All CVEs
1724 CVEs, sorted by threat level then EPSS. Showing 1-120. Use search to combine filters.
CRITICAL 10RansomwareTop #29
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2019-11510Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
Ivanti · Pulse Connect Secure · EPSS 100.00% · Threat 100CRITICAL 10RansomwareTop #24
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-44228Apache Log4j2 Remote Code Execution Vulnerability
Apache · Log4j2 · EPSS 100.00% · Threat 100CRITICAL 10RansomwareTop #5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-3400Palo Alto Networks PAN-OS Command Injection Vulnerability
Palo Alto Networks · PAN-OS · EPSS 100.00% · Threat 100CRITICAL 10RansomwareTop #75
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-1709ConnectWise ScreenConnect Authentication Bypass Vulnerability
ConnectWise · ScreenConnect · EPSS 99.98% · Threat 100CRITICAL 10Ransomware
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-55182Meta React Server Components Remote Code Execution Vulnerability
Meta · React Server Components · EPSS 99.80% · Threat 100CRITICAL 9.8RansomwareTop #26
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2017-5638Apache Struts Remote Code Execution Vulnerability
Apache · Struts · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #27
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-13379Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Fortinet · FortiOS · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #28
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2019-0708Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Microsoft · Remote Desktop Services · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #30
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2019-19781Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #31
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
F5 · BIG-IP · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #33
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2021-21985VMware vCenter Server Improper Input Validation Vulnerability
VMware · vCenter Server · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #34
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2021-22005VMware vCenter Server File Upload Vulnerability
VMware · vCenter Server · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #35
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-26084Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Atlassian · Confluence Server and Data Center · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #37
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-35464ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
ForgeRock · Access Management (AM) · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #18
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2022-26134Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Atlassian · Confluence Server/Data Center · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #20
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2022-29464WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
WSO2 · Multiple Products · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-22518Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
Atlassian · Confluence Data Center and Server · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #16
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2023-27350PaperCut MF/NG Improper Access Control Vulnerability
PaperCut · MF/NG · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #14
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2023-35078Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM) · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #7
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2023-35082Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM) and MobileIron Core · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #4
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-23897Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Jenkins · Jenkins Command Line Interface (CLI) · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #1
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2025-53770Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft · SharePoint · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #39
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2022-22954VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
VMware · Workspace ONE Access and Identity Manager · EPSS 100.00% · Threat 99CRITICAL 9.8RansomwareTop #51
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2025-3248Langflow Missing Authentication Vulnerability
Langflow · Langflow · EPSS 99.99% · Threat 99CRITICAL 9.8RansomwareTop #55
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-41773Apache HTTP Server Path Traversal Vulnerability
Apache · HTTP Server · EPSS 99.99% · Threat 99CRITICAL 9.8RansomwareTop #58
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-7600Drupal Core Remote Code Execution Vulnerability
Drupal · Drupal Core · EPSS 99.99% · Threat 99CRITICAL 9.8RansomwareTop #57
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-29300Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe · ColdFusion · EPSS 99.99% · Threat 99CRITICAL 9.8RansomwareTop #63
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2023-42793JetBrains TeamCity Authentication Bypass Vulnerability
JetBrains · TeamCity · EPSS 99.99% · Threat 99CRITICAL 9.8RansomwareTop #62
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2024-4577PHP-CGI OS Command Injection Vulnerability
PHP Group · PHP · EPSS 99.99% · Threat 99CRITICAL 9.8RansomwareTop #68
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2022-40684Fortinet Multiple Products Authentication Bypass Vulnerability
Fortinet · Multiple Products · EPSS 99.98% · Threat 99CRITICAL 9.8RansomwareTop #66
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-22527Atlassian Confluence Data Center and Server Template Injection Vulnerability
Atlassian · Confluence Data Center and Server · EPSS 99.98% · Threat 99CRITICAL 9.8RansomwareTop #67
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2023-29357Microsoft SharePoint Server Privilege Escalation Vulnerability
Microsoft · SharePoint Server · EPSS 99.98% · Threat 99CRITICAL 9.8RansomwareTop #71
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2025-22457Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Ivanti · Connect Secure, Policy Secure, and ZTA Gateways · EPSS 99.98% · Threat 99CRITICAL 9.8RansomwareTop #79
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-2725Oracle WebLogic Server, Injection
Oracle · WebLogic Server · EPSS 99.98% · Threat 99CRITICAL 9.8RansomwareTop #87
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-31161CrushFTP Authentication Bypass Vulnerability
CrushFTP · CrushFTP · EPSS 99.97% · Threat 99CRITICAL 9.8RansomwareTop #88
Exploited in the wild · CISA KEVExploit-DBATT&CK inferred
CVE-2022-47986IBM Aspera Faspex Code Execution Vulnerability
IBM · Aspera Faspex · EPSS 99.97% · Threat 99CRITICAL 9.8RansomwareTop #89
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-42013Apache HTTP Server Path Traversal Vulnerability
Apache · HTTP Server · EPSS 99.96% · Threat 99CRITICAL 9.8RansomwareTop #96
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2022-1388F5 BIG-IP Missing Authentication Vulnerability
F5 · BIG-IP · EPSS 99.95% · Threat 99CRITICAL 9.8RansomwareTop #97
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-38035Ivanti Sentry Authentication Bypass Vulnerability
Ivanti · Sentry · EPSS 99.95% · Threat 99CRITICAL 9.8RansomwareTop #99
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2018-10562Dasan GPON Routers Command Injection Vulnerability
Dasan · Gigabit Passive Optical Network (GPON) Routers · EPSS 99.95% · Threat 99CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2024-27198JetBrains TeamCity Authentication Bypass Vulnerability
JetBrains · TeamCity · EPSS 99.94% · Threat 99CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-10035Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
Fortra · GoAnywhere MFT · EPSS 99.80% · Threat 99CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-61882Oracle E-Business Suite Unspecified Vulnerability
Oracle · E-Business Suite · EPSS 99.73% · Threat 99CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-31324SAP NetWeaver Unrestricted File Upload Vulnerability
SAP · NetWeaver · EPSS 99.49% · Threat 99CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2024-23692Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Rejetto · HTTP File Server · EPSS 99.48% · Threat 99CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-50623Cleo Multiple Products Unrestricted File Upload Vulnerability
Cleo · Multiple Products · EPSS 98.61% · Threat 99CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Oracle · PeopleSoft Enterprise PeopleTools · EPSS 96.68% · Threat 98CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-53704SonicWall SonicOS SSLVPN Improper Authentication Vulnerability
SonicWall · SonicOS · EPSS 95.31% · Threat 98CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-51378CyberPanel Incorrect Default Permissions Vulnerability
CyberPersons · CyberPanel · EPSS 94.75% · Threat 97CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-55591Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Fortinet · FortiOS and FortiProxy · EPSS 94.35% · Threat 97CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2024-55956Cleo Multiple Products Unauthenticated File Upload Vulnerability
Cleo · Multiple Products · EPSS 93.97% · Threat 97CRITICAL 9.9Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-1731BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
BeyondTrust · Remote Support (RS) and Privileged Remote Access (PRA) · EPSS 92.46% · Threat 97CRITICAL 9.3RansomwareTop #82
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-5777Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
Citrix · NetScaler ADC and Gateway · EPSS 99.97% · Threat 96CRITICAL 9.3Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-0012Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
Palo Alto Networks · PAN-OS · EPSS 99.86% · Threat 96CRITICAL 9.3Ransomware
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-41940WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
WebPros · cPanel & WHM and WP2 (WordPress Squared) · EPSS 98.53% · Threat 96CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-26399SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
SolarWinds · Web Help Desk · EPSS 90.12% · Threat 96CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-63077JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrains · TeamCity · EPSS 89.57% · Threat 96CRITICAL 10Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-52691SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
SmarterTools · SmarterMail · EPSS 85.66% · Threat 96CRITICAL 9.1RansomwareTop #36
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2021-34473Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server · EPSS 100.00% · Threat 95CRITICAL 9RansomwareTop #25
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2021-40438Apache HTTP Server-Side Request Forgery (SSRF)
Apache · Apache · EPSS 100.00% · Threat 95CRITICAL 9.1RansomwareTop #8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-21887Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
Ivanti · Connect Secure and Policy Secure · EPSS 100.00% · Threat 95CRITICAL 9.1RansomwareTop #44
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server · EPSS 100.00% · Threat 95CRITICAL 9RansomwareTop #59
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2021-34523Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft · Exchange Server · EPSS 99.99% · Threat 95CRITICAL 9RansomwareTop #72
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Ivanti · Connect Secure, Policy Secure, and ZTA Gateways · EPSS 99.98% · Threat 95CRITICAL 9RansomwareTop #78
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2021-45046Apache Log4j2 Deserialization of Untrusted Data Vulnerability
Apache · Log4j2 · EPSS 99.98% · Threat 95CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-10520Ivanti Sentry OS Command Injection Vulnerability
Ivanti · Sentry · EPSS 99.91% · Threat 95CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-32432Craft CMS Code Injection Vulnerability
Craft CMS · Craft CMS · EPSS 99.79% · Threat 95CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2015-3306ProFTPD Improper Access Control Vulnerability
ProFTPD · ProFTPD · EPSS 99.50% · Threat 95CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2025-32433Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
Erlang · Erlang/OTP · EPSS 98.79% · Threat 95CRITICAL 9.1Ransomware
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-41713Mitel MiCollab Path Traversal Vulnerability
Mitel · MiCollab · EPSS 97.21% · Threat 95CRITICAL 9.3Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-23760SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
SmarterTools · SmarterMail · EPSS 96.43% · Threat 95CRITICAL 9.8Top #23
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2014-6271GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
GNU · Bourne-Again Shell (Bash) · EPSS 100.00% · Threat 94CRITICAL 9.8Top #22
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2015-1635Microsoft HTTP.sys Remote Code Execution Vulnerability
Microsoft · HTTP.sys · EPSS 100.00% · Threat 94CRITICAL 9.8Top #21
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2017-9841PHPUnit Command Injection Vulnerability
PHPUnit · PHPUnit · EPSS 100.00% · Threat 94CRITICAL 9.8Top #32
Exploited in the wild · CISA KEVMetasploit moduleCTID-mapped
CVE-2021-1498Cisco HyperFlex HX Data Platform Command Injection Vulnerability
Cisco · HyperFlex HX · EPSS 100.00% · Threat 94CRITICAL 9.8Top #9
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2023-1671Sophos Web Appliance Command Injection Vulnerability
Sophos · Web Appliance · EPSS 100.00% · Threat 94CRITICAL 9.8Top #3
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-7593Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
Ivanti · Virtual Traffic Manager · EPSS 100.00% · Threat 94CRITICAL 9.8Top #40
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2012-1823PHP-CGI Query String Parameter Vulnerability
PHP · PHP · EPSS 100.00% · Threat 94CRITICAL 9.8Top #41
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2013-2251Apache Struts Improper Input Validation Vulnerability
Apache · Struts · EPSS 100.00% · Threat 94CRITICAL 9.8Top #38
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2017-7921Hikvision Multiple Products Improper Authentication Vulnerability
Hikvision · Multiple Products · EPSS 100.00% · Threat 94CRITICAL 9.8Top #42
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2020-14882Oracle WebLogic Server Remote Code Execution Vulnerability
Oracle · WebLogic Server · EPSS 100.00% · Threat 94CRITICAL 9.8Top #43
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2019-16920D-Link Multiple Routers Command Injection Vulnerability
D-Link · Multiple Routers · EPSS 100.00% · Threat 94CRITICAL 9.8Top #47
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2022-44877CWP Control Web Panel OS Command Injection Vulnerability
CWP · Control Web Panel · EPSS 100.00% · Threat 94CRITICAL 9.8Top #46
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-3273D-Link Multiple NAS Devices Command Injection Vulnerability
D-Link · Multiple NAS Devices · EPSS 100.00% · Threat 94HIGH 8.8RansomwareTop #45
Exploited in the wild · CISA KEVMetasploit moduleCTID-mapped
CVE-2025-49704Microsoft SharePoint Code Injection Vulnerability
Microsoft · SharePoint · EPSS 100.00% · Threat 94CRITICAL 9.8Top #48
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-34102Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
Adobe · Commerce and Magento Open Source · EPSS 99.99% · Threat 94CRITICAL 9.8Top #53
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2020-8515Multiple DrayTek Vigor Routers Web Management Page Vulnerability
DrayTek · Multiple Vigor Routers · EPSS 99.99% · Threat 94CRITICAL 9.8Top #60
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2021-33044Dahua IP Camera Authentication Bypass Vulnerability
Dahua · IP Camera Firmware · EPSS 99.99% · Threat 94CRITICAL 9.8Top #61
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2020-9054Zyxel Multiple NAS Devices OS Command Injection Vulnerability
Zyxel · Multiple Network-Attached Storage (NAS) Devices · EPSS 99.99% · Threat 94CRITICAL 9.8Top #65
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-9670Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 99.99% · Threat 94CRITICAL 9.8Top #70
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2021-20090Arcadyan Buffalo Firmware Path Traversal Vulnerability
Arcadyan · Buffalo Firmware · EPSS 99.98% · Threat 94CRITICAL 9.8Top #74
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-59287Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
Microsoft · Windows · EPSS 99.98% · Threat 94HIGH 8.8RansomwareTop #81
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
Microsoft · MSCOMCTL.OCX · EPSS 99.98% · Threat 94CRITICAL 9.8Top #83
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2014-8361Realtek SDK Improper Input Validation Vulnerability
Realtek · SDK · EPSS 99.97% · Threat 94CRITICAL 9.8Top #86
Exploited in the wild · CISA KEVCTID-mapped
CVE-2020-25506D-Link DNS-320 Device Command Injection Vulnerability
D-Link · DNS-320 Device · EPSS 99.97% · Threat 94HIGH 8.8RansomwareTop #91
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
Microsoft · Exchange Server · EPSS 99.96% · Threat 94CRITICAL 9.8Top #92
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-10149Exim Mail Transfer Agent (MTA) Improper Input Validation
Exim · Mail Transfer Agent (MTA) · EPSS 99.96% · Threat 94CRITICAL 9.8Top #93
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2018-2628Oracle WebLogic Server Unspecified Vulnerability
Oracle · WebLogic Server · EPSS 99.96% · Threat 94HIGH 8.8RansomwareTop #95
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2022-41040Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft · Exchange Server · EPSS 99.96% · Threat 94CRITICAL 9.8Top #98
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-15961Adobe ColdFusion Unrestricted File Upload Vulnerability
Adobe · ColdFusion · EPSS 99.95% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-24813Apache Tomcat Path Equivalence Vulnerability
Apache · Tomcat · EPSS 99.93% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-25257Fortinet FortiWeb SQL Injection Vulnerability
Fortinet · FortiWeb · EPSS 99.92% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-24893XWiki Platform Eval Injection Vulnerability
XWiki · Platform · EPSS 99.86% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2016-10033PHPMailer Command Injection Vulnerability
PHP · PHPMailer · EPSS 99.71% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-1000353Jenkins Remote Code Execution Vulnerability
Jenkins · Jenkins · EPSS 99.68% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2021-32030ASUS Routers Improper Authentication Vulnerability
ASUS · Routers · EPSS 99.39% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-4885Progress WhatsUp Gold Path Traversal Vulnerability
Progress · WhatsUp Gold · EPSS 99.29% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-27348Apache HugeGraph-Server Improper Access Control Vulnerability
Apache · HugeGraph-Server · EPSS 99.21% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-16278Nostromo nhttpd Directory Traversal Vulnerability
Nostromo · nhttpd · EPSS 99.03% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-24061GNU InetUtils Argument Injection Vulnerability
GNU · InetUtils · EPSS 98.98% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2008-4250Microsoft Windows Buffer Overflow Vulnerability
Microsoft · Windows · EPSS 98.75% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2026-1281Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM) · EPSS 98.69% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2026-1340Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM) · EPSS 98.64% · Threat 94CRITICAL 9.9
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-9463Palo Alto Networks Expedition OS Command Injection Vulnerability
Palo Alto Networks · Expedition · EPSS 98.55% · Threat 94CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-50603Aviatrix Controllers OS Command Injection Vulnerability
Aviatrix · Controllers · EPSS 98.52% · Threat 94CRITICAL 10
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2022-22536SAP Multiple Products HTTP Request Smuggling Vulnerability
SAP · Multiple Products · EPSS 97.95% · Threat 94CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-20281Cisco Identity Services Engine Injection Vulnerability
Cisco · Identity Services Engine · EPSS 97.60% · Threat 94CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-72898Metabase SQL Injection Vulnerability
Metabase · Metabase · EPSS 97.44% · Threat 94CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-57819Sangoma FreePBX Authentication Bypass Vulnerability
Sangoma · FreePBX · EPSS 95.02% · Threat 94CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-51567