Known exploited vulnerabilities
Reported exploited by CISA or ENISA EUVD.
- wso2 api control plane, api manager, multiple products +3 more +5 more Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover 10.0 Critical
- wordpress core, wordpress +1 more WordPress Core Remote File Inclusion Vulnerability 8.1 High
- f5 big-ip, big-ip apm, big-ip access policy manager +2 more BIG-IP APM OAuth vulnerability 9.3 Critical
- check point multiple products, checkpoint multi-domain security management, quantum security management +2 more Directory Traversal and File upload allows execution of arbitrary script on the Management Server 9.8 Critical
- arista velocloud orchestrator, arista networks velocloud orchestrator (vco) on-prem +1 more Security Advisory 0183 9.5 Critical
- checkpoint quantum security gateway, check point multiple products, checkpoint gaia embedded +1 more +3 more Improper Certificate Validation in Quantum Security Gateway 9.8 Critical
- zyxel gs1900-48hpv2 firmware, gs1900 series switches, gs1900-10hp firmware +8 more +10 more A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware... 8.8 High
- linux kernel, linux +1 more netfilter: bridge: make ebt_snat ARP rewrite writable 8.8 High
- linux kernel, linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +4 more +6 more crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg 7.8 High
- debian linux, linux kernel, siemens simatic cn 4100 +1 more +3 more tls: fix handling of zero-length records on the rx_list 9.8 Critical
- acronis backup extension for plesk, backup plugin for cpanel & whm, backup plugin for directadmin +1 more +3 more Local privilege escalation due to insecure file permissions. The following products are affected:... 7.8 High
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 more Cisco Identity Services Engine Authentication Bypass Vulnerability 10.0 Critical
- google android, pixel +1 more In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This... 8.8 High
- cisco asyncos, secure email, secure email gateway +2 more Cisco Secure Email Gateway SQL Injection Vulnerability 9.8 Critical
- gitlab, gitlab community edition and enterprise edition +1 more Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab 10.0 Critical
- connectwise screenconnect ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions 9.9 Critical
- jfrog artifactory Anonymous user token generation exposure in JFrog Artifactory 7.5 High
- jfrog artifactory Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation 8.1 High
- google chrome, chromium v8 +1 more Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to... 8.8 High
- citrix netscaler, netscaler gateway, netscaler adc +2 more +4 more NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 9.3 Critical
- cisco secure firewall management center (fmc), secure firewall management center, secure firewall management center (fmc) and security cloud control (scc) firewall management +2 more Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability 10.0 Critical
- fortinet fortios, fortiswitchmanager, fortisase +3 more +5 more A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0... 7.4 High
- microsoft windows, windows 11 version 23h2, windows 11 version 24h2 +8 more +10 more Windows Update Stack Elevation of Privilege Vulnerability 7.8 High
- microsoft windows, windows 10 version 1607, windows 10 version 1809 +15 more +17 more Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability 7.8 High
- adobe commerce, commerce b2b, commerce and magento +3 more +5 more Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) 10.0 Critical
- n-able n-central pre-authentication remote code execution 10.0 Critical
- mikrotik routeros SSH session privilege manipulation via a crafted username in Mikrotik RouterOS 9.2 Critical
- mikrotik routeros Kernel memory disclosure and denial of service in MikroTik RouterOS btest service 8.8 High
- mikrotik routeros SSH user impersonation possible in Mikrotik RouterOS 9.2 Critical
- google chrome, v8, chromium v8 +2 more Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute... 8.8 High
- geonetwork core-geonetwork Unauthenticated file upload via missing authorization on formatter upload endpoint 8.6 High
- geonetwork core-geonetwork GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter 9.1 Critical
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 more Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS... 7.8 High
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 more A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due... 10.0 Critical
- jfrog artifactory Potential authentication bypass leading to administrative access in Artifactory 9.8 Critical
- sangoma switchvox, switchvox smb edition +1 more Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB 9.3 Critical
- berriai litellm LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback 8.8 High
- kestra, kestra oss +1 more Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter` 10.0 Critical
- encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 more Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks 6.5 Medium
- papercut mf/ng, mf, ng +1 more +3 more PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector 9.4 Critical
- papercut mf/ng, mf, ng +1 more +3 more PaperCut MF/NG: Authentication Bypass 8.8 High
- unknown ctn720-w1, lf-1541, mt7620n +13 more +15 more Zbtlink MQWrt infosrvd Command Injection 9.3 Critical
- morequick mqac-7620, mqac-7620a, mqap-7620 +12 more +14 more Zbtlink MQWrt yunmgrd Cloud C2 Implant 9.3 Critical
- jfrog artifactory Authenticated users may write data outside the intended Docker cache path 5.3 Medium
- linux kernel, linux, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 more +3 more ipv6: account for fraggap on the paged allocation path 7.8 High
- owncloud, owncloud server +1 more An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify,... 9.8 Critical
- citrix netscaler adc and netscaler gateway, netscaler gateway, netscaler adc +2 more +4 more Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service 8.8 High
- linux kernel, fedoraproject fedora, netapp h300e firmware +10 more +12 more An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event... 7.8 High
- ajaxpro.2 project ajaxpro.2, ajax.net professional professional, michaelschwarz ajax.net professional +2 more Deserialization of Untrusted Data 8.1 High
- microsoft sql server, sql server 2014 service pack 2 for 32-bit systems (gdr), sql server 2014 service pack 2 for x64-based systems (gdr) +9 more +11 more A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles... 8.8 High
- Show olderLoading…