[ Exploited · 1,754 CVEs ]
Exploited in the wild.
Every CVE on CISA's Known Exploited Vulnerabilities catalogue, most recently added first. If you run one of these products, patch it now.
KEV catalogue version 2026.10.21
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2025-53521 | 15 Oct 2025 | CVSS 9.8 | F5 BIG-IP Stack-Based Buffer OverflowWhen a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software… | Exploited |
| CVE-2026-33634 | 23 Mar 2026 | CVSS 8.8 | Aquasecurity Trivy Embedded Malicious CodeTrivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push… | Exploited |
| CVE-2026-33017 | 20 Mar 2026 | CVSS 9.8 | Langflow Code InjectionLangflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST… | ExploitedFix |
| CVE-2025-54068 | 17 Jul 2025 | CVSS 9.8 | Laravel Livewire Code InjectionLivewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to… | ExploitedFix |
| CVE-2025-43520 | 12 Dec 2025 | CVSS 5.5 | Apple Multiple Products Classic Buffer OverflowA memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1… | Exploited |
| CVE-2025-43510 | 12 Dec 2025 | CVSS 7.8 | Apple Multiple Products Improper LockingA memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS… | Exploited |
| CVE-2025-32432 | 25 Apr 2025 | CVSS 10.0 | Craft CMS Code InjectionCraft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before… | ExploitedFix |
| CVE-2025-31277 | 30 Jul 2025 | CVSS 8.8 | Apple Multiple Products Buffer OverflowThe issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6… | Exploited |
| CVE-2026-20131 | 4 Mar 2026 | CVSS 10.0 | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted DataA vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated… | Exploited |
| CVE-2026-20963 | 13 Jan 2026 | CVSS 9.8 | Microsoft SharePoint Deserialization of Untrusted DataDeserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | Exploited |
| CVE-2025-66376 | 5 Jan 2026 | CVSS 6.1 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site ScriptingZimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives… | Exploited |
| CVE-2025-47813 | 10 Jul 2025 | CVSS 4.3 | Wing FTP Server Information Disclosureloginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. | Exploited |
| CVE-2026-3910 | 13 Mar 2026 | CVSS 8.8 | Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory BufferInappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a… | Exploited |
| CVE-2026-3909 | 13 Mar 2026 | CVSS 8.8 | Google Skia Out-of-Bounds WriteOut of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted… | Exploited |
| CVE-2025-68613 | 19 Dec 2025 | CVSS 8.8 | n8n Improper Control of Dynamically-Managed Code Resourcesn8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical… | ExploitedFix |
| CVE-2026-1603 | 10 Feb 2026 | CVSS 7.5 | Ivanti Endpoint Manager (EPM) Authentication BypassAn authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored… | Exploited |
| CVE-2025-26399 | 23 Sep 2025 | CVSS 9.8 | SolarWinds Web Help Desk Deserialization of Untrusted DataSolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if… | ExploitedFix |
| CVE-2021-22054 | 17 Dec 2021 | CVSS 7.5 | Omnissa Workspace ONE Server-Side Request ForgeryVMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37… | ExploitedFix |
| CVE-2023-43000 | 5 Nov 2025 | CVSS 8.8 | Apple Multiple products Use-After-FreeA use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari… | Exploited |
| CVE-2023-41974 | 10 Jan 2024 | CVSS 7.8 | Apple iOS and iPadOS Use-After-FreeA use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An… | Exploited |
| CVE-2021-30952 | 24 Aug 2021 | CVSS 7.8 | Apple Multiple Products Integer Overflow or WraparoundAn integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and… | Exploited |
| CVE-2021-22681 | 3 Mar 2021 | CVSS 9.8 | Rockwell Multiple Products Insufficient Protected CredentialsRockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers… | Exploited |
| CVE-2017-7921 | 6 May 2017 | CVSS 9.8 | Hikvision Multiple Products Improper AuthenticationAn Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series… | ExploitedFix |
| CVE-2026-22719 | 25 Feb 2026 | CVSS 8.1 | Broadcom VMware Aria Operations Command InjectionVMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary… | ExploitedFix |
| CVE-2026-21385 | 2 Mar 2026 | CVSS 7.8 | Qualcomm Multiple Chipsets Memory CorruptionMemory corruption while using alignments for memory allocation. | ExploitedFix |
| CVE-2026-20127 | 25 Feb 2026 | CVSS 10.0 | Cisco Catalyst SD-WAN Controller and Manager Authentication BypassA vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly… | Exploited |
| CVE-2022-20775 | 30 Sep 2022 | CVSS 7.8 | Cisco SD-WAN Path TraversalA vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is… | Exploited |
| CVE-2026-25108 | 13 Feb 2026 | CVSS 8.8 | Soliton Systems K.K FileZen OS Command InjectionFileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted… | Exploited |
| CVE-2025-68461 | 18 Dec 2025 | CVSS 6.1 | RoundCube Webmail Cross-site ScriptingRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. | ExploitedFix |
| CVE-2025-49113 | 2 Jun 2025 | CVSS 8.8 | RoundCube Webmail Deserialization of Untrusted DataRoundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is… | ExploitedFix |
| CVE-2026-22769 | 17 Feb 2026 | CVSS 10.0 | Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded CredentialsDell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as… | ExploitedFix |
| CVE-2021-22175 | 11 Jun 2021 | CVSS 9.8 | GitLab Server-Side Request Forgery (SSRF)When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting… | Exploited |
| CVE-2026-2441 | 13 Feb 2026 | CVSS 8.8 | Google Chromium CSS Use-After-FreeUse after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… | Exploited |
| CVE-2024-7694 | 12 Aug 2024 | CVSS 7.2 | TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous TypeThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on… | Exploited |
| CVE-2020-7796 | 18 Feb 2020 | CVSS 9.8 | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request ForgeryZimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. | Exploited |
| CVE-2008-0015 | 7 Jul 2009 | CVSS 8.8 | Microsoft Windows Video ActiveX Control Remote Code ExecutionStack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX… | Exploited |
| CVE-2026-1731 | 6 Feb 2026 | CVSS 9.8 | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command InjectionBeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code… | Exploited |
| CVE-2026-20700 | 11 Feb 2026 | CVSS 7.8 | Apple Multiple Buffer OverflowA memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3… | Exploited |
| CVE-2025-40536 | 28 Jan 2026 | CVSS 9.8 | SolarWinds Web Help Desk Security Control BypassSolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated… | Exploited |
| CVE-2025-15556 | 3 Feb 2026 | CVSS 7.5 | Notepad++ Download of Code Without Integrity CheckNotepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update… | ExploitedFix |
| CVE-2024-43468 | 8 Oct 2024 | CVSS 9.8 | Microsoft Configuration Manager SQL InjectionMicrosoft Configuration Manager Remote Code Execution Vulnerability | Exploited |
| CVE-2026-21533 | 10 Feb 2026 | CVSS 7.8 | Microsoft Windows Improper Privilege ManagementImproper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. | Exploited |
| CVE-2026-21525 | 10 Feb 2026 | CVSS 6.2 | Microsoft Windows NULL Pointer DereferenceNull pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally. | Exploited |
| CVE-2026-21519 | 10 Feb 2026 | CVSS 7.8 | Microsoft Windows Type ConfusionAccess of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | Exploited |
| CVE-2026-21514 | 10 Feb 2026 | CVSS 7.8 | Microsoft Office Word Reliance on Untrusted Inputs in a Security DecisionReliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | Exploited |
| CVE-2026-21513 | 10 Feb 2026 | CVSS 8.8 | Microsoft MSHTML Framework Protection Mechanism FailureProtection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. | Exploited |
| CVE-2026-21510 | 10 Feb 2026 | CVSS 8.8 | Microsoft Windows Shell Protection Mechanism FailureProtection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | Exploited |
| CVE-2026-24423 | 23 Jan 2026 | CVSS 9.8 | SmarterTools SmarterMail Missing Authentication for Critical FunctionSmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method… | Exploited |
| CVE-2025-11953 | 3 Nov 2025 | CVSS 9.8 | React Native Community CLI OS Command InjectionThe Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an… | ExploitedFix |
| CVE-2025-64328 | 7 Nov 2025 | CVSS 7.2 | Sangoma FreePBX OS Command InjectionFreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the… | Exploited |
| CVE-2025-40551 | 28 Jan 2026 | CVSS 9.8 | SolarWinds Web Help Desk Deserialization of Untrusted DataSolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution… | Exploited |
| CVE-2021-39935 | 13 Dec 2021 | CVSS 7.5 | GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF)An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4… | Exploited |
| CVE-2019-19006 | 21 Nov 2019 | CVSS 9.8 | Sangoma FreePBX Improper AuthenticationSangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. | Exploited |
| CVE-2026-1281 | 29 Jan 2026 | CVSS 9.8 | Ivanti Endpoint Manager Mobile (EPMM) Code InjectionA code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. | ExploitedFix |
| CVE-2026-24858 | 27 Jan 2026 | CVSS 9.8 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or ChannelAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5… | Exploited |
| CVE-2026-24061 | 21 Jan 2026 | CVSS 9.8 | GNU InetUtils Argument Injectiontelnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. | ExploitedFix |
| CVE-2026-23760 | 22 Jan 2026 | CVSS 9.8 | SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or ChannelSmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The… | Exploited |
| CVE-2026-21509 | 26 Jan 2026 | CVSS 7.8 | Microsoft Office Security Feature BypassReliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally. | Exploited |
| CVE-2025-52691 | 29 Dec 2025 | CVSS 10.0 | SmarterTools SmarterMail Unrestricted Upload of File with Dangerous TypeSuccessful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server… | Exploited |
| CVE-2018-14634 | 25 Sep 2018 | CVSS 7.8 | Linux Kernel Integer OverflowAn integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise… | ExploitedFix |
| CVE-2024-37079 | 18 Jun 2024 | CVSS 9.8 | Broadcom VMware vCenter Server Out-of-bounds WritevCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter… | ExploitedFix |
| CVE-2025-68645 | 22 Dec 2025 | CVSS 8.8 | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File InclusionA Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling… | Exploited |
| CVE-2025-54313 | 19 Jul 2025 | CVSS 7.5 | Prettier eslint-config-prettier Embedded Malicious Codeeslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package… | Exploited |
| CVE-2025-34026 | 21 May 2025 | CVSS 7.5 | Versa Concerto Improper AuthenticationThe Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at… | Exploited |
| CVE-2025-31125 | 31 Mar 2025 | CVSS 7.5 | Vite Vitejs Improper Access ControlVite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps… | ExploitedFix |
| CVE-2026-20045 | 21 Jan 2026 | CVSS 9.8 | Cisco Unified Communications Products Code InjectionA vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM… | Exploited |
| CVE-2026-20805 | 13 Jan 2026 | CVSS 5.5 | Microsoft Windows Information DisclosureExposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally. | Exploited |
| CVE-2025-8110 | 10 Dec 2025 | CVSS 8.8 | Gogs Path TraversalImproper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | ExploitedFix |
| CVE-2025-37164 | 16 Dec 2025 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) OneView Code InjectionA remote code execution issue exists in HPE OneView. | Exploited |
| CVE-2009-0556 | 3 Apr 2009 | CVSS 8.8 | Microsoft Office PowerPoint Code InjectionMicrosoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute… | ExploitedFix |
| CVE-2025-14847 | 19 Dec 2025 | CVSS 7.5 | MongoDB and MongoDB Server Improper Handling of Length Parameter InconsistencyMismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue… | ExploitedFix |
| CVE-2023-52163 | 3 Feb 2025 | CVSS 8.8 | Digiever DS-2105 Pro Missing AuthorizationDigiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer… | Exploited |
| CVE-2025-14733 | 19 Dec 2025 | CVSS 9.8 | WatchGuard Firebox Out of Bounds WriteAn Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary… | Exploited |
| CVE-2025-59374 | 17 Dec 2025 | CVSS 9.8 | ASUS Live Update Embedded Malicious Code"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a… | Exploited |
| CVE-2025-40602 | 18 Dec 2025 | CVSS 6.6 | SonicWall SMA1000 Missing AuthorizationA local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC). | Exploited |
| CVE-2025-20393 | 17 Dec 2025 | CVSS 10.0 | Cisco Multiple Products Improper Input ValidationA vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could… | Exploited |
| CVE-2025-59718 | 9 Dec 2025 | CVSS 9.8 | Fortinet Multiple Products Improper Verification of Cryptographic SignatureA improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0… | Exploited |
| CVE-2025-43529 | 17 Dec 2025 | CVSS 8.8 | Apple Multiple Products Use-After-Free WebKitA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and… | Exploited |
| CVE-2025-14611 | 12 Dec 2025 | CVSS 9.8 | Gladinet CentreStack and Triofox Hard Coded CryptographicGladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This… | Exploited |
| CVE-2025-14174 | 12 Dec 2025 | CVSS 8.8 | Google Chromium Out of Bounds Memory AccessOut of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access… | Exploited |
| CVE-2018-4063 | 6 May 2019 | CVSS 8.8 | Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous TypeAn exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially… | Exploited |
| CVE-2025-58360 | 25 Nov 2025 | CVSS 9.8 | OSGeo GeoServer Improper Restriction of XML External Entity ReferenceGeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an… | Exploited |
| CVE-2025-62221 | 9 Dec 2025 | CVSS 7.8 | Microsoft Windows Use After FreeUse after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. | Exploited |
| CVE-2025-6218 | 21 Jun 2025 | CVSS 7.8 | RARLAB WinRAR Path TraversalRARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… | Exploited |
| CVE-2025-66644 | 5 Dec 2025 | CVSS 9.8 | Array Networks ArrayOS AG OS Command InjectionArray Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025. | Exploited |
| CVE-2022-37055 | 28 Aug 2022 | CVSS 9.8 | D-Link Routers Buffer OverflowD-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main, | ExploitedFix |
| CVE-2025-55182 | 3 Dec 2025 | CVSS 10.0 | Meta React Server Components Remote Code ExecutionA pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the… | ExploitedFix |
| CVE-2021-26828 | 11 Jun 2021 | CVSS 8.8 | OpenPLC ScadaBR Unrestricted Upload of File with Dangerous TypeOpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via… | ExploitedFix |
| CVE-2025-48633 | 8 Dec 2025 | CVSS 5.5 | Android Framework Information DisclosureIn hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in… | ExploitedFix |
| CVE-2025-48572 | 8 Dec 2025 | CVSS 7.8 | Android Framework Privilege EscalationIn multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local… | Exploited |
| CVE-2021-26829 | 11 Jun 2021 | CVSS 5.4 | OpenPLC ScadaBR Cross-site ScriptingOpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm. | Exploited |
| CVE-2025-61757 | 21 Oct 2025 | CVSS 9.8 | Oracle Fusion Middleware Missing Authentication for Critical FunctionVulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are… | Exploited |
| CVE-2025-13223 | 17 Nov 2025 | CVSS 8.8 | Google Chromium V8 Type ConfusionType Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Exploited |
| CVE-2025-58034 | 18 Nov 2025 | CVSS 7.2 | Fortinet FortiWeb OS Command InjectionAn Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet… | Exploited |
| CVE-2025-64446 | 14 Nov 2025 | CVSS 9.8 | Fortinet FortiWeb Path TraversalA relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9… | Exploited |
| CVE-2025-9242 | 17 Sep 2025 | CVSS 9.8 | WatchGuard Firebox Out-of-Bounds WriteAn Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary… | Exploited |
| CVE-2025-62215 | 11 Nov 2025 | CVSS 7.0 | Microsoft Windows Race ConditionConcurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to… | Exploited |
| CVE-2025-12480 | 10 Nov 2025 | CVSS 9.1 | Gladinet Triofox Improper Access ControlTriofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after… | Exploited |
| CVE-2025-21042 | 12 Sep 2025 | CVSS 9.8 | Samsung Mobile Devices Out-of-Bounds WriteOut-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. | Exploited |
| CVE-2025-48703 | 19 Sep 2025 | CVSS 9.0 | CWP Control Web Panel OS Command InjectionCWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the… | Exploited |
Page 3 of 18