CVERadar

CVEs: Exploited in the wild, page 4

664 CVEs listed as exploited in the wild by CISA KEV or VulnCheck KEV, sorted by threat level then EPSS. Showing 361-480. Use search to combine filters.

HIGH 7.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2023-32434

Apple Multiple Products Integer Overflow Vulnerability

Apple · Multiple Products · EPSS 51.52% · Threat 69
HIGH 8.6
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-9377

TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

TP-Link · Multiple Routers · EPSS 37.73% · Threat 69
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2022-40799

D-Link DNR-322L Download of Code Without Integrity Check Vulnerability

D-Link · DNR-322L · EPSS 33.65% · Threat 69
HIGH 8.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-57968

Advantive VeraCore Unrestricted File Upload Vulnerability

Advantive · VeraCore · EPSS 32.28% · Threat 69
CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-33017

Langflow Code Injection Vulnerability

Langflow · Langflow · EPSS 24.75% · Threat 69
CRITICAL 9.6
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-7971

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · EPSS 21.10% · Threat 69
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-38813

VMware vCenter Server Privilege Escalation Vulnerability

VMware · vCenter Server · EPSS 17.36% · Threat 69
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-58644

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft · SharePoint · EPSS 15.87% · Threat 69
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-9082

Drupal Core SQL Injection Vulnerability

Drupal · Core · EPSS 15.70% · Threat 69
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-56291

Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

Balbooa · Forms · EPSS 14.85% · Threat 69
CRITICAL 10
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-22769

Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability

Dell · RecoverPoint for Virtual Machines (RP4VMs) · EPSS 13.53% · Threat 69
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-86218

N-able N-central Static Code Injection Vulnerability

N-able · N-central · EPSS 13.35% · Threat 69
CRITICAL 9.1Ransomware
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-42999

SAP NetWeaver Deserialization Vulnerability

SAP · NetWeaver · EPSS 12.85% · Threat 69
HIGH 8.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-2533

PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

PaperCut · NG/MF · EPSS 28.83% · Threat 68
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-19490

Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Citrix · NetScaler · EPSS 23.16% · Threat 68
CRITICAL 9.6
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-4947

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · EPSS 15.24% · Threat 68
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-82329

JFrog Artifactory Improper Authentication Vulnerability

JFrog · Artifactory · EPSS 14.37% · Threat 68
HIGH 8.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-49039

Microsoft Windows Task Scheduler Privilege Escalation Vulnerability

Microsoft · Windows · EPSS 14.18% · Threat 68
CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-31201

Apple Multiple Products Arbitrary Read and Write Vulnerability

Apple · Multiple Products · EPSS 13.86% · Threat 68
CRITICAL 9.6Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-45321

TanStack Unspecified Vulnerability

TanStack · TanStack · EPSS 1.05% · Threat 68
MEDIUM 6.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2024-37383

RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

Roundcube · Webmail · EPSS 73.30% · Threat 67
MEDIUM 6.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2019-9978

WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability

WordPress · Social Warfare Plugin · EPSS 72.95% · Threat 67
HIGH 7.2
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2025-58034

Fortinet FortiWeb OS Command Injection Vulnerability

Fortinet · FortiWeb · EPSS 54.72% · Threat 67
HIGH 7.2
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-20118

Cisco Small Business RV Series Routers Command Injection Vulnerability

Cisco · Small Business RV Series Routers · EPSS 54.11% · Threat 67
HIGH 8.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-87902

WordPress Core Remote File Inclusion Vulnerability

WordPress · Core · EPSS 39.98% · Threat 67
HIGH 8.6
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-0994

Trimble Cityworks Deserialization Vulnerability

Trimble · Cityworks · EPSS 31.09% · Threat 67
HIGH 8.7
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-3393

Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

Palo Alto Networks · PAN-OS · EPSS 29.12% · Threat 67
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2018-4063

Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability

Sierra Wireless · AirLink ALEOS · EPSS 27.26% · Threat 67
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2023-28205

Apple Multiple Products WebKit Use-After-Free Vulnerability

Apple · Multiple Products · EPSS 27.08% · Threat 67
CRITICAL 9.2
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-7775

Citrix NetScaler Memory Overflow Vulnerability

Citrix · NetScaler · EPSS 20.28% · Threat 67
CRITICAL 9.3
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-67038

Lantronix EDS5000 Code Injection Vulnerability

Lantronix · EDS5000 · EPSS 19.96% · Threat 67
CRITICAL 9.3
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-9586

Sangoma Switchvox SQL Injection Vulnerability

Sangoma · Switchvox · EPSS 18.98% · Threat 67
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2020-15069

Sophos XG Firewall Buffer Overflow Vulnerability

Sophos · XG Firewall · EPSS 10.67% · Threat 67
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-63030

WordPress Core Interpretation Conflict Vulnerability

WordPress · Core · EPSS 10.65% · Threat 67
CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-6047

GeoVision Devices OS Command Injection Vulnerability

GeoVision · Multiple Devices · EPSS 10.07% · Threat 67
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-83548

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

SonicWall · SMA1000 Appliances · EPSS 8.04% · Threat 67
CRITICAL 9.3Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-48027

Nx Console Embedded Malicious Code Vulnerability

Nx · Nx Console · EPSS 1.34% · Threat 67
HIGH 7.1
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2025-14611

Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

Gladinet · CentreStack and Triofox · EPSS 53.30% · Threat 66
HIGH 7.5
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-28318

SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

SolarWinds · Serv-U · EPSS 43.65% · Threat 66
HIGH 7.7
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-20352

Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

Cisco · IOS and IOS XE · EPSS 41.50% · Threat 66
HIGH 7.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2023-29336

Microsoft Win32K Privilege Escalation Vulnerability

Microsoft · Win32k · EPSS 41.19% · Threat 66
HIGH 8.1
Exploited in the wild · CISA KEVExploit-DBATT&CK inferred
CVE-2008-4128

Cisco IOS Cross-Site Request Forgery Vulnerability

Cisco · IOS · EPSS 33.87% · Threat 66
HIGH 8.6
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-104935

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Ivanti · Connect Secure · EPSS 25.98% · Threat 66
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-21510

Microsoft Windows Shell Protection Mechanism Failure Vulnerability

Microsoft · Windows · EPSS 24.54% · Threat 66
HIGH 8.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-40891

Zyxel DSL CPE OS Command Injection Vulnerability

Zyxel · DSL CPE Devices · EPSS 22.89% · Threat 66
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-14174

Google Chromium Out of Bounds Memory Access Vulnerability

Google · Chromium · EPSS 22.33% · Threat 66
HIGH 8.8
Exploited in the wild · CISA KEVExploit-DBATT&CK inferred
CVE-2020-24363

TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

TP-Link · TL-WA855RE · EPSS 22.19% · Threat 66
HIGH 7.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2018-8639

Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability

Microsoft · Windows · EPSS 22.18% · Threat 66
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-10585

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · EPSS 6.06% · Threat 66
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-75650

Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Adobe · Commerce and Magento · EPSS 3.95% · Threat 66
CRITICAL 10
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-24201

Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

Apple · Multiple Products · EPSS 3.85% · Threat 66
CRITICAL 10
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-32975

Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

Quest · KACE Systems Management Appliance (SMA) · EPSS 2.49% · Threat 66
CRITICAL 10
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-49869

Kestra OSS OS Command Injection Vulnerability

Kestra · Kestra OSS · EPSS 2.10% · Threat 66
CRITICAL 10
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-34909

Ubiquiti UniFi OS Path Traversal Vulnerability

Ubiquiti · UniFi OS · EPSS 1.79% · Threat 66
HIGH 7.2
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2021-40407

Reolink RLC-410W IP Camera OS Command Injection Vulnerability

Reolink · RLC-410W IP Camera · EPSS 47.63% · Threat 65
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-2775

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

SysAid · SysAid On-Prem · EPSS 42.61% · Threat 65
HIGH 8.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-40890

Zyxel DSL CPE OS Command Injection Vulnerability

Zyxel · DSL CPE Devices · EPSS 20.70% · Threat 65
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-21589

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Atlassian · Multiple Products · EPSS 12.71% · Threat 65
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-64849

MLflow Server-Side Request Forgery Vulnerability

MLflow · MLflow · EPSS 10.02% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-20045

Cisco Unified Communications Products Code Injection Vulnerability

Cisco · Unified Communications Manager · EPSS 4.54% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-25249

Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Fortinet · Multiple Products · EPSS 3.80% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-66644

Array Networks ArrayOS AG OS Command Injection Vulnerability

Array Networks · ArrayOS AG · EPSS 3.42% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-42599

Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability

Qualitia · Active! Mail · EPSS 3.36% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-50522

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft · SharePoint · EPSS 3.04% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-39682

Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

Linux · Kernel · EPSS 2.88% · Threat 65
HIGH 8.8Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-45659

Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

Microsoft · SharePoint Server · EPSS 2.70% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-21043

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Samsung · Mobile Devices · EPSS 2.22% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-104286

Fortinet FortiMail Path Traversal Vulnerability

Fortinet · FortiMail · EPSS 2.20% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-76504

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Cisco · Catalyst SD-WAN Manager · EPSS 1.82% · Threat 65
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-65400

Apple macOS Improper Authentication Vulnerability

Apple · macOS · EPSS 1.72% · Threat 65
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-48172

LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

LiteSpeed · cPanel Plugin · EPSS 1.01% · Threat 65
CRITICAL 10
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-16812

Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

Arista · VeloCloud Orchestrator · EPSS 1.00% · Threat 65
CRITICAL 9.9
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-84869

ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

ConnectWise · ScreenConnect · EPSS 0.92% · Threat 65
CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-5430

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 · Multiple Products · EPSS 0.59% · Threat 65
HIGH 7.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2020-9715

Adobe Acrobat Use-After-Free Vulnerability

Adobe · Acrobat · EPSS 33.49% · Threat 64
HIGH 7Ransomware
Exploited in the wild · CISA KEVExploit-DBATT&CK inferred
CVE-2025-26633

Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

Microsoft · Windows · EPSS 30.39% · Threat 64
HIGH 8.1
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-27363

FreeType Out-of-Bounds Write Vulnerability

FreeType · FreeType · EPSS 27.77% · Threat 64
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-21513

Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability

Microsoft · Windows · EPSS 15.85% · Threat 64
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-34197

Apache ActiveMQ Improper Input Validation Vulnerability

Apache · ActiveMQ · EPSS 15.49% · Threat 64
CRITICAL 9.2
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-6543

Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

Citrix · NetScaler ADC and Gateway · EPSS 10.56% · Threat 64
CRITICAL 9.5
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2026-48558

SimpleHelp Authentication Bypass Vulnerability

SimpleHelp · SimpleHelp · EPSS 5.72% · Threat 64
CRITICAL 9.5
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-88772

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix · NetScaler · EPSS 5.30% · Threat 64
CRITICAL 9.5
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-88771

Citrix NetScaler Improper Input Validation Vulnerability

Citrix · NetScaler · EPSS 5.11% · Threat 64
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-24989

Microsoft Power Pages Improper Access Control Vulnerability

Microsoft · Power Pages · EPSS 1.62% · Threat 64
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-33824

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Microsoft · Internet Key Exchange (IKE) Service Extensions · EPSS 1.62% · Threat 64
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-76519

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Cisco · Secure Email Gateway · EPSS 1.57% · Threat 64
CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-49035

Microsoft Partner Center Improper Access Control Vulnerability

Microsoft · Partner Center · EPSS 1.30% · Threat 64
CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-56164

Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

Microsoft · SharePoint Server · EPSS 1.01% · Threat 64
CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-46817

Oracle E-Business Suite Improper Privilege Management Vulnerability

Oracle · E-Business Suite · EPSS 0.81% · Threat 64
HIGH 7.2
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-41710

Mitel SIP Phones Argument Injection Vulnerability

Mitel · SIP Phones · EPSS 41.65% · Threat 63
HIGH 7.5
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2021-39935

GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

GitLab · Community and Enterprise Editions · EPSS 36.14% · Threat 63
HIGH 7.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2024-38193

Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability

Microsoft · Windows · EPSS 28.74% · Threat 63
HIGH 7.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-29824

Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Microsoft · Windows · EPSS 13.90% · Threat 63
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2019-9875

Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Sitecore · CMS and Experience Platform (XP) · EPSS 13.79% · Threat 63
HIGH 8.1Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-24472

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Fortinet · FortiOS and FortiProxy · EPSS 7.23% · Threat 63
CRITICAL 9.2
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-86060

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

MikroTik · RouterOS · EPSS 6.39% · Threat 63
CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-42208

BerriAI LiteLLM SQL Injection Vulnerability

BerriAI · LiteLLM · EPSS 5.77% · Threat 63
CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-3055

Citrix NetScaler Out-of-Bounds Read Vulnerability

Citrix · NetScaler · EPSS 4.04% · Threat 63
CRITICAL 9.4
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-8876

N-able N-Central Command Injection Vulnerability

N-able · N-Central · EPSS 3.45% · Threat 63
CRITICAL 9.4
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-8875

N-able N-Central Insecure Deserialization Vulnerability

N-able · N-Central · EPSS 1.90% · Threat 63
CRITICAL 9.4
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-33634

Aquasecurity Trivy Embedded Malicious Code Vulnerability

Aquasecurity · Trivy · EPSS 1.75% · Threat 63
CRITICAL 9.5
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-72530

TrueConf Server Code Injection Vulnerability

TrueConf · Server · EPSS 1.69% · Threat 63
CRITICAL 9.5
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-93952

Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

Arista · VeloCloud Orchestrator · EPSS 1.06% · Threat 63
HIGH 7.2
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2019-11001

Reolink Multiple IP Cameras OS Command Injection Vulnerability

Reolink · Multiple IP Cameras · EPSS 37.54% · Threat 62
HIGH 7.5
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-20133

Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Cisco · Catalyst SD-WAN Manager · EPSS 31.48% · Threat 62
HIGH 7.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2024-49138

Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Microsoft · Windows · EPSS 26.21% · Threat 62
HIGH 7.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-20245

Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

Cisco · Catalyst SD-WAN Manager · EPSS 25.32% · Threat 62
HIGH 7.8
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2024-35250

Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

Microsoft · Windows · EPSS 25.22% · Threat 62
HIGH 8.1
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-23209

Craft CMS Code Injection Vulnerability

Craft CMS · Craft CMS · EPSS 21.78% · Threat 62
HIGH 8.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-6558

Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

Google · Chromium · EPSS 10.93% · Threat 62
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-23222

Apple Multiple Products WebKit Type Confusion Vulnerability

Apple · Multiple Products · EPSS 10.59% · Threat 62
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-44308

Apple Multiple Products Code Execution Vulnerability

Apple · Multiple Products · EPSS 10.16% · Threat 62
HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-43529

Apple Multiple Products Use-After-Free WebKit Vulnerability

Apple · Multiple Products · EPSS 8.76% · Threat 62
HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-42016

JFrog Artifactory Incorrect Authorization Vulnerability

JFrog · Artifactory · EPSS 8.64% · Threat 62
CRITICAL 9.3
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-61932

Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability

Motex · LANSCOPE Endpoint Manager · EPSS 2.77% · Threat 62
CRITICAL 9.3
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-53521

F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

F5 · BIG-IP · EPSS 2.30% · Threat 62
CRITICAL 9.2
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-110447

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Collabora · Collabora Online – Built-in CODE Server · EPSS 2.28% · Threat 62
CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-94127

F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

F5 · BIG-IP APM · EPSS 2.23% · Threat 62
CRITICAL 9.3
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-45247

Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability

Mirasvit · Mirasvit Full Page Cache Warmer · EPSS 2.08% · Threat 62
CRITICAL 9.3
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-72529

TrueConf Server Missing Authentication for Critical Function Vulnerability

TrueConf · Server · EPSS 1.46% · Threat 62