CVERadar

CVEs: Exploited in the wild, page 2

664 CVEs listed as exploited in the wild by CISA KEV or VulnCheck KEV, sorted by threat level then EPSS. Showing 121-240. Use search to combine filters.

HIGH 8.6RansomwareTop #77
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-24919

Check Point Quantum Security Gateways Information Disclosure Vulnerability

Check Point · Quantum Security Gateways · EPSS 99.98% · Threat 93
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2018-19410

Paessler PRTG Network Monitor Local File Inclusion Vulnerability

Paessler · PRTG Network Monitor · EPSS 97.94% · Threat 93
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2024-4358

Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

Progress · Telerik Report Server · EPSS 97.48% · Threat 93
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-2747

Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

Kentico · Xperience CMS · EPSS 97.17% · Threat 93
CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-20439

Cisco Smart Licensing Utility Static Credential Vulnerability

Cisco · Smart Licensing Utility · EPSS 97.09% · Threat 93
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-20253

Splunk Enterprise Missing Authentication for Critical Function Vulnerability

Splunk · Enterprise · EPSS 96.94% · Threat 93
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-1212

Progress Kemp LoadMaster OS Command Injection Vulnerability

Progress · Kemp LoadMaster · EPSS 95.39% · Threat 93
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2025-47812

Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

Wing FTP Server · Wing FTP Server · EPSS 93.88% · Threat 93
CRITICAL 9.9
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2025-24016

Wazuh Server Deserialization of Untrusted Data Vulnerability

Wazuh · Wazuh Server · EPSS 93.84% · Threat 93
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-85706

GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

GitLab · Community Edition and Enterprise Edition · EPSS 91.95% · Threat 93
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-20182

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Cisco · Catalyst SD-WAN · EPSS 91.82% · Threat 93
CRITICAL 9.3Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-24423

SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

SmarterTools · SmarterMail · EPSS 88.18% · Threat 93
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-47575

Fortinet FortiManager Missing Authentication Vulnerability

Fortinet · FortiManager · EPSS 94.77% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2018-14933

NUUO NVRmini Devices OS Command Injection Vulnerability

NUUO · NVRmini Devices · EPSS 94.76% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-21413

Microsoft Outlook Improper Input Validation Vulnerability

Microsoft · Office Outlook · EPSS 94.66% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2020-2883

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server · EPSS 94.58% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2025-30406

Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability

Gladinet · CentreStack · EPSS 94.34% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-35616

Fortinet FortiClient EMS Improper Access Control Vulnerability

Fortinet · FortiClient EMS · EPSS 93.98% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-11953

React Native Community CLI OS Command Injection Vulnerability

React Native Community · CLI · EPSS 93.98% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-21643

Fortinet FortiClient EMS SQL Injection Vulnerability

Fortinet · FortiClient EMS · EPSS 93.87% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-54309

CrushFTP Unprotected Alternate Channel Vulnerability

CrushFTP · CrushFTP · EPSS 93.47% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBCTID-mapped
CVE-2022-43939

Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

Hitachi Vantara · Pentaho Business Analytics (BA) Server · EPSS 92.27% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-64446

Fortinet FortiWeb Path Traversal Vulnerability

Fortinet · FortiWeb · EPSS 91.97% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2024-7399

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Samsung · MagicINFO 9 Server · EPSS 91.94% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-11680

ProjectSend Improper Authentication Vulnerability

ProjectSend · ProjectSend · EPSS 91.85% · Threat 92
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-20127

Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

Cisco · Catalyst SD-WAN Controller and Manager · EPSS 89.29% · Threat 92
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-48908

JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

JoomShaper · SP Page Builder · EPSS 88.51% · Threat 92
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-20079

Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management · EPSS 88.47% · Threat 92
CRITICAL 9.3Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-50751

Check Point Security Gateway Improper Authentication Vulnerability

Check Point · Security Gateway · EPSS 85.34% · Threat 92
HIGH 8.2RansomwareTop #6
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-21893

Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

Ivanti · Connect Secure, Policy Secure, and Neurons · EPSS 100.00% · Threat 91
HIGH 8.2RansomwareTop #64
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-46805

Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

Ivanti · Connect Secure and Policy Secure · EPSS 99.99% · Threat 91
CRITICAL 9.3Top #80
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2024-4879

ServiceNow Improper Input Validation Vulnerability

ServiceNow · Utah, Vancouver, and Washington DC Now Platform · EPSS 99.98% · Threat 91
CRITICAL 9.2
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-9465

Palo Alto Networks Expedition SQL Injection Vulnerability

Palo Alto Networks · Expedition · EPSS 99.63% · Threat 91
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-34028

Commvault Command Center Path Traversal Vulnerability

Commvault · Command Center · EPSS 97.60% · Threat 91
CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-56145

Craft CMS Code Injection Vulnerability

Craft CMS · Craft CMS · EPSS 97.41% · Threat 91
HIGH 8.4Ransomware
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2024-1708

ConnectWise ScreenConnect Path Traversal Vulnerability

ConnectWise · ScreenConnect · EPSS 95.44% · Threat 91
CRITICAL 9.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2017-3066

Adobe ColdFusion Deserialization Vulnerability

Adobe · ColdFusion · EPSS 90.60% · Threat 91
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-37164

Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability

Hewlett Packard Enterprise (HPE) · OneView · EPSS 90.19% · Threat 91
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-61757

Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

Oracle · Fusion Middleware · EPSS 88.65% · Threat 91
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-54253

Adobe Experience Manager Forms Code Execution Vulnerability

Adobe · Experience Manager (AEM) Forms · EPSS 88.26% · Threat 91
HIGH 8RansomwareTop #84
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2022-41082

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · EPSS 99.97% · Threat 90
CRITICAL 9.1Top #94
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-38475

Apache HTTP Server Improper Escaping of Output Vulnerability

Apache · HTTP Server · EPSS 99.96% · Threat 90
CRITICAL 9
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-48703

CWP Control Web Panel OS Command Injection Vulnerability

CWP · Control Web Panel · EPSS 99.66% · Threat 90
CRITICAL 9.2
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-54068

Laravel Livewire Code Injection Vulnerability

Laravel · Livewire · EPSS 96.28% · Threat 90
HIGH 8.4Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-8088

RARLAB WinRAR Path Traversal Vulnerability

RARLAB · WinRAR · EPSS 94.51% · Threat 90
CRITICAL 9.4
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-34291

Langflow Origin Validation Error Vulnerability

Langflow · Langflow · EPSS 92.81% · Threat 90
CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-58136

Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Yiiframework · Yii · EPSS 87.76% · Threat 90
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2024-12356

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

BeyondTrust · Privileged Remote Access (PRA) and Remote Support (RS) · EPSS 87.26% · Threat 90
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-24858

Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Fortinet · Multiple Products · EPSS 85.80% · Threat 90
HIGH 8.8Top #15
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2023-1389

TP-Link Archer AX-21 Command Injection Vulnerability

TP-Link · Archer AX21 · EPSS 100.00% · Threat 89
HIGH 8.8Top #76
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2023-4863

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Google · Chromium WebP · EPSS 99.98% · Threat 89
HIGH 7.8RansomwareTop #100
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2017-11882

Microsoft Office Memory Corruption Vulnerability

Microsoft · Office · EPSS 99.94% · Threat 89
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2014-6278

GNU Bash OS Command Injection Vulnerability

GNU · GNU Bash · EPSS 99.59% · Threat 89
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-68613

n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

n8n · n8n · EPSS 98.99% · Threat 89
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-49113

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube · Webmail · EPSS 98.97% · Threat 89
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-0108

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Palo Alto Networks · PAN-OS · EPSS 98.45% · Threat 89
CRITICAL 9
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-5086

Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability

Dassault Systèmes · DELMIA Apriso · EPSS 96.91% · Threat 89
CRITICAL 9.1
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-12480

Gladinet Triofox Improper Access Control Vulnerability

Gladinet · Triofox · EPSS 95.75% · Threat 89
CRITICAL 9.1
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-54236

Adobe Commerce and Magento Improper Input Validation Vulnerability

Adobe · Commerce and Magento · EPSS 94.66% · Threat 89
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-9242

WatchGuard Firebox Out-of-Bounds Write Vulnerability

WatchGuard · Firebox · EPSS 91.80% · Threat 89
CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2024-5910

Palo Alto Networks Expedition Missing Authentication Vulnerability

Palo Alto Networks · Expedition · EPSS 91.68% · Threat 89
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2020-7796

Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

Synacor · Zimbra Collaboration Suite · EPSS 84.42% · Threat 89
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2025-40551

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

SolarWinds · Web Help Desk · EPSS 84.18% · Threat 89
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2019-9874

Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Sitecore · CMS and Experience Platform (XP) · EPSS 83.74% · Threat 89
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2010-3765

Mozilla Multiple Products Remote Code Execution Vulnerability

Mozilla · Multiple Products · EPSS 83.16% · Threat 89
CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-0769

D-Link DIR-859 Router Path Traversal Vulnerability

D-Link · DIR-859 Router · EPSS 82.71% · Threat 89
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2021-23758

Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

Ajax.NET Professional · Ajax.NET Professional · EPSS 82.58% · Threat 89
CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2023-28461

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Array Networks · AG/vxAG ArrayOS · EPSS 68.08% · Threat 89
CRITICAL 9.9Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-57726

SimpleHelp Missing Authorization Vulnerability

SimpleHelp · SimpleHelp · EPSS 66.41% · Threat 89
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2023-52163

Digiever DS-2105 Pro Missing Authorization Vulnerability

Digiever · DS-2105 Pro · EPSS 96.92% · Threat 88
HIGH 7.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-0257

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Palo Alto Networks · PAN-OS · EPSS 96.89% · Threat 88
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-43468

Microsoft Configuration Manager SQL Injection Vulnerability

Microsoft · Configuration Manager · EPSS 81.04% · Threat 88
HIGH 7.5RansomwareTop #11
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-4966

Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

Citrix · NetScaler ADC and NetScaler Gateway · EPSS 100.00% · Threat 87
HIGH 7.5RansomwareTop #49
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-10271

Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server · EPSS 99.99% · Threat 87
HIGH 7.5Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2024-57727

SimpleHelp Path Traversal Vulnerability

SimpleHelp · SimpleHelp · EPSS 96.83% · Threat 87
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2010-0249

Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft · Internet Explorer · EPSS 91.94% · Threat 87
CRITICAL 9.1
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-71362

Adobe Commerce and Magento Incorrect Authorization Vulnerability

Adobe · Commerce and Magento · EPSS 87.51% · Threat 87
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-8037

Progress LoadMaster Command Injection Vulnerability

Progress · LoadMaster · EPSS 77.36% · Threat 87
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-25089

Fortinet FortiSandbox OS Command Injection Vulnerability

Fortinet · FortiSandbox · EPSS 76.11% · Threat 87
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-93616

Check Point Multiple Products Path Traversal Vulnerability

Check Point · Multiple Products · EPSS 75.87% · Threat 87
CRITICAL 10
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-20337

Cisco Identity Services Engine Injection Vulnerability

Cisco · Identity Services Engine · EPSS 74.50% · Threat 87
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-21962

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in · EPSS 73.19% · Threat 87
HIGH 7.2RansomwareTop #17
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2023-0669

Fortra GoAnywhere MFT Remote Code Execution Vulnerability

Fortra · GoAnywhere MFT · EPSS 100.00% · Threat 86
HIGH 7.3RansomwareTop #56
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-27199

JetBrains TeamCity Relative Path Traversal Vulnerability

JetBrains · TeamCity · EPSS 99.99% · Threat 86
HIGH 7.5Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-61884

Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

Oracle · E-Business Suite · EPSS 95.89% · Threat 86
HIGH 8.6
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-48248

NAKIVO Backup and Replication Absolute Path Traversal Vulnerability

NAKIVO · Backup and Replication · EPSS 94.36% · Threat 86
HIGH 8.7
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-4008

Smartbedded Meteobridge Command Injection Vulnerability

Smartbedded · Meteobridge · EPSS 93.31% · Threat 86
HIGH 8.7
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2026-42271

BerriAI LiteLLM Command Injection Vulnerability

BerriAI · LiteLLM · EPSS 92.57% · Threat 86
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-42009

RoundCube Webmail Cross-Site Scripting Vulnerability

Roundcube · Webmail · EPSS 82.88% · Threat 86
CRITICAL 9.2
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-34026

Versa Concerto Improper Authentication Vulnerability

Versa · Concerto · EPSS 81.78% · Threat 86
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-2746

Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

Kentico · Xperience CMS · EPSS 74.06% · Threat 86
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2025-40536

SolarWinds Web Help Desk Security Control Bypass Vulnerability

SolarWinds · Web Help Desk · EPSS 73.56% · Threat 86
CRITICAL 9.9
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-20333

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense · EPSS 71.21% · Threat 86
HIGH 8.1Top #50
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-11776

Apache Struts Remote Code Execution Vulnerability

Apache · Struts · EPSS 99.99% · Threat 85
HIGH 8.1Top #85
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-12617

Apache Tomcat Remote Code Execution Vulnerability

Apache · Tomcat · EPSS 99.97% · Threat 85
HIGH 8.1
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2010-3962

Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability

Microsoft · Internet Explorer · EPSS 96.83% · Threat 85
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleCTID-mapped
CVE-2025-4428

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) · EPSS 88.00% · Threat 85
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2013-3893

Microsoft Internet Explorer Resource Management Errors Vulnerability

Microsoft · Internet Explorer · EPSS 87.64% · Threat 85
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2025-33053

Microsoft Windows External Control of File Name or Path Vulnerability

Microsoft · Windows · EPSS 87.02% · Threat 85
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2009-3459

Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

Adobe · Acrobat and Reader · EPSS 86.65% · Threat 85
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2026-81578

PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

PaperCut · NG/MF · EPSS 85.58% · Threat 85
CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-16232

Check Point SmartConsole Improper Authentication Vulnerability

Check Point · SmartConsole · EPSS 77.97% · Threat 85
CRITICAL 10
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-76460

Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

Cisco · Identity Services Engine · EPSS 66.64% · Threat 85
HIGH 7.8Top #73
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-22204

ExifTool Remote Code Execution Vulnerability

Perl · Exiftool · EPSS 99.98% · Threat 84
HIGH 7.8Top #90
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-3156

Sudo Heap-Based Buffer Overflow Vulnerability

Sudo · Sudo · EPSS 99.96% · Threat 84
HIGH 8.1
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2016-3081

Apache Struts Command Injection Vulnerability

Apache · Struts · EPSS 96.05% · Threat 84
HIGH 8.6
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-20230

Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

Cisco · Unified Communications Manager · EPSS 88.20% · Threat 84
HIGH 8.6
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-20362

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense · EPSS 87.09% · Threat 84
HIGH 8.7
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-8110

Gogs Path Traversal Vulnerability

Gogs · Gogs · EPSS 85.20% · Threat 84
HIGH 8.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2025-33073

Microsoft Windows SMB Client Improper Access Control Vulnerability

Microsoft · Windows · EPSS 82.70% · Threat 84
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2010-0806

Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft · Internet Explorer · EPSS 82.24% · Threat 84
CRITICAL 9.3
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-1316

Edimax IC-7100 IP Camera OS Command Injection Vulnerability

Edimax · IC-7100 IP Camera · EPSS 74.48% · Threat 84
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-59718

Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

Fortinet · Multiple Products · EPSS 68.29% · Threat 84
CRITICAL 9.9Ransomware
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-48365

Qlik Sense HTTP Tunneling Vulnerability

Qlik · Sense · EPSS 47.45% · Threat 84
HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-8291

Artifex Ghostscript Type Confusion Vulnerability

Artifex · Ghostscript · EPSS 96.97% · Threat 83
MEDIUM 6.9Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-9474

Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

Palo Alto Networks · PAN-OS · EPSS 94.82% · Threat 83
HIGH 8.6
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2025-64328

Sangoma FreePBX OS Command Injection Vulnerability

Sangoma · FreePBX · EPSS 84.62% · Threat 83
HIGH 8.7
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-14847

MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

MongoDB · MongoDB and MongoDB Server · EPSS 83.22% · Threat 83
CRITICAL 9
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-34192

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 77.27% · Threat 83
CRITICAL 9.1
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-6205

Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability

Dassault Systèmes · DELMIA Apriso · EPSS 73.57% · Threat 83