CVERadar

Updated Sun, 25 Oct 2026 04:32:13 GMT

Exploited CVEs, on radar.

Exploited vulnerabilities, mapped to MITRE ATT&CK, with fixes you can act on. Every post shows the attack chain on a playable MITRE ATT&CK board, plus the patch and the vendor advisory.

1724CVEs tracked
664Known exploited
179CTID ATT&CK-mapped
Play the #1 threatHow we rank
CVE radar storyboardTop CVEs shown as blips: first on the radar, then grouped by ransomware use, known exploitation and EPSS, then shown resolved with a fix.RansomwareKEV + EPSS 50%+KEVWatchResolved: patched or mitigatedCVE-2025-53770: Microsoft SharePointCVE-2021-26086: Atlassian Jira Server and Data CenterCVE-2024-7593: Ivanti Virtual Traffic ManagerCVE-2024-23897: Jenkins Jenkins Command Line Interface (CLI)CVE-2024-3400: Palo Alto Networks PAN-OSCVE-2024-21893: Ivanti Connect Secure, Policy Secure, and NeuronsCVE-2023-35082: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron CoreCVE-2024-21887: Ivanti Connect Secure and Policy SecureCVE-2023-1671: Sophos Web ApplianceCVE-2023-22518: Atlassian Confluence Data Center and ServerCVE-2023-4966: Citrix NetScaler ADC and NetScaler GatewayCVE-2023-44487: IETF HTTP/2CVE-2023-32315: Ignite Realtime OpenfireCVE-2023-35078: Ivanti Endpoint Manager Mobile (EPMM)CVE-2023-1389: TP-Link Archer AX21CVE-2023-27350: PaperCut MF/NGCVE-2023-0669: Fortra GoAnywhere MFTCVE-2022-26134: Atlassian Confluence Server/Data CenterCVE-2014-0160: OpenSSL OpenSSLCVE-2022-29464: WSO2 Multiple ProductsCVE-2017-9841: PHPUnit PHPUnitCVE-2015-1635: Microsoft HTTP.sysCVE-2014-6271: GNU Bourne-Again Shell (Bash)CVE-2021-44228: Apache Log4j2CVE-2021-40438: Apache ApacheCVE-2017-5638: Apache StrutsCVE-2018-13379: Fortinet FortiOSCVE-2019-0708: Microsoft Remote Desktop ServicesCVE-2019-11510: Ivanti Pulse Connect SecureCVE-2019-19781: Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceCVE-2020-5902: F5 BIG-IPCVE-2021-1498: Cisco HyperFlex HXCVE-2021-21985: VMware vCenter ServerCVE-2021-22005: VMware vCenter ServerCVE-2021-26084: Atlassian Confluence Server and Data CenterCVE-2021-34473: Microsoft Exchange ServerCVE-2021-35464: ForgeRock Access Management (AM)CVE-2017-7921: Hikvision Multiple ProductsCVE-2022-22954: VMware Workspace ONE Access and Identity ManagerCVE-2012-1823: PHP PHPCVE-2013-2251: Apache StrutsCVE-2020-14882: Oracle WebLogic ServerCVE-2019-16920: D-Link Multiple RoutersCVE-2021-26855: Microsoft Exchange ServerCVE-2025-49704: Microsoft SharePointCVE-2024-3273: D-Link Multiple NAS DevicesCVE-2022-44877: CWP Control Web PanelCVE-2024-34102: Adobe Commerce and Magento Open Source
  1. 1. Sweep New exploited vulnerabilities show up on the radar as they surface.
  2. 2. Triage Each blip is weighed by how much it matters to defenders.
  3. 3. Resolve Each CVE gets the fix, the vendor advisory and the ATT&CK path, so it ends patched or mitigated.

Latest posts

CRITICAL 9.4
ATT&CK inferred
CVE-2026-115995

CVE-2026-115995: A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4.…

Unknown · · EPSS n/a · Threat 47
CRITICAL 9.8
ATT&CK inferred
CVE-2026-115806

CVE-2026-115806: The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object In…

Unknown · · EPSS 0.82% · Threat 49
CRITICAL 10
ATT&CK inferred
CVE-2026-97785

CVE-2026-97785: Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privil…

Unknown · · EPSS 0.60% · Threat 50
CRITICAL 10
ATT&CK inferred
CVE-2026-83938

CVE-2026-83938: Missing authentication for critical function in Azure Kubernetes Configuration Service all…

Unknown · · EPSS 0.67% · Threat 50
CRITICAL 9.4
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-114625

Arista VeloCloud Orchestrator SQL Injection Vulnerability

Arista · VeloCloud Orchestrator · EPSS 0.81% · Threat 62
CRITICAL 9.4
ATT&CK inferred
CVE-2026-115384

CVE-2026-115384: Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vu…

Unknown · · EPSS 0.31% · Threat 47

Search the radar

1724 of 1724 CVEs

CRITICAL 9.2
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-110447

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Collabora · Collabora Online – Built-in CODE Server · EPSS 2.28% · Threat 62
CRITICAL 9.8
ATT&CK inferred
CVE-2026-115806

CVE-2026-115806: The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object In…

Unknown · · EPSS 0.82% · Threat 49
CRITICAL 9.4
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-114625

Arista VeloCloud Orchestrator SQL Injection Vulnerability

Arista · VeloCloud Orchestrator · EPSS 0.81% · Threat 62
HIGH 8.8
ATT&CK inferred
CVE-2022-51022

CVE-2022-51022: YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path trav…

Unknown · · EPSS 0.79% · Threat 44
CRITICAL 10
ATT&CK inferred
CVE-2026-83938

CVE-2026-83938: Missing authentication for critical function in Azure Kubernetes Configuration Service all…

Unknown · · EPSS 0.67% · Threat 50
CRITICAL 9.3
ATT&CK inferred
CVE-2022-51026

CVE-2022-51026: Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows u…

Unknown · · EPSS 0.61% · Threat 47
CRITICAL 10
ATT&CK inferred
CVE-2026-97785

CVE-2026-97785: Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privil…

Unknown · · EPSS 0.60% · Threat 50
CRITICAL 9.3
ATT&CK inferred
CVE-2021-48016

CVE-2021-48016: DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where …

Unknown · · EPSS 0.44% · Threat 47
CRITICAL 9.4
ATT&CK inferred
CVE-2026-115375

CVE-2026-115375: Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability th…

Unknown · · EPSS 0.40% · Threat 47
CRITICAL 9.4
ATT&CK inferred
CVE-2026-115377

CVE-2026-115377: Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file …

Unknown · · EPSS 0.40% · Threat 47
CRITICAL 9.4
ATT&CK inferred
CVE-2026-115384

CVE-2026-115384: Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vu…

Unknown · · EPSS 0.31% · Threat 47
CRITICAL 9.4
ATT&CK inferred
CVE-2026-115995

CVE-2026-115995: A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4.…

Unknown · · EPSS n/a · Threat 47
CRITICAL 9.3
ATT&CK inferred
CVE-2026-114575

CVE-2026-114575: A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is…

Unknown · · EPSS 2.21% · Threat 47
CRITICAL 9.2
Public PoCATT&CK inferred
CVE-2026-111497

CVE-2026-111497: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli ve…

Unknown · · EPSS 0.71% · Threat 50
CRITICAL 10
Public PoCATT&CK inferred
CVE-2026-110264

CVE-2026-110264: An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.…

Unknown · · EPSS 0.51% · Threat 54
CRITICAL 9.1
Public PoCATT&CK inferred
CVE-2026-91403

CVE-2026-91403: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi…

Unknown · · EPSS 0.37% · Threat 50
CRITICAL 9.3
ATT&CK inferred
CVE-2026-114220

CVE-2026-114220: NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerabil…

Unknown · · EPSS 0.16% · Threat 47
CRITICAL 9.8RansomwareTop #1
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2025-53770

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft · SharePoint · EPSS 100.00% · Threat 99
MEDIUM 5.3Top #2
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2021-26086

Atlassian Jira Server and Data Center Path Traversal Vulnerability

Atlassian · Jira Server and Data Center · EPSS 100.00% · Threat 71
CRITICAL 9.8Top #3
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-7593

Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

Ivanti · Virtual Traffic Manager · EPSS 100.00% · Threat 94
CRITICAL 9.8RansomwareTop #4
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-23897

Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Jenkins · Jenkins Command Line Interface (CLI) · EPSS 100.00% · Threat 99
CRITICAL 10RansomwareTop #5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-3400

Palo Alto Networks PAN-OS Command Injection Vulnerability

Palo Alto Networks · PAN-OS · EPSS 100.00% · Threat 100
HIGH 8.2RansomwareTop #6
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-21893

Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

Ivanti · Connect Secure, Policy Secure, and Neurons · EPSS 100.00% · Threat 91
CRITICAL 9.8RansomwareTop #7
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2023-35082

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) and MobileIron Core · EPSS 100.00% · Threat 99
CRITICAL 9.1RansomwareTop #8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-21887

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Ivanti · Connect Secure and Policy Secure · EPSS 100.00% · Threat 95
CRITICAL 9.8Top #9
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2023-1671

Sophos Web Appliance Command Injection Vulnerability

Sophos · Web Appliance · EPSS 100.00% · Threat 94
CRITICAL 9.8RansomwareTop #10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-22518

Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

Atlassian · Confluence Data Center and Server · EPSS 100.00% · Threat 99
HIGH 7.5RansomwareTop #11
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-4966

Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

Citrix · NetScaler ADC and NetScaler Gateway · EPSS 100.00% · Threat 87
HIGH 7.5Top #12
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2023-44487

HTTP/2 Rapid Reset Attack Vulnerability

IETF · HTTP/2 · EPSS 100.00% · Threat 82
HIGH 7.5Top #13
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-32315

Ignite Realtime Openfire Path Traversal Vulnerability

Ignite Realtime · Openfire · EPSS 100.00% · Threat 82
CRITICAL 9.8RansomwareTop #14
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2023-35078

Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) · EPSS 100.00% · Threat 99
HIGH 8.8Top #15
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2023-1389

TP-Link Archer AX-21 Command Injection Vulnerability

TP-Link · Archer AX21 · EPSS 100.00% · Threat 89
CRITICAL 9.8RansomwareTop #16
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2023-27350

PaperCut MF/NG Improper Access Control Vulnerability

PaperCut · MF/NG · EPSS 100.00% · Threat 99
HIGH 7.2RansomwareTop #17
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2023-0669

Fortra GoAnywhere MFT Remote Code Execution Vulnerability

Fortra · GoAnywhere MFT · EPSS 100.00% · Threat 86
CRITICAL 9.8RansomwareTop #18
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2022-26134

Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

Atlassian · Confluence Server/Data Center · EPSS 100.00% · Threat 99
HIGH 7.5Top #19
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2014-0160

OpenSSL Information Disclosure Vulnerability

OpenSSL · OpenSSL · EPSS 100.00% · Threat 82
CRITICAL 9.8RansomwareTop #20
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2022-29464

WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

WSO2 · Multiple Products · EPSS 100.00% · Threat 99
CRITICAL 9.8Top #21
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2017-9841

PHPUnit Command Injection Vulnerability

PHPUnit · PHPUnit · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #22
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2015-1635

Microsoft HTTP.sys Remote Code Execution Vulnerability

Microsoft · HTTP.sys · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #23
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2014-6271

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

GNU · Bourne-Again Shell (Bash) · EPSS 100.00% · Threat 94
CRITICAL 10RansomwareTop #24
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-44228

Apache Log4j2 Remote Code Execution Vulnerability

Apache · Log4j2 · EPSS 100.00% · Threat 100
CRITICAL 9RansomwareTop #25
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2021-40438

Apache HTTP Server-Side Request Forgery (SSRF)

Apache · Apache · EPSS 100.00% · Threat 95
CRITICAL 9.8RansomwareTop #26
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2017-5638

Apache Struts Remote Code Execution Vulnerability

Apache · Struts · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #27
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-13379

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

Fortinet · FortiOS · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #28
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2019-0708

Microsoft Remote Desktop Services Remote Code Execution Vulnerability

Microsoft · Remote Desktop Services · EPSS 100.00% · Threat 99
CRITICAL 10RansomwareTop #29
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2019-11510

Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

Ivanti · Pulse Connect Secure · EPSS 100.00% · Threat 100
CRITICAL 9.8RansomwareTop #30
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2019-19781

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #31
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2020-5902

F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

F5 · BIG-IP · EPSS 100.00% · Threat 99
CRITICAL 9.8Top #32
Exploited in the wild · CISA KEVMetasploit moduleCTID-mapped
CVE-2021-1498

Cisco HyperFlex HX Data Platform Command Injection Vulnerability

Cisco · HyperFlex HX · EPSS 100.00% · Threat 94
CRITICAL 9.8RansomwareTop #33
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2021-21985

VMware vCenter Server Improper Input Validation Vulnerability

VMware · vCenter Server · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #34
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2021-22005

VMware vCenter Server File Upload Vulnerability

VMware · vCenter Server · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #35
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-26084

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Atlassian · Confluence Server and Data Center · EPSS 100.00% · Threat 99
CRITICAL 9.1RansomwareTop #36
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2021-34473

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · EPSS 100.00% · Threat 95
CRITICAL 9.8RansomwareTop #37
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-35464

ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

ForgeRock · Access Management (AM) · EPSS 100.00% · Threat 99
CRITICAL 9.8Top #38
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2017-7921

Hikvision Multiple Products Improper Authentication Vulnerability

Hikvision · Multiple Products · EPSS 100.00% · Threat 94
CRITICAL 9.8RansomwareTop #39
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2022-22954

VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

VMware · Workspace ONE Access and Identity Manager · EPSS 100.00% · Threat 99
CRITICAL 9.8Top #40
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2012-1823

PHP-CGI Query String Parameter Vulnerability

PHP · PHP · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #41
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2013-2251

Apache Struts Improper Input Validation Vulnerability

Apache · Struts · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #42
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2020-14882

Oracle WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #43
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2019-16920

D-Link Multiple Routers Command Injection Vulnerability

D-Link · Multiple Routers · EPSS 100.00% · Threat 94
CRITICAL 9.1RansomwareTop #44
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-26855

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · EPSS 100.00% · Threat 95
HIGH 8.8RansomwareTop #45
Exploited in the wild · CISA KEVMetasploit moduleCTID-mapped
CVE-2025-49704

Microsoft SharePoint Code Injection Vulnerability

Microsoft · SharePoint · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #46
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-3273

D-Link Multiple NAS Devices Command Injection Vulnerability

D-Link · Multiple NAS Devices · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #47
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2022-44877

CWP Control Web Panel OS Command Injection Vulnerability

CWP · Control Web Panel · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #48
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-34102

Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

Adobe · Commerce and Magento Open Source · EPSS 99.99% · Threat 94
HIGH 7.5RansomwareTop #49
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-10271

Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server · EPSS 99.99% · Threat 87
HIGH 8.1Top #50
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-11776

Apache Struts Remote Code Execution Vulnerability

Apache · Struts · EPSS 99.99% · Threat 85
CRITICAL 9.8RansomwareTop #51
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2025-3248

Langflow Missing Authentication Vulnerability

Langflow · Langflow · EPSS 99.99% · Threat 99
HIGH 7.5Top #52
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-13159

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti · Endpoint Manager (EPM) · EPSS 99.99% · Threat 82
CRITICAL 9.8Top #53
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2020-8515

Multiple DrayTek Vigor Routers Web Management Page Vulnerability

DrayTek · Multiple Vigor Routers · EPSS 99.99% · Threat 94
HIGH 7.5Top #54
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2020-3452

Cisco ASA and FTD Read-Only Path Traversal Vulnerability

Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) · EPSS 99.99% · Threat 82
CRITICAL 9.8RansomwareTop #55
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-41773

Apache HTTP Server Path Traversal Vulnerability

Apache · HTTP Server · EPSS 99.99% · Threat 99
HIGH 7.3RansomwareTop #56
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-27199

JetBrains TeamCity Relative Path Traversal Vulnerability

JetBrains · TeamCity · EPSS 99.99% · Threat 86
CRITICAL 9.8RansomwareTop #57
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-29300

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe · ColdFusion · EPSS 99.99% · Threat 99
CRITICAL 9.8RansomwareTop #58
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-7600

Drupal Core Remote Code Execution Vulnerability

Drupal · Drupal Core · EPSS 99.99% · Threat 99
CRITICAL 9RansomwareTop #59
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2021-34523

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft · Exchange Server · EPSS 99.99% · Threat 95
CRITICAL 9.8Top #60
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2021-33044

Dahua IP Camera Authentication Bypass Vulnerability

Dahua · IP Camera Firmware · EPSS 99.99% · Threat 94
CRITICAL 9.8Top #61
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2020-9054

Zyxel Multiple NAS Devices OS Command Injection Vulnerability

Zyxel · Multiple Network-Attached Storage (NAS) Devices · EPSS 99.99% · Threat 94
CRITICAL 9.8RansomwareTop #62
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2024-4577

PHP-CGI OS Command Injection Vulnerability

PHP Group · PHP · EPSS 99.99% · Threat 99
CRITICAL 9.8RansomwareTop #63
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2023-42793

JetBrains TeamCity Authentication Bypass Vulnerability

JetBrains · TeamCity · EPSS 99.99% · Threat 99
HIGH 8.2RansomwareTop #64
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-46805

Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

Ivanti · Connect Secure and Policy Secure · EPSS 99.99% · Threat 91
CRITICAL 9.8Top #65
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-9670

Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 99.99% · Threat 94
CRITICAL 9.8RansomwareTop #66
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-22527

Atlassian Confluence Data Center and Server Template Injection Vulnerability

Atlassian · Confluence Data Center and Server · EPSS 99.98% · Threat 99
CRITICAL 9.8RansomwareTop #67
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2023-29357

Microsoft SharePoint Server Privilege Escalation Vulnerability

Microsoft · SharePoint Server · EPSS 99.98% · Threat 99
CRITICAL 9.8RansomwareTop #68
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2022-40684

Fortinet Multiple Products Authentication Bypass Vulnerability

Fortinet · Multiple Products · EPSS 99.98% · Threat 99
HIGH 7.5Top #69
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-45195

Apache OFBiz Forced Browsing Vulnerability

Apache · OFBiz · EPSS 99.98% · Threat 82
CRITICAL 9.8Top #70
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2021-20090

Arcadyan Buffalo Firmware Path Traversal Vulnerability

Arcadyan · Buffalo Firmware · EPSS 99.98% · Threat 94
CRITICAL 9.8RansomwareTop #71
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2025-22457

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Ivanti · Connect Secure, Policy Secure, and ZTA Gateways · EPSS 99.98% · Threat 99
CRITICAL 9RansomwareTop #72
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-0282

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Ivanti · Connect Secure, Policy Secure, and ZTA Gateways · EPSS 99.98% · Threat 95
HIGH 7.8Top #73
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-22204

ExifTool Remote Code Execution Vulnerability

Perl · Exiftool · EPSS 99.98% · Threat 84
CRITICAL 9.8Top #74
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-59287

Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Microsoft · Windows · EPSS 99.98% · Threat 94
CRITICAL 10RansomwareTop #75
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-1709

ConnectWise ScreenConnect Authentication Bypass Vulnerability

ConnectWise · ScreenConnect · EPSS 99.98% · Threat 100
HIGH 8.8Top #76
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2023-4863

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Google · Chromium WebP · EPSS 99.98% · Threat 89
HIGH 8.6RansomwareTop #77
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-24919

Check Point Quantum Security Gateways Information Disclosure Vulnerability

Check Point · Quantum Security Gateways · EPSS 99.98% · Threat 93
CRITICAL 9RansomwareTop #78
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2021-45046

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

Apache · Log4j2 · EPSS 99.98% · Threat 95
CRITICAL 9.8RansomwareTop #79
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-2725

Oracle WebLogic Server, Injection

Oracle · WebLogic Server · EPSS 99.98% · Threat 99
CRITICAL 9.3Top #80
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2024-4879

ServiceNow Improper Input Validation Vulnerability

ServiceNow · Utah, Vancouver, and Washington DC Now Platform · EPSS 99.98% · Threat 91
HIGH 8.8RansomwareTop #81
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2012-0158

Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

Microsoft · MSCOMCTL.OCX · EPSS 99.98% · Threat 94
CRITICAL 9.3RansomwareTop #82
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-5777

Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

Citrix · NetScaler ADC and Gateway · EPSS 99.97% · Threat 96
CRITICAL 9.8Top #83
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2014-8361

Realtek SDK Improper Input Validation Vulnerability

Realtek · SDK · EPSS 99.97% · Threat 94
HIGH 8RansomwareTop #84
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2022-41082

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · EPSS 99.97% · Threat 90
HIGH 8.1Top #85
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-12617

Apache Tomcat Remote Code Execution Vulnerability

Apache · Tomcat · EPSS 99.97% · Threat 85
CRITICAL 9.8Top #86
Exploited in the wild · CISA KEVCTID-mapped
CVE-2020-25506

D-Link DNS-320 Device Command Injection Vulnerability

D-Link · DNS-320 Device · EPSS 99.97% · Threat 94
CRITICAL 9.8RansomwareTop #87
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-31161

CrushFTP Authentication Bypass Vulnerability

CrushFTP · CrushFTP · EPSS 99.97% · Threat 99
CRITICAL 9.8RansomwareTop #88
Exploited in the wild · CISA KEVExploit-DBATT&CK inferred
CVE-2022-47986

IBM Aspera Faspex Code Execution Vulnerability

IBM · Aspera Faspex · EPSS 99.97% · Threat 99
CRITICAL 9.8RansomwareTop #89
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-42013

Apache HTTP Server Path Traversal Vulnerability

Apache · HTTP Server · EPSS 99.96% · Threat 99
HIGH 7.8Top #90
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-3156

Sudo Heap-Based Buffer Overflow Vulnerability

Sudo · Sudo · EPSS 99.96% · Threat 84
HIGH 8.8RansomwareTop #91
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2020-0688

Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

Microsoft · Exchange Server · EPSS 99.96% · Threat 94
CRITICAL 9.8Top #92
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-10149

Exim Mail Transfer Agent (MTA) Improper Input Validation

Exim · Mail Transfer Agent (MTA) · EPSS 99.96% · Threat 94
CRITICAL 9.8Top #93
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2018-2628

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server · EPSS 99.96% · Threat 94
CRITICAL 9.1Top #94
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-38475

Apache HTTP Server Improper Escaping of Output Vulnerability

Apache · HTTP Server · EPSS 99.96% · Threat 90
HIGH 8.8RansomwareTop #95
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2022-41040

Microsoft Exchange Server Server-Side Request Forgery Vulnerability

Microsoft · Exchange Server · EPSS 99.96% · Threat 94
CRITICAL 9.8RansomwareTop #96
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2022-1388

F5 BIG-IP Missing Authentication Vulnerability

F5 · BIG-IP · EPSS 99.95% · Threat 99
CRITICAL 9.8RansomwareTop #97
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-38035

Ivanti Sentry Authentication Bypass Vulnerability

Ivanti · Sentry · EPSS 99.95% · Threat 99
CRITICAL 9.8Top #98
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-15961

Adobe ColdFusion Unrestricted File Upload Vulnerability

Adobe · ColdFusion · EPSS 99.95% · Threat 94
CRITICAL 9.8RansomwareTop #99
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2018-10562

Dasan GPON Routers Command Injection Vulnerability

Dasan · Gigabit Passive Optical Network (GPON) Routers · EPSS 99.95% · Threat 99
HIGH 7.8RansomwareTop #100
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2017-11882

Microsoft Office Memory Corruption Vulnerability

Microsoft · Office · EPSS 99.94% · Threat 89
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2015-3306

ProFTPD Improper Access Control Vulnerability

ProFTPD · ProFTPD · EPSS 99.50% · Threat 95
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2015-5477

ISC BIND Data Processing Errors Vulnerability

ISC · BIND · EPSS 99.41% · Threat 82
HIGH 8.1
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2016-3081

Apache Struts Command Injection Vulnerability

Apache · Struts · EPSS 96.05% · Threat 84

Showing the first 120. Narrow the filters to see more.