Known exploited vulnerabilities
Reported exploited by CISA or ENISA EUVD.
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 more Microsoft SharePoint Remote Code Execution Vulnerability 8.8 High
- simple-help simplehelp SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification 9.5 Critical
- ptc flexplm, windchill and flexplm, windchill pdmlink +2 more Remote Code Execution (RCE) vulnerability in Windchill PDMlink 9.3 Critical
- cisco unified communications manager Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability 8.6 High
- ubiquiti unifi os, free5gc udm, udr +59 more +61 more A malicious actor with access to the network could exploit an Improper Input Validation... 10.0 Critical
- ubiquiti unifi os, @clerk express, free5gc udm +61 more +63 more A malicious actor with access to the network could exploit a Path Traversal vulnerability found... 10.0 Critical
- ubiquiti unifi os, free5gc udm, udr +59 more +61 more A malicious actor with access to the network could exploit an Improper Access Control... 10.0 Critical
- lantronix eds5000, e210 series, e213f102s firmware +36 more +38 more Lantronix EDS5000, G520, and X300 OS Command Injection 9.3 Critical
- splunk enterprise, splunk +1 more Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise 9.8 Critical
- widgetfactorylimited jce, joomlacontenteditor.net joomla content editor (jce) extension for joomla, widget factory joomla content editor +2 more Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5 10.0 Critical
- cisco catalyst sd-wan manager Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability 6.5 Medium
- litespeed cpanel plugin, litespeedtech litespeed cpanel plugin, litespeed whm plugin +2 more LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0)... 8.5 High
- oracle peoplesoft enterprise peopletools Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:... 9.8 Critical
- ivanti sentry, standalone sentry +1 more An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1... 10.0 Critical
- google chrome, chromium v8 +1 more Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote... 8.8 High
- arista eos, extensible operating system +1 more Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass 6.9 Medium
- cisco catalyst sd-wan manager, catalyst sd-wan controller, sd-wan vsmart controller +2 more Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability 7.8 High
- check point security gateway, checkpoint gaia embedded, gaia os +2 more +4 more User Authentication Bypass in VPN Remote Access and Mobile Access 9.3 Critical
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +5 more +7 more LiteLLM: Authenticated command execution via MCP stdio test endpoints 8.7 High
- solarwinds serv-u SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability 7.5 High
- mirasvit full page cache warmer for magento 2, full page cache warmer +1 more Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection 9.3 Critical
- android framework, google android +1 more In multiple locations, there is a possible way to achieve code execution due to an integer... 8.4 High
- debian linux, linux kernel, canonical ubuntu linux +24 more +26 more Important: kernel security, bug fix, and enhancement update 7.8 High
- oracle weblogic server Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)... 7.5 High
- palo alto networks cloud ngfw, pan-os, prisma access +2 more +4 more PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities 7.8 High
- nx console, nrwl nx-console +1 more Compromised Nx Console version 18.95.0 9.3 Critical
- avb disc soft daemon tools lite, daemon tools lite, disc-soft daemon tools +2 more A supply chain attack compromised the official installation packages of DAEMON Tools Lite ... 9.3 Critical
- tanstack, @tanstack arktype-adapter, eslint-plugin-router +211 more +213 more Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys 9.6 Critical
- litespeed cpanel plugin, litespeed technologies whm plugin, litespeedtech litespeed cpanel plugin +1 more +3 more LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as... 10.0 Critical
- drupal core, drupal +1 more Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 9.8 Critical
- trend micro apex one, trend micro, inc. trendai apex one, trendai apex one as a service +2 more A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre... 6.7 Medium
- langflow Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE 9.4 Critical
- microsoft defender, malware protection engine +1 more Microsoft Defender Elevation of Privilege Vulnerability 7.8 High
- microsoft defender, defender antimalware platform +1 more Microsoft Defender Denial of Service Vulnerability 4.0 Medium
- microsoft internet explorer Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft... 9.3 High
- microsoft internet explorer Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000... 8.8 High
- adobe acrobat, acrobat and reader, acrobat reader +2 more Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9... 9.3 High
- microsoft directx, windows 2000, windows server 2003 +2 more +4 more Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in... 9.3 High
- microsoft windows, windows 2000, windows server 2003 +3 more +5 more The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista... 10.0 High
- microsoft exchange server, microsoft, microsoft exchange server subscription edition +4 more +6 more Microsoft Exchange Server Spoofing Vulnerability 8.1 High
- cisco catalyst sd-wan, catalyst sd-wan manager, catalyst sd-wan controller +2 more +4 more Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability 10.0 Critical
- berriai litellm, red hat lightspeed core, ansible automation platform 2 +1 more +3 more LiteLLM: SQL injection in Proxy API key verification 9.3 Critical
- ivanti endpoint manager mobile, endpoint manager mobile (epmm) +1 more An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1... 7.2 High
- palo alto networks cloud ngfw, pan-os, prisma access +2 more +4 more PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal 9.3 Critical
- amazon linux, linux kernel, arista cloudvision agni +142 more +144 more crypto: algif_aead - Revert to operating out-of-place 7.8 High
- cpanel, cpanel whm, wp squared +1 more +3 more WebPros cPanel and WHM Authentication Bypass via Login Flow 9.3 Critical
- microsoft windows, windows 10 version 1607, windows 10 version 1809 +26 more +28 more Windows Shell Spoofing Vulnerability 4.3 Medium
- connectwise screenconnect Improper limitation of a pathname to a restricted directory (“path traversal”) 8.4 High
- d-link dir-823x, dlink dir-823x firmware +1 more A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized... 7.2 High
- simple-help simplehelp SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files... 7.2 High
- Show olderLoading…