Skip to content

CVEs: Metasploit module

373 CVEs with a public Metasploit Framework module, sorted by threat level then EPSS. Showing 1-120. Use search to combine filters.

CRITICAL 10RansomwareTop #29

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

Ivanti · Pulse Connect Secure · EPSS 100.00% · Threat 100

CRITICAL 10RansomwareTop #24

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Apache Log4j2 Remote Code Execution Vulnerability

Apache · Log4j2 · EPSS 100.00% · Threat 100

CRITICAL 10RansomwareTop #5

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Palo Alto Networks PAN-OS Command Injection Vulnerability

Palo Alto Networks · PAN-OS · EPSS 100.00% · Threat 100

CRITICAL 10RansomwareTop #75

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

ConnectWise ScreenConnect Authentication Bypass Vulnerability

ConnectWise · ScreenConnect · EPSS 99.98% · Threat 100

CRITICAL 10Ransomware

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Meta React Server Components Remote Code Execution Vulnerability

Meta · React Server Components · EPSS 99.80% · Threat 100

CRITICAL 9.8RansomwareTop #26

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Apache Struts Remote Code Execution Vulnerability

Apache · Struts · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #27

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

Fortinet · FortiOS · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #28

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Microsoft Remote Desktop Services Remote Code Execution Vulnerability

Microsoft · Remote Desktop Services · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #30

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #31

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

F5 · BIG-IP · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #33

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

VMware vCenter Server Improper Input Validation Vulnerability

VMware · vCenter Server · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #34

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

VMware vCenter Server File Upload Vulnerability

VMware · vCenter Server · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #35

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Atlassian · Confluence Server and Data Center · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #37

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

ForgeRock · Access Management (AM) · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #18

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

Atlassian · Confluence Server/Data Center · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #20

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

WSO2 · Multiple Products · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #10

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

Atlassian · Confluence Data Center and Server · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #16

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

PaperCut MF/NG Improper Access Control Vulnerability

PaperCut · MF/NG · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #4

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Jenkins · Jenkins Command Line Interface (CLI) · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #1

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft · SharePoint · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #39

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

VMware · Workspace ONE Access and Identity Manager · EPSS 100.00% · Threat 99

CRITICAL 9.8RansomwareTop #51

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Langflow Missing Authentication Vulnerability

Langflow · Langflow · EPSS 99.99% · Threat 99

CRITICAL 9.8RansomwareTop #55

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Apache HTTP Server Path Traversal Vulnerability

Apache · HTTP Server · EPSS 99.99% · Threat 99

CRITICAL 9.8RansomwareTop #58

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Drupal Core Remote Code Execution Vulnerability

Drupal · Drupal Core · EPSS 99.99% · Threat 99

CRITICAL 9.8RansomwareTop #63

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

JetBrains TeamCity Authentication Bypass Vulnerability

JetBrains · TeamCity · EPSS 99.99% · Threat 99

CRITICAL 9.8RansomwareTop #62

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

PHP-CGI OS Command Injection Vulnerability

PHP Group · PHP · EPSS 99.99% · Threat 99

CRITICAL 9.8RansomwareTop #68

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Fortinet Multiple Products Authentication Bypass Vulnerability

Fortinet · Multiple Products · EPSS 99.98% · Threat 99

CRITICAL 9.8RansomwareTop #66

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Atlassian Confluence Data Center and Server Template Injection Vulnerability

Atlassian · Confluence Data Center and Server · EPSS 99.98% · Threat 99

CRITICAL 9.8RansomwareTop #67

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Microsoft SharePoint Server Privilege Escalation Vulnerability

Microsoft · SharePoint Server · EPSS 99.98% · Threat 99

CRITICAL 9.8RansomwareTop #71

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Ivanti · Connect Secure, Policy Secure, and ZTA Gateways · EPSS 99.98% · Threat 99

CRITICAL 9.8RansomwareTop #79

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Oracle WebLogic Server, Injection

Oracle · WebLogic Server · EPSS 99.98% · Threat 99

CRITICAL 9.8RansomwareTop #89

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Apache HTTP Server Path Traversal Vulnerability

Apache · HTTP Server · EPSS 99.96% · Threat 99

CRITICAL 9.8RansomwareTop #96

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

F5 BIG-IP Missing Authentication Vulnerability

F5 · BIG-IP · EPSS 99.95% · Threat 99

CRITICAL 9.8RansomwareTop #97

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Ivanti Sentry Authentication Bypass Vulnerability

Ivanti · Sentry · EPSS 99.95% · Threat 99

CRITICAL 9.8Ransomware

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

JetBrains TeamCity Authentication Bypass Vulnerability

JetBrains · TeamCity · EPSS 99.94% · Threat 99

CRITICAL 9.8Ransomware

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Oracle E-Business Suite Unspecified Vulnerability

Oracle · E-Business Suite · EPSS 99.73% · Threat 99

CRITICAL 9.8Ransomware

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Rejetto · HTTP File Server · EPSS 99.48% · Threat 99

CRITICAL 9.8Ransomware

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

CyberPanel Incorrect Default Permissions Vulnerability

CyberPersons · CyberPanel · EPSS 94.75% · Threat 97

CRITICAL 9.8Ransomware

Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred

Cleo Multiple Products Unauthenticated File Upload Vulnerability

Cleo · Multiple Products · EPSS 93.97% · Threat 97

CRITICAL 9.9Ransomware

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

BeyondTrust · Remote Support (RS) and Privileged Remote Access (PRA) · EPSS 92.46% · Threat 97

CRITICAL 9.3Ransomware

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

Palo Alto Networks · PAN-OS · EPSS 99.86% · Threat 96

CRITICAL 9.3Ransomware

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

WebPros · cPanel & WHM and WP2 (WordPress Squared) · EPSS 98.53% · Threat 96

CRITICAL 9.8Ransomware

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

JetBrains · TeamCity · EPSS 89.57% · Threat 96

CRITICAL 10Ransomware

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

SmarterTools · SmarterMail · EPSS 85.66% · Threat 96

CRITICAL 9.1RansomwareTop #36

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · EPSS 100.00% · Threat 95

CRITICAL 9.1RansomwareTop #8

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Ivanti · Connect Secure and Policy Secure · EPSS 100.00% · Threat 95

CRITICAL 9.1RansomwareTop #44

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · EPSS 100.00% · Threat 95

CRITICAL 9RansomwareTop #59

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft · Exchange Server · EPSS 99.99% · Threat 95

CRITICAL 9RansomwareTop #78

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

Apache · Log4j2 · EPSS 99.98% · Threat 95

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Craft CMS Code Injection Vulnerability

Craft CMS · Craft CMS · EPSS 99.79% · Threat 95

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

ProFTPD Improper Access Control Vulnerability

ProFTPD · ProFTPD · EPSS 99.50% · Threat 95

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Erlang · Erlang/OTP · EPSS 98.79% · Threat 95

CRITICAL 9.8Top #23

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

GNU · Bourne-Again Shell (Bash) · EPSS 100.00% · Threat 94

CRITICAL 9.8Top #22

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Microsoft HTTP.sys Remote Code Execution Vulnerability

Microsoft · HTTP.sys · EPSS 100.00% · Threat 94

CRITICAL 9.8Top #32

Exploited in the wild · CISA KEVMetasploit moduleCTID-mapped

Cisco HyperFlex HX Data Platform Command Injection Vulnerability

Cisco · HyperFlex HX · EPSS 100.00% · Threat 94

CRITICAL 9.8Top #3

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

Ivanti · Virtual Traffic Manager · EPSS 100.00% · Threat 94

CRITICAL 9.8Top #40

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

PHP-CGI Query String Parameter Vulnerability

PHP · PHP · EPSS 100.00% · Threat 94

CRITICAL 9.8Top #41

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred

Apache Struts Improper Input Validation Vulnerability

Apache · Struts · EPSS 100.00% · Threat 94

CRITICAL 9.8Top #38

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Hikvision Multiple Products Improper Authentication Vulnerability

Hikvision · Multiple Products · EPSS 100.00% · Threat 94

CRITICAL 9.8Top #42

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Oracle WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server · EPSS 100.00% · Threat 94

CRITICAL 9.8Top #47

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

CWP Control Web Panel OS Command Injection Vulnerability

CWP · Control Web Panel · EPSS 100.00% · Threat 94

HIGH 8.8RansomwareTop #45

Exploited in the wild · CISA KEVMetasploit moduleCTID-mapped

Microsoft SharePoint Code Injection Vulnerability

Microsoft · SharePoint · EPSS 100.00% · Threat 94

CRITICAL 9.8Top #48

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

Adobe · Commerce and Magento Open Source · EPSS 99.99% · Threat 94

CRITICAL 9.8Top #65

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 99.99% · Threat 94

CRITICAL 9.8Top #74

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Microsoft · Windows · EPSS 99.98% · Threat 94

HIGH 8.8RansomwareTop #81

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred

Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

Microsoft · MSCOMCTL.OCX · EPSS 99.98% · Threat 94

CRITICAL 9.8Top #83

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred

Realtek SDK Improper Input Validation Vulnerability

Realtek · SDK · EPSS 99.97% · Threat 94

HIGH 8.8RansomwareTop #91

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

Microsoft · Exchange Server · EPSS 99.96% · Threat 94

CRITICAL 9.8Top #92

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Exim Mail Transfer Agent (MTA) Improper Input Validation

Exim · Mail Transfer Agent (MTA) · EPSS 99.96% · Threat 94

CRITICAL 9.8Top #93

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server · EPSS 99.96% · Threat 94

HIGH 8.8RansomwareTop #95

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Microsoft Exchange Server Server-Side Request Forgery Vulnerability

Microsoft · Exchange Server · EPSS 99.96% · Threat 94

CRITICAL 9.8Top #98

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Adobe ColdFusion Unrestricted File Upload Vulnerability

Adobe · ColdFusion · EPSS 99.95% · Threat 94

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Apache Tomcat Path Equivalence Vulnerability

Apache · Tomcat · EPSS 99.93% · Threat 94

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

XWiki Platform Eval Injection Vulnerability

XWiki · Platform · EPSS 99.86% · Threat 94

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

PHPMailer Command Injection Vulnerability

PHP · PHPMailer · EPSS 99.71% · Threat 94

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

CVE-2017-1000353

Jenkins Remote Code Execution Vulnerability

Jenkins · Jenkins · EPSS 99.68% · Threat 94

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Apache HugeGraph-Server Improper Access Control Vulnerability

Apache · HugeGraph-Server · EPSS 99.21% · Threat 94

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Nostromo nhttpd Directory Traversal Vulnerability

Nostromo · nhttpd · EPSS 99.03% · Threat 94

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

GNU InetUtils Argument Injection Vulnerability

GNU · InetUtils · EPSS 98.98% · Threat 94

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Microsoft Windows Buffer Overflow Vulnerability

Microsoft · Windows · EPSS 98.75% · Threat 94

Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) · EPSS 98.69% · Threat 94

Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) · EPSS 98.64% · Threat 94

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Sangoma FreePBX Authentication Bypass Vulnerability

Sangoma · FreePBX · EPSS 95.02% · Threat 94

CRITICAL 9.8Ransomware

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

CyberPanel Incorrect Default Permissions Vulnerability

CyberPersons · CyberPanel · EPSS 84.40% · Threat 94

HIGH 8.6RansomwareTop #77

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Check Point Quantum Security Gateways Information Disclosure Vulnerability

Check Point · Quantum Security Gateways · EPSS 99.98% · Threat 93

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

Progress · Telerik Report Server · EPSS 97.48% · Threat 93

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Progress Kemp LoadMaster OS Command Injection Vulnerability

Progress · Kemp LoadMaster · EPSS 95.39% · Threat 93

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

Wing FTP Server · Wing FTP Server · EPSS 93.88% · Threat 93

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Wazuh Server Deserialization of Untrusted Data Vulnerability

Wazuh · Wazuh Server · EPSS 93.84% · Threat 93

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

GitLab · Community Edition and Enterprise Edition · EPSS 91.95% · Threat 93

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Cisco · Catalyst SD-WAN · EPSS 91.82% · Threat 93

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Fortinet FortiManager Missing Authentication Vulnerability

Fortinet · FortiManager · EPSS 94.77% · Threat 92

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred

NUUO NVRmini Devices OS Command Injection Vulnerability

NUUO · NVRmini Devices · EPSS 94.76% · Threat 92

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server · EPSS 94.58% · Threat 92

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability

Gladinet · CentreStack · EPSS 94.34% · Threat 92

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBCTID-mapped

Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

Hitachi Vantara · Pentaho Business Analytics (BA) Server · EPSS 92.27% · Threat 92

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

Fortinet FortiWeb Path Traversal Vulnerability

Fortinet · FortiWeb · EPSS 91.97% · Threat 92

Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Samsung · MagicINFO 9 Server · EPSS 91.94% · Threat 92

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

ProjectSend Improper Authentication Vulnerability

ProjectSend · ProjectSend · EPSS 91.85% · Threat 92

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

Cisco · Catalyst SD-WAN Controller and Manager · EPSS 89.29% · Threat 92

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management · EPSS 88.47% · Threat 92

HIGH 8.2RansomwareTop #6

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

Ivanti · Connect Secure, Policy Secure, and Neurons · EPSS 100.00% · Threat 91

HIGH 8.2RansomwareTop #64

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

Ivanti · Connect Secure and Policy Secure · EPSS 99.99% · Threat 91

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Craft CMS Code Injection Vulnerability

Craft CMS · Craft CMS · EPSS 97.41% · Threat 91

HIGH 8.4Ransomware

Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred

ConnectWise ScreenConnect Path Traversal Vulnerability

ConnectWise · ScreenConnect · EPSS 95.44% · Threat 91

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability

Hewlett Packard Enterprise (HPE) · OneView · EPSS 90.19% · Threat 91

HIGH 8RansomwareTop #84

Exploited in the wild · CISA KEVMetasploit modulePublic PoCCTID-mapped

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · EPSS 99.97% · Threat 90

Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

BeyondTrust · Privileged Remote Access (PRA) and Remote Support (RS) · EPSS 87.26% · Threat 90

HIGH 7.8RansomwareTop #100

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped

Microsoft Office Memory Corruption Vulnerability

Microsoft · Office · EPSS 99.94% · Threat 89

Metasploit moduleExploit-DBPublic PoCATT&CK inferred

CVE-2022-42889: Apache Commons Text performs variable interpolation, allowing properties to be dynamically…

apache · commons text · EPSS 99.93% · Threat 89

Metasploit moduleExploit-DBATT&CK inferred

CVE-2022-37061: All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to …

flir · flir ax8 firmware · EPSS 99.61% · Threat 89

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred

GNU Bash OS Command Injection Vulnerability

GNU · GNU Bash · EPSS 99.59% · Threat 89

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

n8n · n8n · EPSS 98.99% · Threat 89

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube · Webmail · EPSS 98.97% · Threat 89

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Adobe Commerce and Magento Improper Input Validation Vulnerability

Adobe · Commerce and Magento · EPSS 94.66% · Threat 89

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred

Palo Alto Networks Expedition Missing Authentication Vulnerability

Palo Alto Networks · Expedition · EPSS 91.68% · Threat 89

Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

SolarWinds · Web Help Desk · EPSS 84.18% · Threat 89

Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred

Mozilla Multiple Products Remote Code Execution Vulnerability

Mozilla · Multiple Products · EPSS 83.16% · Threat 89

Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred

Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

Ajax.NET Professional · Ajax.NET Professional · EPSS 82.58% · Threat 89

Metasploit moduleExploit-DBPublic PoCATT&CK inferred

CVE-2023-6553: The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all ve…

backupbliss · backup migration · EPSS 97.85% · Threat 88