Known exploited vulnerabilities
Under attack, per CISA.
- broadcom vmware vcenter, vmware vcenter, cloud foundation +4 more +6 more vCenter directory-traversal vulnerability 9.8 Critical
- microsoft sharepoint, sharepoint server, sharepoint enterprise server 2016 +2 more +4 more Microsoft SharePoint Server Security Feature Bypass Vulnerability 9.1 Critical
- microsoft internet key exchange (ike) service extensions, windows 10 version 1607, windows 10 version 1809 +23 more +25 more Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability 9.8 Critical
- anyscale ray Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack 9.4 Critical
- cisco secure firewall adaptive security appliance (asa) software, secure firewall threat defense (ftd) software, secure firewall threat defense +2 more +4 more Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability 8.6 High
- microsoft windows ancillary function driver for winsock, windows 10 version 1607, windows 10 version 1809 +25 more +27 more Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.0 High
- metabase Metabase SQL injection via password reset endpoint 10.0 Critical
- progress ecs connection manager, loadmaster, progress software moveit waf +4 more +6 more OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF 9.6 Critical
- jetbrains teamcity In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was... 9.8 Critical
- n-able n-central Unauthenticated administrative account takeover 8.2 High
- ibm langflow, langflow oss +1 more Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation 9.8 Critical
- apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +21 more +23 more Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor 7.5 High
- n-able n-central Incomplete patch leads to administrative account takeover 8.2 High
- cisco secure firewall management center (fmc), secure firewall management center +1 more Cisco Secure Firewall Management Center Software Static Credential Vulnerability 5.3 Medium
- arista velocloud orchestrator, arista networks velocloud orchestrator on-prem +1 more VeloCloud Orchestrator OS Command Injection 10.0 Critical
- fortinet fortios An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200]... 5.3 Medium
- check point smartconsole, checkpoint multi-domain security management, quantum security management +2 more Authentication Bypass in the SmartConsole Login Process Using an Application Token 9.3 Critical
- microsoft sharepoint, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 more Microsoft SharePoint Remote Code Execution Vulnerability 9.8 Critical
- wordpress, wordpress core +1 more WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution 9.8 Critical
- wordpress, wordpress core +1 more WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query 5.9 Medium
- dd-wrt An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the... 8.1 High
- langflow Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability 9.8 Critical
- microsoft sharepoint, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 more Microsoft SharePoint Remote Code Execution Vulnerability 9.8 Critical
- fortinet fortisandbox, fortisandbox cloud, fortisandbox paas +2 more A improper neutralization of special elements used in an os command ('os command injection')... 9.1 Critical
- fortinet fortisandbox, fortisandbox paas +1 more A improper neutralization of special elements used in an os command ('os command injection')... 9.1 Critical
- oracle e-business suite, oracle corporation payments +1 more Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File... 9.8 Critical
- knx connection authorization, knx association protocol connection authorization option 1 +1 more KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the... 7.5 High
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 more Post-authentication improper control of generation of code ('Code Injection') vulnerability has... 7.2 High
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 more A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance... 10.0 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 more Microsoft SharePoint Server Elevation of Privilege Vulnerability 5.3 Medium
- microsoft active directory federation services, windows 10 version 1607, windows 10 version 1809 +13 more +15 more Active Directory Federation Services Elevation of Privilege Vulnerability 7.8 High
- cisco ios Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component... 9.3 High
- balbooa forms, balbooa.com balbooa forms extension for joomla +1 more Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 10.0 Critical
- icagenda, icagenda.com icagenda extension for joomla +1 more Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15 10.0 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 more ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 10.0 Critical
- joomlack page builder, page builder ck, joomlack.fr page builder ck extension for joomla +2 more Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 10.0 Critical
- joomshaper sp page builder, joomshaper.net sp page builder extension for joomla +1 more Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2 10.0 Critical
- langflow Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow 8.4 High
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 more Microsoft SharePoint Remote Code Execution Vulnerability 8.8 High
- simple-help simplehelp SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification 9.5 Critical
- ptc flexplm, windchill and flexplm, windchill pdmlink +2 more Remote Code Execution (RCE) vulnerability in Windchill PDMlink 9.3 Critical
- cisco unified communications manager Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability 8.6 High
- ubiquiti unifi os, free5gc udm, udr +59 more +61 more A malicious actor with access to the network could exploit an Improper Input Validation... 10.0 Critical
- ubiquiti unifi os, @clerk express, free5gc udm +61 more +63 more A malicious actor with access to the network could exploit a Path Traversal vulnerability found... 10.0 Critical
- ubiquiti unifi os, free5gc udm, udr +59 more +61 more A malicious actor with access to the network could exploit an Improper Access Control... 10.0 Critical
- lantronix eds5000, e210 series, e213f102s firmware +36 more +38 more Lantronix EDS5000, G520, and X300 OS Command Injection 9.3 Critical
- splunk enterprise, splunk +1 more Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise 9.8 Critical
- widgetfactorylimited jce, joomlacontenteditor.net joomla content editor (jce) extension for joomla, widget factory joomla content editor +2 more Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5 10.0 Critical
- cisco catalyst sd-wan manager Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability 6.5 Medium
- litespeed cpanel plugin, litespeedtech litespeed cpanel plugin, litespeed whm plugin +2 more LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0)... 8.5 High
- Show olderLoading…