network Scanner	Oct 29, 2026	Critical(9.8)	0.03	0.85	No
FUXA <= 1.1.12 - Unauthenticated SQL Injection CVE-2023-31719	Network Scanner	Oct 29, 2026	Critical(9.8)	0.45	0.99	No
Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution CVE-2026-102489	Network Scanner	Oct 29, 2026	Critical(9.8)	0.23	0.98	No
WordPress Check & Log Email < 2.0.15 - SQL Injection CVE-2026-14554	Network Scanner	Oct 29, 2026	Medium(6.5)	0.02	0.73	No
Docker-Proxy hubcmdui - Missing Authentication on /api/config CVE-2026-116070	Network Scanner	Oct 28, 2026	Medium(6.5)	0.01	0.46	No
SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth "to" Parameter CVE-2026-116167	Network Scanner	Oct 28, 2026	High(7.6)	0.01	0.52	No
Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass CVE-2026-85595	Network Scanner	Oct 28, 2026	Critical(9.8)	0.03	0.85	No
WP Booking System <= 2.1.0.3 - Unauthenticated Email Log Disclosure CVE-2026-108123	Network Scanner	Oct 28, 2026	High(7.5)	0.02	0.64	No
OpenEMR < 8.0.0 - MedEx Callback Unauthenticated Token Disclosure CVE-2026-24898	Network Scanner	Oct 28, 2026	Critical(10)	0.03	0.85	No
MLflow <3.17.0 - Unauthenticated SSRF via Third-Party (TruLens) Scorer CVE-2026-115886	Network Scanner	Oct 28, 2026	Medium(6.5)	0.01	0.53	No
Collabora Built-in CODE Server < 26.4.303 - OS Command Injection CVE-2026-110447	Network Scanner	Oct 28, 2026	Critical(9.2)	0.74	1	No
danmu_api - Unauthenticated Access to Admin API via Default Token CVE-2026-116485	Network Scanner	Oct 27, 2026	Critical(9.8)	0.03	0.84	No
YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery CVE-2026-116205	Network Scanner	Oct 27, 2026	Medium(5.3)	0.01	0.44	No
W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write CVE-2026-18051	Network Scanner	Oct 27, 2026	Critical(10)	0.03	0.81	No

Vulnerability & Exploit Database

One of EMEA's fastest-growing tech companies

Independently audited company-wide ISMS

50,000+ security folks are here. Are you?

Security leaders trust what they can prove