Known exploited vulnerabilities
Reported exploited by CISA or ENISA EUVD.
- sysaid, sysaid on-prem +1 more SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection 9.3 Critical
- sysaid, sysaid on-prem +1 more SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection 9.3 Critical
- microsoft sharepoint, sharepoint server, sharepoint enterprise server 2016 +2 more +4 more Microsoft SharePoint Server Remote Code Execution Vulnerability 9.8 Critical
- fortinet fortiweb An improper neutralization of special elements used in an SQL command ('SQL Injection')... 9.6 Critical
- wftpserver wing ftp server, wing ftp server ftp server +1 more In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes,... 10.0 Critical
- redhat data grid, jboss a-mq, openshift +12 more +14 more Deserialization of Untrusted Data in Apache commons collections 9.8 Critical
- redhat jboss enterprise application platform, jboss enterprise brms platform, jboss enterprise portal platform +1 more +3 more The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA... 6.8 Medium
- citrix netscaler gateway, netscaler adc, gateway +2 more +4 more NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread 9.3 Critical
- synacor zimbra collaboration suite, zimbra collaboration suite (zcs) +1 more Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8... 7.5 High
- debian linux, fedoraproject fedora, opensuse leap +5 more +7 more Path Traversal in Action View 7.5 High
- multi-router looking glass project looking glass, looking glass multi-router looking glass (mrlg) +1 more fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause... 9.8 Critical
- php phpmailer, joomla joomla\!, wordpress +2 more Remote code execution in PHPMailer 9.8 Critical
- google chrome, chromium v8 +1 more Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform... 8.1 High
- smarsh telemessage, telemessage service, tm sgnl +2 more The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap... 4.0 Medium
- smarsh telemessage, telemessage service, tm sgnl +2 more The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap... 5.3 Medium
- citrix netscaler gateway, netscaler adc, gateway +2 more +4 more Memory overflow vulnerability leading to unintended control flow and Denial of Service 9.2 Critical
- ami megarac spx, megarac-spx, megarac sp-x +9 more +11 more Redfish Authentication Bypass 10.0 Critical
- d-link dir-859, dir-859 router, dlink dir-859 firmware +2 more D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal 5.3 Medium
- fortinet fortios, fortigate +1 more Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup... 6.5 Medium
- debian linux, linux kernel, canonical ubuntu linux +5 more +7 more A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid... 7.8 High
- apple ipados, macos, visionos +4 more +6 more This issue was addressed with improved checks. This issue is fixed in watchOS 11.3.1, macOS... 4.2 Medium
- tp-link multiple routers, tl-wr740n firmware, tl-wr841n firmware +1 more +3 more TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a... 8.8 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 more Internet Shortcut Files Remote Code Execution Vulnerability 8.8 High
- wazuh, wazuh server +1 more Remote code execution in Wazuh server 9.9 Critical
- erlang erlang/otp, otp, cisco cloud native broadband network gateway +22 more +24 more Erlang/OTP SSH Vulnerable to Pre-Authentication RCE 10.0 Critical
- roundcube webmail A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a... 9.3 Critical
- google chrome, chromium v8, microsoft edge chromium +2 more Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote... 8.8 High
- qualcomm aqt1000 firmware, fastconnect 6200 firmware, fastconnect 6700 firmware +74 more +76 more Incorrect Authorization in Graphics 8.6 High
- qualcomm ar8031 firmware, csra6620 firmware, csra6640 firmware +43 more +45 more Use After Free in Graphics 7.5 High
- qualcomm aqt1000 firmware, fastconnect 6200 firmware, fastconnect 6700 firmware +75 more +77 more Incorrect Authorization in Graphics Windows 8.6 High
- craft cms, craftcms craft cms +1 more Craft CMS stores user-provided content in session files 6.9 Medium
- connectwise screenconnect ScreenConnect Exposure to ASP.NET ViewState Code Injection 8.1 High
- craft cms cms, craftcms craft cms +1 more RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms 9.3 Critical
- asus rt-ax55, rt-ax55 routers, rt-ax55 firmware +2 more ASUS RT-AX55 v3.0.0.4.386.51598 was discovered to contain an authenticated command injection... 8.8 High
- asus gt-ac2900 firmware, lyra mini firmware, routers +2 more The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows... 9.8 Critical
- samsung magicinfo 9 server Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9... 9.8 Critical
- ivanti endpoint manager mobile, endpoint manager mobile (epmm) +1 more Remote Code Execution 7.2 High
- ivanti endpoint manager mobile, endpoint manager mobile (epmm) +1 more Authentication Bypass 5.3 Medium
- srimax output messenger Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper... 7.2 High
- mdaemon email server, mdaemon +1 more Stored XSS vulnerability in MDaemon Email Server 5.3 Medium
- zimbra collaboration, synacor zimbra collaboration suite (zcs) +1 more An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS)... 6.1 Medium
- zkteco biotime A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated... 7.5 High
- sap netweaver, sap se netweaver (visual composer development server) +1 more Insecure Deserialization in SAP NetWeaver (Visual Composer development server) 9.1 Critical
- draytek vigor2960, vigor300b, vigor routers +2 more +4 more DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection 6.9 Medium
- fortinet forticamera, fortimail, fortindr +4 more +6 more A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiVoice versions 7.2.0, 7.0... 9.6 Critical
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 more Scripting Engine Memory Corruption Vulnerability 7.5 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 more Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.8 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 more Windows Common Log File System Driver Elevation of Privilege Vulnerability 7.8 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 more Windows Common Log File System Driver Elevation of Privilege Vulnerability 7.8 High
- microsoft windows, windows 10 version 1809, windows 10 version 21h2 +18 more +20 more Microsoft DWM Core Library Elevation of Privilege Vulnerability 7.8 High
- Show olderLoading…