- 1. Sweep New exploited vulnerabilities show up on the radar as they surface.
- 2. Triage Each blip is weighed by how much it matters to defenders.
- 3. Resolve Each CVE gets the fix, the vendor advisory and the ATT&CK path, so it ends patched or mitigated.
Updated Tue, 10 Nov 2026 13:30:02 GMT
Exploited CVEs, on radar.
News on newly exploited vulnerabilities: what happened, who is affected and whether attackers are using it. Every record shows the exploitation evidence, the attack chain on a playable MITRE ATT&CK board and the vendor advisory.
1922CVEs tracked
682Known exploited
179CTID ATT&CK-mapped
Newly exploited
All recent CISA KEV additions →- Added CVE-2026-102895GPUStackCRITICAL 9.8
- Added CVE-2026-116779SignalWire FreeSwitchCRITICAL 9.8
- Added CVE-2026-123218IBM Aspera FaspexCRITICAL 9.8
- Added CVE-2026-123158sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workar…HIGH 8.1
- Added CVE-2026-19868SonicWall SonicOS SSLVPNHIGH 7.5
- Added CVE-2024-27834Apple Multiple ProductsMEDIUM 5.5
Latest posts
- MEDIUM 6.4ATT&CK inferredCVE-2026-60043
CVE-2026-60043: An unauthenticated remote attacker can perform a XSS attack on a logged in backend user al…
Unknown · · EPSS n/a · Threat 32 - CRITICAL 10ATT&CK inferredCVE-2026-89126
CVE-2026-89126: SAP Web Dispatcher does not sufficiently validate certain network input processed by an in…
Unknown · · EPSS n/a · Threat 50 - CRITICAL 9.6ATT&CK inferredCVE-2026-89119
CVE-2026-89119: SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manag…
Unknown · · EPSS n/a · Threat 48 - CRITICAL 10ATT&CK inferredCVE-2026-89103
CVE-2026-89103: SAP Gateway activates the default Access Control List with high privileges allowing catego…
Unknown · · EPSS n/a · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-76965
CVE-2026-76965: SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authori…
Unknown · · EPSS n/a · Threat 50 - CRITICAL 10ATT&CK inferredCVE-2026-76964
CVE-2026-76964: SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input…
Unknown · · EPSS n/a · Threat 50
Search the radar
120 of 1922 CVEs
- HIGH 7.5Public PoCATT&CK inferredCVE-2026-58882
CVE-2026-58882: In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an i…
google · android · EPSS 0.35% · Threat 42 - CRITICAL 9.9ATT&CK inferredCVE-2026-109795
CVE-2026-109795: SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input v…
Unknown · · EPSS n/a · Threat 50 - CRITICAL 9.1ATT&CK inferredCVE-2026-109798
CVE-2026-109798: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly re…
Unknown · · EPSS n/a · Threat 45 - CRITICAL 9.9ATT&CK inferredCVE-2026-109803
CVE-2026-109803: SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selectio…
Unknown · · EPSS n/a · Threat 50 - CRITICAL 10ATT&CK inferredCVE-2026-120017
CVE-2026-120017: SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incomi…
Unknown · · EPSS n/a · Threat 50 - CRITICAL 9.3ATT&CK inferredCVE-2026-125086
CVE-2026-125086: A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of …
Unknown · · EPSS n/a · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-125370
CVE-2026-125370: Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows una…
Unknown · · EPSS n/a · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-125383
CVE-2026-125383: INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contai…
Unknown · · EPSS n/a · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-125384
CVE-2026-125384: INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allow…
Unknown · · EPSS n/a · Threat 47 - MEDIUM 6.4ATT&CK inferredCVE-2026-60043
CVE-2026-60043: An unauthenticated remote attacker can perform a XSS attack on a logged in backend user al…
Unknown · · EPSS n/a · Threat 32 - CRITICAL 10ATT&CK inferredCVE-2026-76964
CVE-2026-76964: SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input…
Unknown · · EPSS n/a · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-76965
CVE-2026-76965: SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authori…
Unknown · · EPSS n/a · Threat 50 - CRITICAL 10ATT&CK inferredCVE-2026-89103
CVE-2026-89103: SAP Gateway activates the default Access Control List with high privileges allowing catego…
Unknown · · EPSS n/a · Threat 50 - CRITICAL 9.6ATT&CK inferredCVE-2026-89119
CVE-2026-89119: SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manag…
Unknown · · EPSS n/a · Threat 48 - CRITICAL 10ATT&CK inferredCVE-2026-89126
CVE-2026-89126: SAP Web Dispatcher does not sufficiently validate certain network input processed by an in…
Unknown · · EPSS n/a · Threat 50 - CRITICAL 9.3ATT&CK inferredCVE-2026-124580
CVE-2026-124580: A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202…
Unknown · · EPSS 2.79% · Threat 47 - HIGH 8.6ATT&CK inferredCVE-2026-124585
CVE-2026-124585: A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202…
Unknown · · EPSS 2.21% · Threat 44 - HIGH 8.9ATT&CK inferredCVE-2026-124577
CVE-2026-124577: A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected …
Unknown · · EPSS 2.07% · Threat 45 - CRITICAL 9.8Exploited in the wild · CISA KEVATT&CK inferredCVE-2026-116779
SignalWire FreeSwitch Code Injection Vulnerability
SignalWire · FreeSwitch · EPSS 1.30% · Threat 64 - HIGH 8.9ATT&CK inferredCVE-2026-124560
CVE-2026-124560: A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAs…
Unknown · · EPSS 0.72% · Threat 45 - CRITICAL 9.8Exploited in the wild · CISA KEVATT&CK inferredCVE-2026-102895
GPUStack Improper Authentication Vulnerability
GPUStack · GPUStack · EPSS 0.33% · Threat 64 - CRITICAL 9.3ATT&CK inferredCVE-2026-119756
CVE-2026-119756: Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulne…
Unknown · · EPSS n/a · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-124079
CVE-2026-124079: rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of…
Unknown · · EPSS n/a · Threat 47 - CRITICAL 9.8ATT&CK inferredCVE-2026-15266
CVE-2026-15266: IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command …
Unknown · · EPSS 0.88% · Threat 49 - CRITICAL 9.8ATT&CK inferredCVE-2026-6715
CVE-2026-6715: IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorp…
Unknown · · EPSS 0.86% · Threat 49 - CRITICAL 9.3ATT&CK inferredCVE-2026-123614
CVE-2026-123614: imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allo…
Unknown · · EPSS 0.66% · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-123550
CVE-2026-123550: OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 serv…
Unknown · · EPSS 0.56% · Threat 47 - CRITICAL 9.4ATT&CK inferredCVE-2026-124440
CVE-2026-124440: Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the ap…
Unknown · · EPSS 0.55% · Threat 47 - CRITICAL 9.9ATT&CK inferredCVE-2026-107331
CVE-2026-107331: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to…
Unknown · · EPSS 0.50% · Threat 50 - CRITICAL 9.3ATT&CK inferredCVE-2026-124450
CVE-2026-124450: OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in …
Unknown · · EPSS 0.49% · Threat 47 - HIGH 7.8Public PoCATT&CK inferredCVE-2026-50679
CVE-2026-50679: Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized atta…
microsoft · windows 11 24h2 · EPSS 0.46% · Threat 43 - CRITICAL 10ATT&CK inferredCVE-2026-123551
CVE-2026-123551: OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that all…
Unknown · · EPSS 0.43% · Threat 50 - CRITICAL 9.1ATT&CK inferredCVE-2026-101117
CVE-2026-101117: IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypas…
Unknown · · EPSS 0.40% · Threat 46 - CRITICAL 9.1ATT&CK inferredCVE-2026-17466
CVE-2026-17466: IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain se…
Unknown · · EPSS 0.37% · Threat 46 - CRITICAL 9.3ATT&CK inferredCVE-2026-124427
CVE-2026-124427: Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that all…
Unknown · · EPSS 0.37% · Threat 47 - CRITICAL 9.4ATT&CK inferredCVE-2026-124490
CVE-2026-124490: OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClien…
Unknown · · EPSS 0.36% · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-123549
CVE-2026-123549: OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-regis…
Unknown · · EPSS 0.35% · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-124445
CVE-2026-124445: OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ig…
Unknown · · EPSS 0.35% · Threat 47 - CRITICAL 9.4ATT&CK inferredCVE-2026-124469
CVE-2026-124469: OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-invento…
Unknown · · EPSS 0.31% · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-114464
CVE-2026-114464: IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive i…
Unknown · · EPSS 0.21% · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-123966
CVE-2026-123966: A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the fu…
Unknown · · EPSS 1.02% · Threat 47 - CRITICAL 9.8ATT&CK inferredCVE-2026-19803
CVE-2026-19803: The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress i…
Unknown · · EPSS 0.96% · Threat 49 - CRITICAL 9.8ATT&CK inferredCVE-2026-17340
CVE-2026-17340: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitra…
Unknown · · EPSS 0.92% · Threat 49 - CRITICAL 9.9ATT&CK inferredCVE-2026-17147
CVE-2026-17147: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.90% · Threat 50 - CRITICAL 9.8ATT&CK inferredCVE-2026-93754
CVE-2026-93754: The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upl…
Unknown · · EPSS 0.87% · Threat 49 - CRITICAL 9.9ATT&CK inferredCVE-2026-17342
CVE-2026-17342: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.85% · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-17359
CVE-2026-17359: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.85% · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-17239
CVE-2026-17239: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to e…
Unknown · · EPSS 0.83% · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-17117
CVE-2026-17117: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.80% · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-17150
CVE-2026-17150: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.79% · Threat 50 - CRITICAL 9.8ATT&CK inferredCVE-2026-17313
CVE-2026-17313: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitiv…
Unknown · · EPSS 0.78% · Threat 49 - CRITICAL 9.8ATT&CK inferredCVE-2026-16720
CVE-2026-16720: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.77% · Threat 49 - CRITICAL 9.8ATT&CK inferredCVE-2026-17278
CVE-2026-17278: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthoriz…
Unknown · · EPSS 0.72% · Threat 49 - CRITICAL 10ATT&CK inferredCVE-2026-109469
CVE-2026-109469: Authorization bypass through user-controlled key in Entra Device Registration allows an un…
Unknown · · EPSS 0.67% · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-17146
CVE-2026-17146: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.67% · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-17354
CVE-2026-17354: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to p…
Unknown · · EPSS 0.66% · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-17158
CVE-2026-17158: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.66% · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-17392
CVE-2026-17392: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.66% · Threat 50 - HIGH 8.5ATT&CK inferredCVE-2026-124057
CVE-2026-124057: A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the funct…
Unknown · · EPSS 0.64% · Threat 43 - CRITICAL 9.9ATT&CK inferredCVE-2026-17132
CVE-2026-17132: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to e…
Unknown · · EPSS 0.62% · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-17336
CVE-2026-17336: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to e…
Unknown · · EPSS 0.62% · Threat 50 - CRITICAL 9.6ATT&CK inferredCVE-2026-17297
CVE-2026-17297: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.61% · Threat 48 - CRITICAL 9.8ATT&CK inferredCVE-2026-17360
CVE-2026-17360: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full admin…
Unknown · · EPSS 0.58% · Threat 49 - CRITICAL 9.1ATT&CK inferredCVE-2026-17066
CVE-2026-17066: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to o…
Unknown · · EPSS 0.56% · Threat 46 - CRITICAL 9.9ATT&CK inferredCVE-2026-17049
CVE-2026-17049: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to o…
Unknown · · EPSS 0.54% · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-17298
CVE-2026-17298: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.54% · Threat 50 - CRITICAL 9.9ATT&CK inferredCVE-2026-16920
CVE-2026-16920: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to b…
Unknown · · EPSS 0.53% · Threat 50 - CRITICAL 9.6ATT&CK inferredCVE-2026-17394
CVE-2026-17394: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.52% · Threat 48 - CRITICAL 9.3ATT&CK inferredCVE-2026-17344
CVE-2026-17344: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitiv…
Unknown · · EPSS 0.51% · Threat 47 - HIGH 8.5ATT&CK inferredCVE-2026-124060
CVE-2026-124060: A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this issue is the…
Unknown · · EPSS 0.50% · Threat 43 - CRITICAL 9.9ATT&CK inferredCVE-2026-16884
CVE-2026-16884: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitiv…
Unknown · · EPSS 0.50% · Threat 50 - CRITICAL 9.1ATT&CK inferredCVE-2026-17339
CVE-2026-17339: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to a…
Unknown · · EPSS 0.49% · Threat 46 - HIGH 8.5ATT&CK inferredCVE-2026-124058
CVE-2026-124058: A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function se…
Unknown · · EPSS 0.49% · Threat 43 - HIGH 8.5ATT&CK inferredCVE-2026-124059
CVE-2026-124059: A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by thi…
Unknown · · EPSS 0.49% · Threat 43 - CRITICAL 9.9ATT&CK inferredCVE-2026-17134
CVE-2026-17134: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to e…
Unknown · · EPSS 0.46% · Threat 50 - CRITICAL 9.6ATT&CK inferredCVE-2026-17353
CVE-2026-17353: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to o…
Unknown · · EPSS 0.46% · Threat 48 - CRITICAL 9.6ATT&CK inferredCVE-2026-17296
CVE-2026-17296: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.45% · Threat 48 - CRITICAL 9.6ATT&CK inferredCVE-2026-17299
CVE-2026-17299: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.44% · Threat 48 - CRITICAL 9.3ATT&CK inferredCVE-2026-17131
CVE-2026-17131: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitiv…
Unknown · · EPSS 0.44% · Threat 47 - CRITICAL 9.8ATT&CK inferredCVE-2026-17301
CVE-2026-17301: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an un…
Unknown · · EPSS 0.43% · Threat 49 - CRITICAL 9.3ATT&CK inferredCVE-2026-16918
CVE-2026-16918: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.42% · Threat 47 - CRITICAL 9.1ATT&CK inferredCVE-2026-120984
CVE-2026-120984: A flaw was found in the Keycloak server's client management component. When a client is cr…
Unknown · · EPSS 0.42% · Threat 46 - CRITICAL 9.3ATT&CK inferredCVE-2026-17329
CVE-2026-17329: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitiv…
Unknown · · EPSS 0.41% · Threat 47 - CRITICAL 9.1ATT&CK inferredCVE-2026-17292
CVE-2026-17292: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a rem…
Unknown · · EPSS 0.40% · Threat 46 - CRITICAL 9.8Exploited in the wild · CISA KEVATT&CK inferredCVE-2026-123218
CVE-2026-123218: IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific …
Unknown · · EPSS 0.40% · Threat 64 - CRITICAL 9.1ATT&CK inferredCVE-2026-17338
CVE-2026-17338: IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to o…
Unknown · · EPSS 0.38% · Threat 46 - CRITICAL 9.1ATT&CK inferredCVE-2026-114630
CVE-2026-114630: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable…
Unknown · · EPSS 1.32% · Threat 46 - HIGH 8.1Exploited in the wild · CISA KEVPublic PoCATT&CK inferredCVE-2026-123158
CVE-2026-123158: sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workar…
Unknown · · EPSS 1.01% · Threat 56 - CRITICAL 9.8ATT&CK inferredCVE-2026-107622
CVE-2026-107622: The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions …
Unknown · · EPSS 0.74% · Threat 49 - HIGH 7.5Exploited in the wild · CISA KEVATT&CK inferredCVE-2026-19868
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
SonicWall · SonicOS SSLVPN · EPSS 0.62% · Threat 53 - CRITICAL 10Public PoCATT&CK inferredCVE-2026-118423
CVE-2026-118423: The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded th…
Unknown · · EPSS 0.57% · Threat 54 - CRITICAL 9.3ATT&CK inferredCVE-2026-119757
CVE-2026-119757: BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information di…
Unknown · · EPSS 0.54% · Threat 47 - CRITICAL 9.3Public PoCATT&CK inferredCVE-2026-123488
CVE-2026-123488: Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL inje…
Unknown · · EPSS 0.48% · Threat 51 - HIGH 8.1Public PoCATT&CK inferredCVE-2026-83844
CVE-2026-83844: Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a…
Unknown · · EPSS 0.38% · Threat 45 - CRITICAL 9.3ATT&CK inferredCVE-2026-122051
CVE-2026-122051: A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unkno…
Unknown · · EPSS 2.57% · Threat 47 - HIGH 7.7Public PoCATT&CK inferredCVE-2026-109518
CVE-2026-109518: On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipul…
Unknown · · EPSS 0.93% · Threat 43 - CRITICAL 9.3ATT&CK inferredCVE-2026-54384
CVE-2026-54384: VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that …
Unknown · · EPSS 0.66% · Threat 47 - CRITICAL 9.4ATT&CK inferredCVE-2026-122311
CVE-2026-122311: Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument…
Unknown · · EPSS 0.45% · Threat 47 - CRITICAL 9.4ATT&CK inferredCVE-2026-122304
CVE-2026-122304: Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allo…
Unknown · · EPSS 0.39% · Threat 47 - CRITICAL 9.4ATT&CK inferredCVE-2026-122310
CVE-2026-122310: Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after clean…
Unknown · · EPSS 0.36% · Threat 47 - CRITICAL 9.4ATT&CK inferredCVE-2026-122303
CVE-2026-122303: Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allo…
Unknown · · EPSS 0.33% · Threat 47 - CRITICAL 9.4ATT&CK inferredCVE-2026-122313
CVE-2026-122313: Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allow…
Unknown · · EPSS 0.31% · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-122302
CVE-2026-122302: Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace …
Unknown · · EPSS 0.28% · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-54378
CVE-2026-54378: VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that a…
Unknown · · EPSS 0.23% · Threat 47 - HIGH 8.5ATT&CK inferredCVE-2026-122321
CVE-2026-122321: Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages beca…
Unknown · · EPSS 0.23% · Threat 43 - CRITICAL 10Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferredCVE-2026-97229
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab · Community Edition and Enterprise Edition · EPSS 65.22% · Threat 85 - CRITICAL 9.3Exploited in the wild · CISA KEVPublic PoCATT&CK inferredCVE-2026-48356
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe · Commerce and Magento · EPSS 47.47% · Threat 76 - CRITICAL 9.3ATT&CK inferredCVE-2026-120276
CVE-2026-120276: A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability aff…
Unknown · · EPSS 3.21% · Threat 47 - HIGH 8.5ATT&CK inferredCVE-2026-120229
CVE-2026-120229: A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the f…
Unknown · · EPSS 2.82% · Threat 43 - HIGH 8.5ATT&CK inferredCVE-2026-121930
CVE-2026-121930: A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the fun…
Unknown · · EPSS 2.72% · Threat 43 - HIGH 8.5ATT&CK inferredCVE-2026-121931
CVE-2026-121931: A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted elemen…
Unknown · · EPSS 2.72% · Threat 43 - CRITICAL 9.3ATT&CK inferredCVE-2026-120277
CVE-2026-120277: A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue…
Unknown · · EPSS 2.45% · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-121932
CVE-2026-121932: A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system…
Unknown · · EPSS 2.38% · Threat 47 - HIGH 8.6ATT&CK inferredCVE-2026-120230
CVE-2026-120230: A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_gro…
Unknown · · EPSS 2.21% · Threat 44 - CRITICAL 9.3ATT&CK inferredCVE-2026-120195
CVE-2026-120195: A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The…
Unknown · · EPSS 2.07% · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-120280
CVE-2026-120280: A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the …
Unknown · · EPSS 1.99% · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-120345
CVE-2026-120345: A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the …
Unknown · · EPSS 1.99% · Threat 47 - CRITICAL 9.3ATT&CK inferredCVE-2026-120442
CVE-2026-120442: ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows un…
Unknown · · EPSS 1.71% · Threat 47 - HIGH 8.6ATT&CK inferredCVE-2026-120196
CVE-2026-120196: A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_…
Unknown · · EPSS 1.69% · Threat 44 - HIGH 8.6ATT&CK inferredCVE-2026-120238
CVE-2026-120238: A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the functio…
Unknown · · EPSS 1.69% · Threat 44