CVERadar

CVEs: Exploited in the wild, page 3

664 CVEs listed as exploited in the wild by CISA KEV or VulnCheck KEV, sorted by threat level then EPSS. Showing 241-360. Use search to combine filters.

CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-2776

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

SysAid · SysAid On-Prem · EPSS 64.73% · Threat 83
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2021-22681

Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

Rockwell · Multiple Products · EPSS 63.63% · Threat 83
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-0770

Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Langflow · Langflow · EPSS 62.56% · Threat 83
CRITICAL 10
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-54085

AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

AMI · MegaRAC SPx · EPSS 60.75% · Threat 83
CRITICAL 10Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-20131

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

Cisco · Secure Firewall Management Center (FMC) · EPSS 43.17% · Threat 83
HIGH 7.5Top #19
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2014-0160

OpenSSL Information Disclosure Vulnerability

OpenSSL · OpenSSL · EPSS 100.00% · Threat 82
HIGH 7.5Top #13
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2023-32315

Ignite Realtime Openfire Path Traversal Vulnerability

Ignite Realtime · Openfire · EPSS 100.00% · Threat 82
HIGH 7.5Top #12
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2023-44487

HTTP/2 Rapid Reset Attack Vulnerability

IETF · HTTP/2 · EPSS 100.00% · Threat 82
HIGH 7.5Top #52
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-13159

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti · Endpoint Manager (EPM) · EPSS 99.99% · Threat 82
HIGH 7.5Top #54
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2020-3452

Cisco ASA and FTD Read-Only Path Traversal Vulnerability

Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) · EPSS 99.99% · Threat 82
HIGH 7.5Top #69
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-45195

Apache OFBiz Forced Browsing Vulnerability

Apache · OFBiz · EPSS 99.98% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2025-4427

Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) · EPSS 99.93% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2021-22054

Omnissa Workspace ONE Server-Side Request Forgery

Omnissa · Workspace One UEM · EPSS 99.68% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-28995

SolarWinds Serv-U Path Traversal Vulnerability

SolarWinds · Serv-U · EPSS 99.61% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2015-5477

ISC BIND Data Processing Errors Vulnerability

ISC · BIND · EPSS 99.41% · Threat 82
MEDIUM 6.5Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped
CVE-2025-49706

Microsoft SharePoint Improper Authentication Vulnerability

Microsoft · SharePoint · EPSS 99.09% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-29059

Microsoft .NET Framework Information Disclosure Vulnerability

Microsoft · .NET Framework · EPSS 98.62% · Threat 82
HIGH 7.4
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-20767

Adobe ColdFusion Improper Access Control Vulnerability

Adobe · ColdFusion · EPSS 98.51% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-5418

Rails Ruby on Rails Path Traversal Vulnerability

Rails · Ruby on Rails · EPSS 98.51% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2020-25078

D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability

D-Link · DCS-2530L and DCS-2670L Devices · EPSS 97.51% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2021-41277

Metabase GeoJSON API Local File Inclusion Vulnerability

Metabase · Metabase · EPSS 97.18% · Threat 82
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2011-3402

Microsoft Windows Remote Code Execution Vulnerability

Microsoft · Windows · EPSS 78.14% · Threat 82
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2019-15949

Nagios XI Remote Code Execution Vulnerability

Nagios · Nagios XI · EPSS 77.04% · Threat 82
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2008-0015

Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability

Microsoft · Windows · EPSS 76.58% · Threat 82
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2015-7755

Juniper ScreenOS Improper Authentication Vulnerability

Juniper · ScreenOS · EPSS 61.14% · Threat 82
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-58360

OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

OSGeo · GeoServer · EPSS 60.01% · Threat 82
HIGH 8.8Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2023-21529

Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Microsoft · Exchange Server · EPSS 59.29% · Threat 82
HIGH 7.2
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2021-21311

Adminer Server-Side Request Forgery Vulnerability

Adminer · Adminer · EPSS 98.46% · Threat 81
HIGH 7.5
Exploited in the wild · CISA KEVCTID-mapped
CVE-2017-12637

SAP NetWeaver Directory Traversal Vulnerability

SAP · NetWeaver · EPSS 95.11% · Threat 81
HIGH 7.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-6218

RARLAB WinRAR Path Traversal Vulnerability

RARLAB · WinRAR · EPSS 90.48% · Threat 81
HIGH 7.5Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2023-27351

PaperCut NG/MF Improper Authentication Vulnerability

PaperCut · NG/MF · EPSS 78.05% · Threat 81
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2013-3918

Microsoft Windows Out-of-Bounds Write Vulnerability

Microsoft · Windows · EPSS 73.69% · Threat 81
HIGH 8.9
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-73570

Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 71.66% · Threat 81
CRITICAL 9.1
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-55040

Microsoft SharePoint Weak Authentication Vulnerability

Microsoft · SharePoint · EPSS 69.54% · Threat 81
CRITICAL 9.4
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2026-82078

PaperCut NG/MF Unsafe Reflection Vulnerability

PaperCut · NG/MF · EPSS 63.53% · Threat 81
CRITICAL 9.4
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-62593

Ray-Project Ray Code Injection Vulnerability

Ray-Project · Ray · EPSS 62.46% · Threat 81
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2019-19006

Sangoma FreePBX Improper Authentication Vulnerability

Sangoma · FreePBX · EPSS 55.95% · Threat 81
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2022-37055

D-Link Routers Buffer Overflow Vulnerability

D-Link · Routers · EPSS 55.53% · Threat 81
HIGH 7.2
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBCTID-mapped
CVE-2022-43769

Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Hitachi Vantara · Pentaho Business Analytics (BA) Server · EPSS 97.67% · Threat 80
HIGH 7.5
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-38950

ZKTeco BioTime Path Traversal Vulnerability

ZKTeco · BioTime · EPSS 92.47% · Threat 80
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2025-11371

Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

Gladinet · CentreStack and Triofox · EPSS 92.14% · Threat 80
HIGH 7.5
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-13160

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti · Endpoint Manager (EPM) · EPSS 90.98% · Threat 80
HIGH 8.6
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-30066

tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability

tj-actions · changed-files GitHub Action · EPSS 72.09% · Threat 80
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-38812

VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

VMware · vCenter Server · EPSS 54.57% · Threat 80
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-85102

Check Point Multiple Products Improper Certificate Validation Vulnerability

Check Point · Multiple Products · EPSS 54.23% · Threat 80
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2021-22175

GitLab Server-Side Request Forgery (SSRF) Vulnerability

GitLab · GitLab · EPSS 53.37% · Threat 80
CRITICAL 9.3Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-12569

PTC Windchill and FlexPLM Improper Input Validation Vulnerability

PTC · Windchill and FlexPLM · EPSS 46.05% · Threat 80
MEDIUM 6.9
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-12987

DrayTek Vigor Routers OS Command Injection Vulnerability

DrayTek · Vigor Routers · EPSS 98.16% · Threat 79
HIGH 7.5
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-13161

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti · Endpoint Manager (EPM) · EPSS 89.81% · Threat 79
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-43798

Grafana Path Traversal Vulnerability

Grafana Labs · Grafana · EPSS 88.50% · Threat 79
HIGH 7.5
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-1603

Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

Ivanti · Endpoint Manager (EPM) · EPSS 88.33% · Threat 79
HIGH 8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-6204

Dassault Systèmes DELMIA Apriso Code Injection Vulnerability

Dassault Systèmes · DELMIA Apriso · EPSS 79.20% · Threat 79
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2009-0556

Microsoft Office PowerPoint Code Injection Vulnerability

Microsoft · Office · EPSS 67.31% · Threat 79
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2022-23227

NUUO NVRmini2 Devices Missing Authentication Vulnerability

NUUO · NVRmini2 Devices · EPSS 48.50% · Threat 79
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-34910

Ubiquiti UniFi OS Improper Input Validation Vulnerability

Ubiquiti · UniFi OS · EPSS 45.77% · Threat 79
HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-22555

Linux Kernel Heap Out-of-Bounds Write Vulnerability

Linux · Kernel · EPSS 78.68% · Threat 78
CRITICAL 9
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-53690

Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Sitecore · Multiple Products · EPSS 60.60% · Threat 78
CRITICAL 9.1
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-8956

PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

PTZOptics · PT30X-SDI/NDI Cameras · EPSS 58.79% · Threat 78
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-39808

Fortinet FortiSandbox OS Command Injection Vulnerability

Fortinet · FortiSandbox · EPSS 47.36% · Threat 78
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-48282

Adobe ColdFusion Path Traversal Vulnerability

Adobe · ColdFusion · EPSS 42.39% · Threat 78
HIGH 7.2
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-29635

D-Link DIR-823X Command Injection Vulnerability

D-Link · DIR-823X · EPSS 87.94% · Threat 77
HIGH 7.2
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2018-9276

Paessler PRTG Network Monitor OS Command Injection Vulnerability

Paessler · PRTG Network Monitor · EPSS 87.00% · Threat 77
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-9621

Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 81.04% · Threat 77
HIGH 7.8Ransomware
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2024-21338

Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

Microsoft · Windows · EPSS 59.81% · Threat 77
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2023-49105

ownCloud Improper Authentication Vulnerability

ownCloud · ownCloud · EPSS 43.19% · Threat 77
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2019-1068

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft · SQL Server · EPSS 57.27% · Threat 76
CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-23006

SonicWall SMA1000 Appliances Deserialization Vulnerability

SonicWall · SMA1000 Appliances · EPSS 23.43% · Threat 76
HIGH 7.2
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-8957

PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability

PTZOptics · PT30X-SDI/NDI Cameras · EPSS 79.84% · Threat 75
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-21182

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server · EPSS 74.16% · Threat 75
HIGH 7.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-21509

Microsoft Office Security Feature Bypass Vulnerability

Microsoft · Office · EPSS 70.80% · Threat 75
HIGH 7.2Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-57728

SimpleHelp Path Traversal Vulnerability

SimpleHelp · SimpleHelp · EPSS 64.47% · Threat 75
HIGH 8.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-2441

Google Chromium CSS Use-After-Free Vulnerability

Google · Chromium · EPSS 54.96% · Threat 75
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2020-25079

D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

D-Link · DCS-2530L and DCS-2670L Devices · EPSS 54.01% · Threat 75
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-21042

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Samsung · Mobile Devices · EPSS 35.58% · Threat 75
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-20393

Cisco Multiple Products Improper Input Validation Vulnerability

Cisco · Multiple Products · EPSS 32.39% · Threat 75
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-43300

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Apple · iOS, iPadOS, and macOS · EPSS 32.03% · Threat 75
HIGH 7.2
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-44221

SonicWall SMA100 Appliances OS Command Injection Vulnerability

SonicWall · SMA100 Appliances · EPSS 76.25% · Threat 74
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2009-1537

Microsoft DirectX NULL Byte Overwrite Vulnerability

Microsoft · DirectX · EPSS 51.36% · Threat 74
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-85046

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · EPSS 48.88% · Threat 74
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-68645

Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 48.87% · Threat 74
CRITICAL 10
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-56290

Joomlack Page Builder Improper Access Control Vulnerability

Joomlack · Page Builder · EPSS 30.87% · Threat 74
CRITICAL 9.3Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-14733

WatchGuard Firebox Out of Bounds Write Vulnerability

WatchGuard · Firebox · EPSS 26.51% · Threat 74
MEDIUM 6.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-43451

Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability

Microsoft · Windows · EPSS 84.27% · Threat 73
HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-4911

GNU C Library Buffer Overflow Vulnerability

GNU · GNU C Library · EPSS 63.77% · Threat 73
CRITICAL 9.3
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-105134

Ahsay AhsayCBS Command Injection Vulnerability

Ahsay · AhsayCBS · EPSS 38.31% · Threat 73
CRITICAL 9.3
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-39987

Marimo Remote Code Execution Vulnerability

Marimo · Marimo · EPSS 37.87% · Threat 73
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-32756

Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

Fortinet · Multiple Products · EPSS 30.94% · Threat 73
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-76461

Cisco Secure Email Gateway SQL Injection Vulnerability

Cisco · Secure Email Gateway · EPSS 29.54% · Threat 73
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-20963

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft · SharePoint · EPSS 29.20% · Threat 73
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2014-3931

Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability

Looking Glass · Multi-Router Looking Glass (MRLG) · EPSS 28.98% · Threat 73
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-9198

IBM Langflow Code Injection Vulnerability

IBM · Langflow · EPSS 28.66% · Threat 73
CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-11120

GeoVision Devices OS Command Injection Vulnerability

GeoVision · Multiple Devices · EPSS 28.39% · Threat 73
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-31125

Vite Vitejs Improper Access Control Vulnerability

Vite · Vitejs · EPSS 65.76% · Threat 72
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2007-0671

Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft · Office · EPSS 43.24% · Threat 72
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2009-0238

Microsoft Office Remote Code Execution

Microsoft · Office · EPSS 42.94% · Threat 72
CRITICAL 10Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-15409

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

SonicWall · SMA1000 Appliances · EPSS 6.79% · Threat 72
MEDIUM 5.3Top #2
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2021-26086

Atlassian Jira Server and Data Center Path Traversal Vulnerability

Atlassian · Jira Server and Data Center · EPSS 100.00% · Threat 71
MEDIUM 6.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2020-11023

JQuery Cross-Site Scripting (XSS) Vulnerability

JQuery · JQuery · EPSS 84.89% · Threat 71
HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-32463

Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Sudo · Sudo · EPSS 55.50% · Threat 71
HIGH 7.2Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-38094

Microsoft SharePoint Deserialization Vulnerability

Microsoft · SharePoint · EPSS 50.89% · Threat 71
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2023-33538

TP-Link Multiple Routers Command Injection Vulnerability

TP-Link · Multiple Routers · EPSS 41.61% · Threat 71
HIGH 8.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-39780

ASUS RT-AX55 Routers OS Command Injection Vulnerability

ASUS · RT-AX55 Routers · EPSS 39.51% · Threat 71
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2021-26828

OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

OpenPLC · ScadaBR · EPSS 39.10% · Threat 71
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-0300

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Palo Alto Networks · PAN-OS · EPSS 31.72% · Threat 71
CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-4632

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Samsung · MagicINFO 9 Server · EPSS 24.07% · Threat 71
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-60004

Gitea Code Injection Vulnerability

Gitea · Gitea · EPSS 23.99% · Threat 71
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-54948

Trend Micro Apex One OS Command Injection Vulnerability

Trend Micro · Apex One · EPSS 23.92% · Threat 71
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-37079

Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability

Broadcom · VMware vCenter Server · EPSS 22.38% · Threat 71
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-48939

iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

iCagenda · iCagenda · EPSS 20.07% · Threat 71
HIGH 7
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-0411

7-Zip Mark of the Web Bypass Vulnerability

7-Zip · 7-Zip · EPSS 67.07% · Threat 70
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-31200

Apple Multiple Products Memory Corruption Vulnerability

Apple · Multiple Products · EPSS 20.90% · Threat 70
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2021-3199

ONLYOFFICE Docs Server Path Traversal Vulnerability

ONLYOFFICE · Docs · EPSS 20.14% · Threat 70
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2016-7836

SKYSEA Client View Improper Authentication Vulnerability

SKYSEA · Client View · EPSS 19.23% · Threat 70
CRITICAL 10
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-24085

Apple Multiple Products Use-After-Free Vulnerability

Apple · Multiple Products · EPSS 17.51% · Threat 70
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-48907

Widget Factory Joomla Content Editor Improper Access Control Vulnerability

Widget Factory · Joomla Content Editor · EPSS 16.19% · Threat 70
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-34908

Ubiquiti UniFi OS Improper Access Control Vulnerability

Ubiquiti · UniFi OS · EPSS 15.21% · Threat 70
CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVCTID-mapped
CVE-2020-29574

CyberoamOS (CROS) SQL Injection Vulnerability

Sophos · CyberoamOS · EPSS 4.70% · Threat 70
CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-11667

Zyxel Multiple Firewalls Path Traversal Vulnerability

Zyxel · Multiple Firewalls · EPSS 2.93% · Threat 70
CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-59310

Broadcom VMware vCenter Path Traversal Vulnerability

Broadcom · VMware vCenter · EPSS 2.56% · Threat 70
HIGH 7.5
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-25181

Advantive VeraCore SQL Injection Vulnerability

Advantive · VeraCore · EPSS 55.55% · Threat 69