[ Exploited · 1,754 CVEs ]
Exploited in the wild.
Every CVE on CISA's Known Exploited Vulnerabilities catalogue, most recently added first. If you run one of these products, patch it now.
KEV catalogue version 2026.10.21
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2025-11371 | 9 Oct 2025 | CVSS 7.5 | Gladinet CentreStack and Triofox Files or Directories Accessible to External PartiesIn the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows… | Exploited |
| CVE-2025-41244 | 29 Sep 2025 | CVSS 7.8 | Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe ActionsVMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative… | Exploited |
| CVE-2025-24893 | 20 Feb 2025 | CVSS 9.8 | XWiki Platform Eval InjectionXWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code… | ExploitedFix |
| CVE-2025-6205 | 4 Aug 2025 | CVSS 9.1 | Dassault Systèmes DELMIA Apriso Missing AuthorizationA missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged… | Exploited |
| CVE-2025-6204 | 4 Aug 2025 | CVSS 8.0 | Dassault Systèmes DELMIA Apriso Code InjectionAn Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow… | Exploited |
| CVE-2025-59287 | 14 Oct 2025 | CVSS 9.8 | Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted DataDeserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network. | Exploited |
| CVE-2025-54236 | 9 Sep 2025 | CVSS 9.1 | Adobe Commerce and Magento Improper Input ValidationAdobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation… | Exploited |
| CVE-2025-61932 | 20 Oct 2025 | CVSS 9.3 | Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication ChannelLanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing… | Exploited |
| CVE-2025-61884 | 12 Oct 2025 | CVSS 7.5 | Oracle E-Business Suite Server-Side Request Forgery (SSRF)Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are… | Exploited |
| CVE-2025-33073 | 10 Jun 2025 | CVSS 8.8 | Microsoft Windows SMB Client Improper Access ControlImproper access control in Windows SMB allows an authorized attacker to elevate privileges over a network. | Exploited |
| CVE-2025-2747 | 24 Mar 2025 | CVSS 9.8 | Kentico Xperience CMS Authentication Bypass Using an Alternate Path or ChannelAn authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for… | ExploitedFix |
| CVE-2025-2746 | 24 Mar 2025 | CVSS 9.8 | Kentico Xperience CMS Authentication Bypass Using an Alternate Path or ChannelAn authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1… | ExploitedFix |
| CVE-2022-48503 | 14 Aug 2023 | CVSS 8.8 | Apple Multiple Products UnspecifiedThe issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5… | Exploited |
| CVE-2025-54253 | 5 Aug 2025 | CVSS 10.0 | Adobe Experience Manager Forms Code ExecutionAdobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution… | Exploited |
| CVE-2025-59230 | 14 Oct 2025 | CVSS 7.8 | Microsoft Windows Improper Access ControlImproper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | Exploited |
| CVE-2025-47827 | 5 Jun 2025 | CVSS 4.6 | IGEL OS Use of a Key Past its Expiration DateIn IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a… | Exploited |
| CVE-2025-24990 | 14 Oct 2025 | CVSS 7.8 | Microsoft Windows Untrusted Pointer DereferenceMicrosoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an… | Exploited |
| CVE-2016-7836 | 9 Jun 2017 | CVSS 9.8 | SKYSEA Client View Improper AuthenticationSKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the… | Exploited |
| CVE-2021-43798 | 7 Dec 2021 | CVSS 7.5 | Grafana Path TraversalGrafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss… | ExploitedFix |
| CVE-2025-27915 | 12 Mar 2025 | CVSS 5.4 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site ScriptingAn issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic… | Exploited |
| CVE-2025-61882 | 5 Oct 2025 | CVSS 9.8 | Oracle E-Business Suite UnspecifiedVulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that… | Exploited |
| CVE-2021-43226 | 15 Dec 2021 | CVSS 7.8 | Microsoft Windows Privilege EscalationWindows Common Log File System Driver Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2021-22555 | 7 Jul 2021 | CVSS 7.8 | Linux Kernel Heap Out-of-Bounds WriteA heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges… | ExploitedFix |
| CVE-2013-3918 | 12 Nov 2013 | CVSS 8.8 | Microsoft Windows Out-of-Bounds WriteThe InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2… | ExploitedFix |
| CVE-2011-3402 | 4 Nov 2011 | CVSS 8.8 | Microsoft Windows Remote Code ExecutionUnspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows… | Exploited |
| CVE-2010-3962 | 5 Nov 2010 | CVSS 8.1 | Microsoft Internet Explorer Uninitialized Memory CorruptionUse-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to… | ExploitedFix |
| CVE-2010-3765 | 28 Oct 2010 | CVSS 9.8 | Mozilla Multiple Products Remote Code ExecutionMozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before… | Exploited |
| CVE-2025-4008 | 21 May 2025 | CVSS 8.8 | Smartbedded Meteobridge Command InjectionThe Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system… | Exploited |
| CVE-2025-21043 | 12 Sep 2025 | CVSS 9.8 | Samsung Mobile Devices Out-of-Bounds WriteOut-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. | Exploited |
| CVE-2017-1000353 | 29 Jan 2018 | CVSS 9.8 | Jenkins Remote Code ExecutionJenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated… | ExploitedFix |
| CVE-2015-7755 | 19 Dec 2015 | CVSS 9.8 | Juniper ScreenOS Improper AuthenticationJuniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before… | Exploited |
| CVE-2014-6278 | 30 Sep 2014 | CVSS 8.8 | GNU Bash OS Command InjectionGNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to… | ExploitedFix |
| CVE-2025-59689 | 19 Sep 2025 | CVSS 6.1 | Libraesva Email Security Gateway Command InjectionLibraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in… | Exploited |
| CVE-2025-32463 | 30 Jun 2025 | CVSS 7.8 | Sudo Inclusion of Functionality from Untrusted Control SphereSudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot… | Exploited |
| CVE-2025-20352 | 24 Sep 2025 | CVSS 7.7 | Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code ExecutionA vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following… | Exploited |
| CVE-2025-10035 | 18 Sep 2025 | CVSS 9.8 | Fortra GoAnywhere MFT Deserialization of Untrusted DataA deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to… | Exploited |
| CVE-2021-21311 | 11 Feb 2021 | CVSS 7.2 | Adminer Server-Side Request ForgeryAdminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request… | ExploitedFix |
| CVE-2025-20362 | 25 Sep 2025 | CVSS 8.6 | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing AuthorizationUpdate: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD… | Exploited |
| CVE-2025-20333 | 25 Sep 2025 | CVSS 9.9 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer OverflowA vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense… | Exploited |
| CVE-2025-10585 | 24 Sep 2025 | CVSS 9.8 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Exploited |
| CVE-2025-5086 | 2 Jun 2025 | CVSS 9.0 | Dassault Systèmes DELMIA Apriso Deserialization of Untrusted DataA deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code… | Exploited |
| CVE-2025-53690 | 3 Sep 2025 | CVSS 9.0 | Sitecore Multiple Products Deserialization of Untrusted DataDeserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This… | Exploited |
| CVE-2025-48543 | 4 Sep 2025 | CVSS 8.8 | Android Runtime Use-After-FreeIn multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to… | ExploitedFix |
| CVE-2025-38352 | 22 Jul 2025 | CVSS 7.8 | Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race ConditionIn the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and… | ExploitedFix |
| CVE-2025-9377 | 29 Aug 2025 | CVSS 7.2 | TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command InjectionThe authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS)… | Exploited |
| CVE-2023-50224 | 3 May 2024 | CVSS 6.5 | TP-Link TL-WR841N Authentication Bypass by SpoofingTP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to… | Exploited |
| CVE-2025-55177 | 29 Aug 2025 | CVSS 5.4 | Meta Platforms WhatsApp Incorrect AuthorizationIncomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78… | Exploited |
| CVE-2020-24363 | 31 Aug 2020 | CVSS 8.8 | TP-link TL-WA855RE Missing Authentication for Critical FunctionTP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a… | Exploited |
| CVE-2025-57819 | 28 Aug 2025 | CVSS 9.8 | Sangoma FreePBX Authentication BypassFreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized… | Exploited |
| CVE-2025-7775 | 26 Aug 2025 | CVSS 9.8 | Citrix NetScaler Memory OverflowMemory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is… | Exploited |
| CVE-2025-48384 | 8 Jul 2025 | CVSS 8.0 | Git Link FollowingGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full… | Exploited |
| CVE-2024-8069 | 12 Nov 2024 | CVSS 8.0 | Citrix Session Recording Deserialization of Untrusted DataLimited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user… | Exploited |
| CVE-2024-8068 | 12 Nov 2024 | CVSS 8.0 | Citrix Session Recording Improper Privilege ManagementPrivilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows… | Exploited |
| CVE-2025-43300 | 21 Aug 2025 | CVSS 10.0 | Apple iOS, iPadOS, and macOS Out-of-Bounds WriteAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS… | Exploited |
| CVE-2025-54948 | 5 Aug 2025 | CVSS 9.8 | Trend Micro Apex One OS Command InjectionA vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and… | ExploitedFix |
| CVE-2025-8876 | 14 Aug 2025 | CVSS 8.8 | N-able N-Central Command InjectionImproper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1. | Exploited |
| CVE-2025-8875 | 14 Aug 2025 | CVSS 7.8 | N-able N-Central Insecure DeserializationDeserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1. | Exploited |
| CVE-2025-8088 | 8 Aug 2025 | CVSS 8.8 | RARLAB WinRAR Path TraversalA path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive… | Exploited |
| CVE-2013-3893 | 18 Sep 2013 | CVSS 8.8 | Microsoft Internet Explorer Resource Management ErrorsUse-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers… | Exploited |
| CVE-2007-0671 | 3 Feb 2007 | CVSS 8.8 | Microsoft Office Excel Remote Code ExecutionUnspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted… | Exploited |
| CVE-2022-40799 | 29 Nov 2022 | CVSS 8.8 | D-Link DNR-322L Download of Code Without Integrity CheckData Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device. | Exploited |
| CVE-2020-25079 | 2 Sep 2020 | CVSS 8.8 | D-Link DCS-2530L and DCS-2670L Command InjectionAn issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated… | ExploitedFix |
| CVE-2020-25078 | 2 Sep 2020 | CVSS 7.5 | D-Link DCS-2530L and DCS-2670L Devices UnspecifiedAn issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint… | ExploitedFix |
| CVE-2025-20337 | 16 Jul 2025 | CVSS 10.0 | Cisco Identity Services Engine InjectionA vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the… | Exploited |
| CVE-2025-20281 | 25 Jun 2025 | CVSS 10.0 | Cisco Identity Services Engine InjectionA vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the… | Exploited |
| CVE-2023-2533 | 20 Jun 2023 | CVSS 8.8 | PaperCut NG/MF Cross-Site Request Forgery (CSRF)A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable… | Exploited |
| CVE-2025-6558 | 15 Jul 2025 | CVSS 8.8 | Google Chromium ANGLE and GPU Improper Input ValidationInsufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform… | Exploited |
| CVE-2025-54309 | 18 Jul 2025 | CVSS 9.8 | CrushFTP Unprotected Alternate ChannelCrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote… | Exploited |
| CVE-2025-49706 | 8 Jul 2025 | CVSS 6.5 | Microsoft SharePoint Improper AuthenticationImproper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | Exploited |
| CVE-2025-49704 | 8 Jul 2025 | CVSS 8.8 | Microsoft SharePoint Code InjectionImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Exploited |
| CVE-2025-2776 | 7 May 2025 | CVSS 9.8 | SysAid On-Prem Improper Restriction of XML External Entity ReferenceSysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing… | Exploited |
| CVE-2025-2775 | 7 May 2025 | CVSS 7.5 | SysAid On-Prem Improper Restriction of XML External Entity ReferenceSysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing… | Exploited |
| CVE-2025-53770 | 20 Jul 2025 | CVSS 9.8 | Microsoft SharePoint Deserialization of Untrusted DataDeserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network… | Exploited |
| CVE-2025-25257 | 17 Jul 2025 | CVSS 9.8 | Fortinet FortiWeb SQL InjectionAn improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb… | Exploited |
| CVE-2025-47812 | 10 Jul 2025 | CVSS 10.0 | Wing FTP Server Improper Neutralization of Null Byte or NUL CharacterIn Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into… | Exploited |
| CVE-2025-5777 | 17 Jun 2025 | CVSS 7.5 | Citrix NetScaler ADC and Gateway Out-of-Bounds ReadInsufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP… | Exploited |
| CVE-2019-9621 | 30 Apr 2019 | CVSS 7.5 | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF)Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows… | Exploited |
| CVE-2019-5418 | 27 Mar 2019 | CVSS 7.5 | Rails Ruby on Rails Path TraversalThere is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers… | ExploitedFix |
| CVE-2016-10033 | 30 Dec 2016 | CVSS 9.8 | PHPMailer Command InjectionThe mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command… | ExploitedFix |
| CVE-2014-3931 | 31 Mar 2017 | CVSS 9.8 | Multi-Router Looking Glass (MRLG) Buffer Overflowfastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption. | Exploited |
| CVE-2025-6554 | 30 Jun 2025 | CVSS 8.1 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page… | Exploited |
| CVE-2025-48928 | 28 May 2025 | CVSS 4.0 | TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control SphereThe TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a… | Exploited |
| CVE-2025-48927 | 28 May 2025 | CVSS 5.3 | TeleMessage TM SGNL Initialization of a Resource with an Insecure DefaultThe TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the… | Exploited |
| CVE-2025-6543 | 25 Jun 2025 | CVSS 9.8 | Citrix NetScaler ADC and Gateway Buffer OverflowMemory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as… | Exploited |
| CVE-2024-54085 | 11 Mar 2025 | CVSS 9.8 | AMI MegaRAC SPx Authentication Bypass by SpoofingAMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful… | Exploited |
| CVE-2024-0769 | 21 Jan 2024 | CVSS 9.8 | D-Link DIR-859 Router Path Traversal** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some… | Exploited |
| CVE-2019-6693 | 21 Nov 2019 | CVSS 6.5 | Fortinet FortiOS Use of Hard-Coded CredentialsUse of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup… | Exploited |
| CVE-2023-0386 | 22 Mar 2023 | CVSS 7.8 | Linux Kernel Improper Ownership ManagementA flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s… | ExploitedFix |
| CVE-2025-43200 | 16 Jun 2025 | CVSS 4.2 | Apple Multiple Products UnspecifiedThis issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and… | Exploited |
| CVE-2023-33538 | 7 Jun 2023 | CVSS 8.8 | TP-Link Multiple Routers Command InjectionTP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component… | Exploited |
| CVE-2025-33053 | 10 Jun 2025 | CVSS 8.8 | Microsoft Windows External Control of File Name or PathExternal control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. | Exploited |
| CVE-2025-24016 | 10 Feb 2025 | CVSS 9.9 | Wazuh Server Deserialization of Untrusted DataWazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1… | Exploited |
| CVE-2025-32433 | 16 Apr 2025 | CVSS 10.0 | Erlang Erlang/OTP SSH Server Missing Authentication for Critical FunctionErlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server… | ExploitedFix |
| CVE-2024-42009 | 5 Aug 2024 | CVSS 9.3 | RoundCube Webmail Cross-Site ScriptingA Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim… | Exploited |
| CVE-2025-5419 | 3 Jun 2025 | CVSS 8.8 | Google Chromium V8 Out-of-Bounds Read and WriteOut of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a… | Exploited |
| CVE-2025-27038 | 3 Jun 2025 | CVSS 7.5 | Qualcomm Multiple Chipsets Use-After-FreeMemory corruption while rendering graphics using Adreno GPU drivers in Chrome. | Exploited |
| CVE-2025-21480 | 3 Jun 2025 | CVSS 8.6 | Qualcomm Multiple Chipsets Incorrect AuthorizationMemory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. | Exploited |
| CVE-2025-21479 | 3 Jun 2025 | CVSS 8.6 | Qualcomm Multiple Chipsets Incorrect AuthorizationMemory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. | Exploited |
| CVE-2025-3935 | 25 Apr 2025 | CVSS 7.2 | ConnectWise ScreenConnect Improper AuthenticationScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to… | Exploited |
| CVE-2025-35939 | 7 May 2025 | CVSS 5.3 | Craft CMS External Control of Assumed-Immutable Web ParameterCraft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an… | ExploitedFix |
Page 4 of 18