[ Exploited · 1,754 CVEs ]
Exploited in the wild.
Every CVE on CISA's Known Exploited Vulnerabilities catalogue, most recently added first. If you run one of these products, patch it now.
KEV catalogue version 2026.10.21
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-96656 | 23 Sep 2026 | CVSS 7.2 | Plex Media Server admin setting allows code executionPlex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference… | Exploited |
| CVE-2026-96655 | 23 Sep 2026 | CVSS 4.3 | Server-side request forgery in Plex Media Server transcoderPlex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the… | Exploited |
| CVE-2026-96654 | 23 Sep 2026 | CVSS 6.5 | URL handling flaw exposes Plex Media Server plugin functionsPlex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins'… | Exploited |
| CVE-2026-96652 | 23 Sep 2026 | CVSS 4.3 | Server-side request forgery in Plex Media Server timeline endpointPlex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the… | Exploited |
| CVE-2026-110936 | 15 Oct 2026 | CVSS 6.7 | DLL search path flaw in Siemens Software CenterA vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries… | ExploitedFix |
| CVE-2026-106931 | 14 Oct 2026 | CVSS 8.5 | Command injection in SiteGuard Server Edition gives root or SYSTEMSiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or… | Exploited |
| CVE-2026-102764 | 15 Oct 2026 | CVSS 9.8 | Authentication bypass in BeyondTrust Remote SupportThe vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of… | Exploited |
| CVE-2025-61624 | 14 Apr 2026 | CVSS 6.5 | Fortinet Multiple Products Path TraversalAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4… | Exploited |
| CVE-2026-21589 | 5 Oct 2026 | CVSS 7.5 | Unauthenticated file read in Atlassian Data Center productsThis is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data… | ExploitedFix |
| CVE-2026-76519 | 14 Oct 2026 | CVSS 9.8 | Crafted email attachment gives root on Cisco Secure Email GatewayA vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to… | ExploitedFix |
| CVE-2026-105134 | 4 Oct 2026 | CVSS 10.0 | Command injection in AhsayCBS backup serverA flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the… | Exploited |
| CVE-2026-105133 | 4 Oct 2026 | CVSS 7.3 | Ahsay AhsayCBS Improper AuthenticationA vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file… | Exploited |
| CVE-2026-0322 | 14 Oct 2026 | CVSS 7.2 | Code injection in PAN-OS management interface gives root on firewallsA remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with… | Exploited |
| CVE-2026-96951 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows Command InjectionImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a… | ExploitedFix |
| CVE-2026-104935 | 13 Oct 2026 | CVSS 8.6 | Ivanti Connect Secure authentication bypass allows remote commandsAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does… | ExploitedFix |
| CVE-2023-22894 | 19 Apr 2023 | CVSS 4.9 | Strapi Cleartext Storage of Sensitive InformationStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The… | Exploited |
| CVE-2021-3199 | 26 Jan 2021 | CVSS 9.8 | Path traversal in ONLYOFFICE Document Server leads to code executionDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence… | Exploited |
| CVE-2016-3081 | 26 Apr 2016 | CVSS 8.1 | Remote code execution in Apache Struts with Dynamic Method InvocationApache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to… | ExploitedFix |
| CVE-2015-5477 | 29 Jul 2015 | CVSS 7.5 | Crafted TKEY queries crash ISC BIND DNS serversnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and… | ExploitedFix |
| CVE-2015-3306 | 18 May 2015 | CVSS 10.0 | ProFTPD mod_copy lets anyone copy files on the serverThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. | Exploited |
| CVE-2026-88779 | 4 Oct 2026 | CVSS 7.5 | Exploited denial of service flaw in NetScaler ADC and GatewayVulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and… | ExploitedFix |
| CVE-2026-102490 | 30 Sep 2026 | CVSS 7.8 | Local privilege escalation to root in Zammad DEB and RPM packagesZammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the… | Exploited |
| CVE-2026-102489 | 30 Sep 2026 | CVSS 9.8 | Session hijack leads to code execution in ZammadZammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also… | Exploited |
| CVE-2026-104286 | 1 Oct 2026 | CVSS 9.8 | Unauthenticated file write in Fortinet FortiMailAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail… | ExploitedFix |
| CVE-2026-76504 | 30 Sep 2026 | CVSS 9.8 | Authentication bypass gives admin access to Cisco SD-WAN ManagerA vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker… | ExploitedFix |
| CVE-2026-86950 | 28 Sep 2026 | CVSS 8.8 | Exploited out-of-bounds write in Apple iOS, iPadOS and macOSAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1… | ExploitedFix |
| CVE-2026-88772 | 27 Sep 2026 | CVSS 8.1 | Memory flaw in NetScaler ADC and Gateway allows remote code executionVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37… | ExploitedFix |
| CVE-2026-88771 | 27 Sep 2026 | CVSS 9.8 | Unauthenticated command execution in NetScaler ADC and GatewayImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before… | ExploitedFix |
| CVE-2026-87902 | 22 Sep 2026 | CVSS 8.1 | Local file inclusion in WordPress core can lead to code executionAn unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active… | ExploitedFix |
| CVE-2026-67279 | 5 Sep 2026 | CVSS 6.5 | Mikrotik RouterOS Improper Enforcement of Behavioral WorkflowRouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an… | Exploited |
| CVE-2026-65660 | 11 Aug 2026 | CVSS 8.8 | Microsoft SharePoint Code InjectionImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ExploitedFix |
| CVE-2026-71362 | 11 Aug 2026 | CVSS 9.1 | Privilege escalation in Adobe Commerce and MagentoAdobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this… | Exploited |
| CVE-2026-5430 | 6 Aug 2026 | CVSS 10.0 | WSO2 Multiple Products Path TraversalThe JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker… | Exploited |
| CVE-2026-94127 | 22 Sep 2026 | CVSS 9.8 | F5 BIG-IP APM Heap-based Buffer OverflowWhen a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution… | ExploitedFix |
| CVE-2026-93952 | 22 Sep 2026 | CVSS 10.0 | Arista VeloCloud Orchestrator Improper Input ValidationVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality… | Exploited |
| CVE-2026-93616 | 22 Sep 2026 | CVSS 9.8 | Unauthenticated script upload in Check Point Management ServerA directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point… | ExploitedFix |
| CVE-2026-85102 | 9 Sep 2026 | CVSS 9.8 | Check Point Multiple Products Improper Certificate ValidationImproper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to… | ExploitedFix |
| CVE-2026-7273 | 16 Jun 2026 | CVSS 8.8 | Zyxel GS1900 Series Switches Stack-Based Buffer OverflowA stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a… | Exploited |
| CVE-2026-53266 | 25 Jun 2026 | CVSS 8.8 | Linux Kernel Out-of-Bounds WriteIn the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target… | ExploitedFix |
| CVE-2025-39964 | 13 Oct 2025 | CVSS 5.5 | Linux Kernel Race ConditionIn the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes… | ExploitedFix |
| CVE-2025-39682 | 5 Sep 2025 | CVSS 9.8 | Linux Kernel Improper Check for Unusual or Exceptional ConditionsIn the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must… | ExploitedFix |
| CVE-2026-87886 | 17 Sep 2026 | CVSS 7.8 | Acronis Backup Incorrect Default PermissionsLocal privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux)… | Exploited |
| CVE-2026-76460 | 16 Sep 2026 | CVSS 10.0 | Cisco Identity Services Engine Incorrect Use of Privileged APIsA vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This… | Exploited |
| CVE-2026-58704 | 15 Sep 2026 | CVSS 8.8 | Google Pixel Improper AuthorizationIn Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation… | Exploited |
| CVE-2026-76461 | 14 Sep 2026 | CVSS 9.8 | Cisco Secure Email Gateway SQL InjectionA vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to… | Exploited |
| CVE-2026-85706 | 12 Sep 2026 | CVSS 10.0 | Unauthenticated file read in GitLab through the commits APIGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before… | ExploitedFix |
| CVE-2026-84869 | 8 Sep 2026 | CVSS 9.9 | ConnectWise ScreenConnect Improper Privilege Management and Missing AuthorizationA condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host… | Exploited |
| CVE-2026-42018 | 12 Aug 2026 | CVSS 7.5 | JFrog Artifactory Improper AuthenticationJFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing… | Exploited |
| CVE-2026-42016 | 27 Jul 2026 | CVSS 8.8 | JFrog Artifactory Incorrect AuthorizationJFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token… | Exploited |
| CVE-2026-86060 | 5 Sep 2026 | CVSS 9.8 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a CommandRouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the… | Exploited |
| CVE-2026-67277 | 5 Sep 2026 | CVSS 8.2 | MikroTik RouterOS Missing Authentication for Critical FunctionRouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can… | Exploited |
| CVE-2026-87491 | 9 Sep 2026 | CVSS 8.8 | Google Chromium V8 Out of Bounds WriteOut of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a… | Exploited |
| CVE-2026-20079 | 4 Mar 2026 | CVSS 10.0 | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or ChannelA vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to… | Exploited |
| CVE-2026-19490 | 19 Aug 2026 | CVSS 9.8 | Citrix NetScaler Authentication Bypass Using an Alternate Path or ChannelVulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1… | Exploited |
| CVE-2025-25249 | 13 Jan 2026 | CVSS 9.8 | Fortinet Multiple Products Heap-based Buffer OverflowA heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11… | Exploited |
| CVE-2026-86218 | 6 Sep 2026 | CVSS 9.8 | N-able N-central Static Code InjectionN-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14. | Exploited |
| CVE-2026-85880 | 8 Sep 2026 | CVSS 7.8 | Microsoft Windows Heap-Based Buffer OverflowHeap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. | ExploitedFix |
| CVE-2026-81963 | 8 Sep 2026 | CVSS 7.8 | Microsoft Windows Link FollowingImproper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. | ExploitedFix |
| CVE-2026-75650 | 7 Sep 2026 | CVSS 10.0 | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template EngineAdobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary… | ExploitedFix |
| CVE-2026-85046 | 3 Sep 2026 | CVSS 8.8 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… | ExploitedFix |
| CVE-2026-9586 | 17 Jul 2026 | CVSS 9.8 | Sangoma Switchvox SQL InjectionAn unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning… | Exploited |
| CVE-2026-83549 | 1 Sep 2026 | CVSS 7.8 | SonicWall SMA1000 Appliances OS Command InjectionPost-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in… | ExploitedFix |
| CVE-2026-83548 | 1 Sep 2026 | CVSS 10.0 | SonicWall SMA1000 Appliances Server-Side Request ForgeryA Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote… | ExploitedFix |
| CVE-2026-82329 | 28 Aug 2026 | CVSS 9.8 | JFrog Artifactory Improper AuthenticationJFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to… | Exploited |
| CVE-2026-59822 | 8 Jul 2026 | CVSS 8.2 | BerriAI LiteLLM Improper AuthenticationLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed… | ExploitedFix |
| CVE-2026-49869 | 26 Jun 2026 | CVSS 10.0 | Kestra OSS OS Command InjectionKestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses… | Exploited |
| CVE-2026-48710 | 26 May 2026 | CVSS 6.5 | Kludex Starlette HTTP Request/Response SmugglingStarlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to… | ExploitedFix |
| CVE-2026-82078 | 28 Aug 2026 | CVSS 9.1 | PaperCut NG/MF Unsafe ReflectionAn unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application… | ExploitedFix |
| CVE-2026-81578 | 28 Aug 2026 | CVSS 9.8 | PaperCut NG/MF Missing Authentication for Critical FunctionAn improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions… | ExploitedFix |
| CVE-2026-66384 | 12 Aug 2026 | CVSS 5.3 | JFrog Artifactory Improper Limitation of a Pathname to a Restricted DirectoryAn authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. | Exploited |
| CVE-2026-53362 | 4 Jul 2026 | CVSS 7.8 | Linux Kernel UnspecifiedIn the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data()… | ExploitedFix |
| CVE-2023-49105 | 21 Nov 2023 | CVSS 9.8 | ownCloud Improper AuthenticationAn issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the… | Exploited |
| CVE-2026-8452 | 30 Jun 2026 | CVSS 9.8 | Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory BufferMemory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the… | Exploited |
| CVE-2022-0995 | 25 Mar 2022 | CVSS 7.8 | Linux Kernel Out-of-Bounds WriteAn out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of… | ExploitedFix |
| CVE-2021-23758 | 3 Dec 2021 | CVSS 9.8 | Ajax.NET Professional Deserialization of Untrusted DataAll versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET… | ExploitedFix |
| CVE-2019-1068 | 15 Jul 2019 | CVSS 8.8 | Microsoft SQL Server Remote Code ExecutionA remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL… | ExploitedFix |
| CVE-2015-5287 | 7 Dec 2015 | CVSS 7.8 | Red Hat Automatic Bug Reporting Tool Privilege EscalationThe abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges… | ExploitedFix |
| CVE-2015-3246 | 11 Aug 2015 | CVSS 7.4 | Red Hat Libuser Race Conditionlibuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which… | Exploited |
| CVE-2026-60004 | 26 Aug 2026 | CVSS 9.8 | Gitea Code InjectionGitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. | Exploited |
| CVE-2026-21962 | 20 Jan 2026 | CVSS 10.0 | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access ControlVulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy… | ExploitedFix |
| CVE-2026-73570 | 13 Aug 2026 | CVSS 8.9 | Zimbra Collaboration Suite (ZCS) OS Command InjectionA remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP… | Exploited |
| CVE-2026-72530 | 19 Aug 2026 | CVSS 9.0 | TrueConf Server Code InjectionA remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5… | Exploited |
| CVE-2026-72529 | 19 Aug 2026 | CVSS 9.8 | TrueConf Server Missing Authentication for Critical FunctionA remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5… | Exploited |
| CVE-2026-64849 | 17 Aug 2026 | CVSS 9.3 | MLflow Server-Side Request ForgeryMLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to… | ExploitedFix |
| CVE-2026-65400 | 6 Aug 2026 | CVSS 9.8 | Apple macOS Improper AuthenticationAn authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma… | Exploited |
| CVE-2026-59310 | 30 Jul 2026 | CVSS 9.8 | Broadcom VMware vCenter Path TraversalVMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this… | Exploited |
| CVE-2026-55040 | 14 Jul 2026 | CVSS 9.1 | Microsoft SharePoint Weak AuthenticationWeak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. | ExploitedFix |
| CVE-2026-33824 | 14 Apr 2026 | CVSS 9.8 | Microsoft Internet Key Exchange (IKE) Service Extensions Double FreeDouble free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. | Exploited |
| CVE-2025-62593 | 26 Nov 2025 | CVSS 8.8 | Ray-Project Ray Code InjectionRay is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE… | ExploitedFix |
| CVE-2026-72898 | 10 Aug 2026 | CVSS 10.0 | Metabase SQL InjectionMetabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access… | ExploitedFix |
| CVE-2026-68820 | 11 Aug 2026 | CVSS 7.0 | Microsoft Windows Ancillary Function Driver for WinSock Use-After-FreeUse after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | ExploitedFix |
| CVE-2026-20349 | 11 Aug 2026 | CVSS 8.6 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap InspectionA vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall… | Exploited |
| CVE-2026-8037 | 4 Jun 2026 | CVSS 9.8 | Progress LoadMaster Command InjectionOS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary… | ExploitedFix |
| CVE-2026-63077 | 27 Jul 2026 | CVSS 9.8 | JetBrains TeamCity Deserialization of Untrusted DataIn JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol | Exploited |
| CVE-2026-9198 | 17 Jul 2026 | CVSS 9.8 | IBM Langflow Code InjectionIBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller)… | Exploited |
| CVE-2026-34486 | 9 Apr 2026 | CVSS 7.5 | Apache Tomcat Missing Encryption of Sensitive DataMissing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor… | Exploited |
| CVE-2026-18556 | 1 Aug 2026 | CVSS 7.4 | N-able N-central Authentication Bypass Using an Alternate Path or ChannelAuthentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects… | Exploited |
| CVE-2026-18577 | 2 Aug 2026 | CVSS 8.1 | N-able N-central Authentication Bypass Using an Alternate Path or ChannelAn incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 | ExploitedFix |
| CVE-2026-20316 | 29 Jul 2026 | CVSS 5.3 | Cisco Secure Firewall Management Center Use of Hard-coded PasswordA vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log… | Exploited |
| CVE-2026-16812 | 27 Jul 2026 | CVSS 10.0 | Arista VeloCloud Orchestrator On-Prem OS Command InjectionVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality… | Exploited |
Page 1 of 18