Known exploited vulnerabilities
Reported exploited by CISA or ENISA EUVD.
- red hat automatic bug reporting tool, oracle linux, redhat enterprise linux +4 more +6 more The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local... 7.8 High
- libuser project libuser, opensuse, redhat enterprise linux +2 more libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the... 7.2 High
- gitea Gitea: Remote Code Execution via diffpatch Git Hook Installation 9.8 Critical
- oracle http server, weblogic server proxy plug-in, oracle corporation http server, oracle weblogic server proxy plug-in +1 more +3 more Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle... 10.0 Critical
- microsoft entra id, entra +1 more Microsoft Entra ID Remote Code Execution Vulnerability 10.0 Critical
- trueconf server A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server... 9.5 Critical
- trueconf server A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server... 9.3 Critical
- lfprojects mlflow MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) 9.3 Critical
- zimbra collaboration, synacor zimbra collaboration suite (zcs), zimbra collaboration suite +2 more A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when... 8.9 High
- apple macos An authentication issue was addressed with improved state management. This issue is fixed in... 9.8 Critical
- microsoft sharepoint, sharepoint server, sharepoint enterprise server 2016 +2 more +4 more Microsoft SharePoint Server Security Feature Bypass Vulnerability 9.1 Critical
- microsoft internet key exchange (ike) service extensions, windows 10 version 1607, windows 10 version 1809 +23 more +25 more Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability 9.8 Critical
- paperclipai paperclip, paperclip paperclipai, paperclipai\/server +1 more +3 more Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass 10.0 Critical
- anyscale ray Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack 9.4 Critical
- cisco secure firewall adaptive security appliance (asa) software, secure firewall threat defense (ftd) software, secure firewall threat defense +2 more +4 more Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability 8.6 High
- microsoft windows ancillary function driver for winsock, windows 10 version 1607, windows 10 version 1809 +25 more +27 more Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.0 High
- metabase Metabase SQL injection via password reset endpoint 10.0 Critical
- broadcom vmware vcenter, vmware vcenter, cloud foundation +4 more +6 more vCenter directory-traversal vulnerability 9.8 Critical
- progress ecs connection manager, loadmaster, progress software moveit waf +4 more +6 more OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF 9.6 Critical
- jetbrains teamcity In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was... 9.8 Critical
- n-able n-central Unauthenticated administrative account takeover 8.2 High
- ibm langflow, langflow oss +1 more Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation 9.8 Critical
- apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +21 more +23 more Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor 7.5 High
- n-able n-central Incomplete patch leads to administrative account takeover 8.2 High
- cisco secure firewall management center (fmc), secure firewall management center +1 more Cisco Secure Firewall Management Center Software Static Credential Vulnerability 5.3 Medium
- arista velocloud orchestrator, arista networks velocloud orchestrator on-prem +1 more VeloCloud Orchestrator OS Command Injection 10.0 Critical
- fortinet fortios An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200]... 5.3 Medium
- check point smartconsole, checkpoint multi-domain security management, quantum security management +2 more Authentication Bypass in the SmartConsole Login Process Using an Application Token 9.3 Critical
- microsoft sharepoint, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 more Microsoft SharePoint Remote Code Execution Vulnerability 9.8 Critical
- wordpress, wordpress core +1 more WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution 9.8 Critical
- wordpress, wordpress core +1 more WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query 5.9 Medium
- dd-wrt An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the... 8.1 High
- langflow Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability 9.8 Critical
- microsoft sharepoint, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 more Microsoft SharePoint Remote Code Execution Vulnerability 9.8 Critical
- fortinet fortisandbox, fortisandbox cloud, fortisandbox paas +2 more A improper neutralization of special elements used in an os command ('os command injection')... 9.1 Critical
- fortinet fortisandbox, fortisandbox paas +1 more A improper neutralization of special elements used in an os command ('os command injection')... 9.1 Critical
- oracle e-business suite, oracle corporation payments +1 more Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File... 9.8 Critical
- knx connection authorization, knx association protocol connection authorization option 1 +1 more KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the... 7.5 High
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 more Post-authentication improper control of generation of code ('Code Injection') vulnerability has... 7.2 High
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 more A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance... 10.0 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 more Microsoft SharePoint Server Elevation of Privilege Vulnerability 5.3 Medium
- microsoft active directory federation services, windows 10 version 1607, windows 10 version 1809 +13 more +15 more Active Directory Federation Services Elevation of Privilege Vulnerability 7.8 High
- cisco ios Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component... 9.3 High
- balbooa forms, balbooa.com balbooa forms extension for joomla +1 more Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 10.0 Critical
- ollyo helix3, joomshaper.com helix3 extension for joomla +1 more Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler 7.5 High
- icagenda, icagenda.com icagenda extension for joomla +1 more Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15 10.0 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 more ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 10.0 Critical
- joomlack page builder, page builder ck, joomlack.fr page builder ck extension for joomla +2 more Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 10.0 Critical
- langflow Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow 8.4 High
- joomshaper sp page builder, joomshaper.net sp page builder extension for joomla +1 more Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2 10.0 Critical
- Show olderLoading…