CISA Known Exploited Vulnerabilities catalog
All 1,780 CVEs on CISA's Known Exploited Vulnerabilities catalog, newest first, with public PoC counts, Metasploit modules, EPSS and due dates.
About the catalog
The Known Exploited Vulnerabilities (KEV) catalog is the list of CVEs that the US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed are exploited in the wild. Binding Operational Directive 22-01 requires US federal civilian agencies to remediate each entry by its due date, and many other organisations use the catalog as a patch-first list. Background: the KEV glossary entry.
CVE Explore syncs the catalog from CISA every six hours. Each row adds what CISA's own page does not show: how many public proof-of-concept repositories were written for the CVE, whether a Metasploit module exists, and the current FIRST.org EPSS score. Of the 1,780 entries, 979 have a public PoC, 533 have a Metasploit module and 361 are flagged by CISA for known ransomware use. Every CVE with any such evidence, on KEV or not, is on the latest public exploits list.
Feeds of the catalog: RSS, Atom, JSON Feed. Additions in the last 30 days only: RSS, Atom, JSON Feed.
Known exploited CVEs, newest addition first (page 1 of 18)
| CVE | Product | Severity | Added to KEV | Due date | Ransomware use | Public PoCs | Metasploit | EPSS | Summary |
|---|---|---|---|---|---|---|---|---|---|
CVE-2026-20320 | Cisco Broadworks Application Delivery Platform +4 | High 7.5 | — | 0 | — | 0.004 (32.9th percentile) | A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. … | ||
CVE-2026-125350 | Google Chrome | High 8.8 | — | 3 | — | — | Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. | ||
CVE-2026-124194 | Microsoft 365 Apps +5 | Medium 6.5 | — | 2 | — | — | Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. | ||
CVE-2026-116606 | Barracuda Networks Barracuda Email Security Gateway (Esg) | — | — | 2 | — | 0.016 (76.0th percentile) | An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted… | ||
CVE-2026-111793 | Openwave Webtop Media Transcoder +1 | Medium 4.3 | — | 0 | — | 0.003 (20.0th percentile) | Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. | ||
CVE-2026-111560 | Barracuda Networks Barracuda Email Security Gateway (Esg) +5 | — | — | 0 | — | 0.011 (64.8th percentile) | Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject… | ||
CVE-2026-123218 | IBM Aspera Faspex +1 | Critical 9.8 | — | 1 | — | 0.007 (53.7th percentile) | IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges. | ||
CVE-2026-123158 | OpenBSD OpenSSH | High 8.1 | — | 33 | — | 0.165 (97.0th percentile) | sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be… | ||
CVE-2026-116779 | Freeswitch Freeswitch +1 | Critical 9.8 | — | 2 | — | 0.022 (82.5th percentile) | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. | ||
CVE-2026-102895 | Gpustack Gpustack | Critical 9.8 | — | 0 | — | 0.006 (46.7th percentile) | GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. | ||
CVE-2026-19868 | SonicWall Sonicos | High 7.5 | — | 2 | — | 0.005 (45.3th percentile) | An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. | ||
CVE-2024-27834 | Apple iOS And Ipados +9 | Medium 5.5 | — | 0 | — | 0.015 (74.5th percentile) | The issue was addressed with improved checks. | ||
CVE-2026-119977 | WordPress WordPress +1 | High 8.1 | — | 9 | — | 0.012 (68.4th percentile) | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. | ||
CVE-2026-118527 | Ivanti Connect Secure | Medium 4.3 | — | 0 | — | 0.008 (57.6th percentile) | Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location… | ||
CVE-2026-111357 | Ivanti Connect Secure +1 | High 7.0 | — | 0 | — | 0.005 (45.3th percentile) | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026. | ||
CVE-2026-97229 | GitLab GitLab +1 | Critical 10.0 | — | 10 | Yes | 0.652 (99.3th percentile) | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthe… | ||
CVE-2026-76418 | Cisco Adaptive Security Appliance Software +3 | High 8.6 | — | 0 | — | 0.008 (57.6th percentile) | A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthe… | ||
CVE-2026-46300 | Linux Linux +8 | High 7.8 | — | 20 | Yes | 0.161 (97.0th percentile) | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. | ||
CVE-2026-41709 | VMware Cloud Foundation +4 | Low 2.7 | — | 0 | — | 0.007 (53.1th percentile) | VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged. | ||
CVE-2026-48356 | Adobe Adobe Commerce +7 | Critical 9.3 | — | 4 | — | 0.475 (98.9th percentile) | Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining el… | ||
CVE-2026-111497 | 7-Zip P7zip +60 | Critical 9.8 | — | 103 | — | 0.826 (99.7th percentile) | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent deco… | ||
CVE-2026-109619 | Paloaltonetworks Panorama Virtual Appliance +12 | High 8.1 | — | 32 | — | 1.000 (100.0th percentile) | PHP has various global state that temporarily points into request memory. | ||
CVE-2026-109618 | Paloaltonetworks Panorama Virtual Appliance +11 | Critical 9.8 | — | 859 | — | 1.000 (100.0th percentile) | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. | ||
CVE-2026-114625 | Arista Velocloud Orchestrator +1 | Critical 9.9 | — | 3 | — | 0.010 (63.8th percentile) | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. | ||
CVE-2026-110447 | Collabora Collabora Online - Built-In Code Server +1 | Critical 9.8 | — | 4 | — | 0.733 (99.5th percentile) | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerabi… | ||
CVE-2026-96656 | Plex Media Server +1 | High 7.2 | — | 1 | — | 0.018 (78.5th percentile) | Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. | ||
CVE-2026-96655 | Plex Media Server +1 | Medium 4.3 | — | 0 | — | 0.107 (95.9th percentile) | Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. | ||
CVE-2026-96654 | Plex Media Server +1 | Medium 6.5 | — | 0 | — | 0.019 (80.4th percentile) | Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters. | ||
CVE-2026-96652 | Plex Media Server +1 | Medium 4.3 | — | 8 | — | 0.119 (96.1th percentile) | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. | ||
CVE-2026-110936 | Siemens Siemens Software Center +1 | Medium 6.7 | — | 1 | — | 0.010 (62.0th percentile) | A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). | ||
CVE-2026-106931 | Eg Secure Solutions Inc. Siteguard Server Edition For Apache Httpd +5 | High 7.8 | — | 0 | — | 0.025 (85.0th percentile) | SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected… | ||
CVE-2026-102764 | Beyondtrust Remote Support +1 | Critical 9.8 | — | 7 | — | 0.780 (99.6th percentile) | The vulnerability exists within internal components of BeyondTrust’s Remote Support product. | ||
CVE-2025-61624 | Fortinet Fortios +4 | Medium 6.0 | — | 0 | — | 0.013 (71.6th percentile) | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions… | ||
CVE-2026-21589 | Atlassian Bamboo +17 | High 7.5 | — | 19 | — | 0.997 (99.9th percentile) | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. | ||
CVE-2026-76519 | Cisco Asyncos +1 | Critical 9.8 | — | 2 | Yes | 0.062 (93.6th percentile) | A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating sys… | ||
CVE-2026-105134 | Ahsay Ahsaycbs +1 | Critical 10.0 | — | 1 | — | 0.818 (99.6th percentile) | A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. | ||
CVE-2026-105133 | Ahsay Ahsaycbs +1 | High 7.3 | — | 1 | — | 0.845 (99.7th percentile) | A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. | ||
CVE-2026-0322 | Palo Alto Networks Pan-Os +2 | High 7.2 | — | 1 | — | 0.017 (77.9th percentile) | A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with roo… | ||
CVE-2026-96951 | Microsoft Microsoft Edge (Chromium-Based) +34 | High 8.8 | — | 0 | — | 0.098 (95.6th percentile) | Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | ||
CVE-2026-104935 | Ivanti Connect Secure | High 8.6 | — | 9 | — | 0.889 (99.8th percentile) | Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. | ||
CVE-2023-22894 | — | Medium 4.9 | — | 3 | — | 0.041 (90.9th percentile) | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. | ||
CVE-2021-3199 | — | Critical 9.8 | — | 0 | — | 0.302 (98.2th percentile) | Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. | ||
CVE-2016-3081 | Apache Struts +20 | High 8.1 | — | 0 | Yes | 0.969 (99.9th percentile) | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to… | ||
CVE-2015-5477 | Apple OS X Server +21 | High 7.5 | — | 8 | Yes | 0.996 (99.9th percentile) | named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries. | ||
CVE-2015-3306 | Debian Debian Linux +5 | Critical 10.0 | — | 21 | Yes | 0.995 (99.9th percentile) | The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. | ||
CVE-2026-88779 | Citrix Netscaler Application Delivery Controller +3 | High 7.5 | — | 0 | — | 0.114 (96.0th percentile) | Vulnerability in NetScaler ADC and NetScaler Gateway. | ||
CVE-2026-102490 | Zammad Zammad +1 | High 7.8 | — | 0 | — | 0.109 (95.9th percentile) | Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full ro… | ||
CVE-2026-102489 | Zammad Zammad +1 | Critical 9.8 | — | 3 | — | 0.499 (98.9th percentile) | Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. | ||
CVE-2026-104286 | Fortinet Fortimail | Critical 9.8 | — | 10 | — | 0.046 (91.7th percentile) | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8… | ||
CVE-2026-76504 | Cisco Catalyst Sd-Wan Manager +1 | Critical 9.8 | — | 3 | — | 0.389 (98.6th percentile) | A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the… | ||
CVE-2026-86950 | Apple iOS And Ipados +3 | High 8.8 | — | 9 | — | 0.262 (98.0th percentile) | An out-of-bounds write issue was addressed with improved bounds checking. | ||
CVE-2026-88772 | Citrix Netscaler Application Delivery Controller +3 | High 8.1 | — | 9 | Yes | 0.766 (99.5th percentile) | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||
CVE-2026-88771 | Citrix Netscaler Application Delivery Controller +3 | Critical 9.8 | — | 18 | Yes | 0.819 (99.7th percentile) | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||
CVE-2026-87902 | WordPress WordPress | High 8.1 | — | 28 | — | 0.958 (99.9th percentile) | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. | ||
CVE-2026-67279 | Mikrotik Routeros | Medium 6.5 | — | 4 | — | 0.023 (83.3th percentile) | RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send a… | ||
CVE-2026-65660 | Microsoft Microsoft Sharepoint Enterprise Server 2016 +3 | High 8.8 | — | 2 | — | 0.099 (95.6th percentile) | Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||
CVE-2026-71362 | Adobe Adobe Commerce +5 | Critical 9.1 | — | 2 | — | 0.917 (99.8th percentile) | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. | ||
CVE-2026-5430 | Wso2 API Control Plane +8 | Critical 10.0 | — | 4 | — | 0.224 (97.7th percentile) | The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. | ||
CVE-2026-94127 | F5 Big-Ip +1 | Critical 9.8 | — | 2 | — | 0.266 (98.0th percentile) | When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). | ||
CVE-2026-93952 | Arista Velocloud Orchestrator +1 | Critical 10.0 | — | 0 | — | 0.014 (72.4th percentile) | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. | ||
CVE-2026-93616 | Checkpoint Multi-Domain Security Management +2 | Critical 9.8 | — | 4 | — | 0.916 (99.8th percentile) | A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. | ||
CVE-2026-85102 | Checkpoint Gaia Embedded +2 | Critical 9.8 | — | 1 | — | 0.541 (99.0th percentile) | Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. | ||
CVE-2026-7273 | Zyxel Gs1900-10hp Firmware +19 | High 8.8 | — | 0 | — | 0.027 (86.2th percentile) | A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw an… | ||
CVE-2026-53266 | Linux Linux +1 | High 8.8 | — | 2 | — | 0.009 (61.1th percentile) | In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind s… | ||
CVE-2025-39964 | Linux Linux +3 | High 7.8 | — | 3 | — | 0.016 (76.1th percentile) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data w… | ||
CVE-2025-39682 | Debian Debian Linux +3 | Critical 9.8 | — | 3 | — | 0.033 (88.7th percentile) | In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (… | ||
CVE-2026-87886 | Acronis Acronis Backup +3 | High 7.8 | — | 0 | — | 0.002 (14.3th percentile) | Local privilege escalation due to insecure file permissions. | ||
CVE-2026-76460 | Cisco Cisco Identity Services Engine Software +3 | Critical 10.0 | — | 1 | — | 0.756 (99.5th percentile) | A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication… | ||
CVE-2026-58704 | Google Android | High 8.8 | — | 0 | — | 0.006 (50.3th percentile) | In Cellular Modem, there is a possible permission bypass due to a logic error in the code. | ||
CVE-2026-76461 | Cisco Asyncos +1 | Critical 9.8 | — | 6 | Yes | 0.402 (98.7th percentile) | A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the… | ||
CVE-2026-85706 | GitLab GitLab | Critical 10.0 | — | 16 | Yes | 0.974 (99.9th percentile) | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain… | ||
CVE-2026-84869 | Connectwise Screenconnect | Critical 9.9 | — | 0 | — | 0.009 (60.7th percentile) | A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. | ||
CVE-2026-42018 | Jfrog Artifactory | High 7.5 | — | 0 | — | 0.100 (95.6th percentile) | JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. | ||
CVE-2026-42016 | Jfrog Artifactory | High 8.1 | — | 1 | — | 0.086 (95.2th percentile) | JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. | ||
CVE-2026-86060 | Mikrotik Routeros | Critical 9.8 | — | 3 | — | 0.064 (93.7th percentile) | RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to p… | ||
CVE-2026-67277 | Mikrotik Routeros | High 8.2 | — | 0 | — | 0.016 (75.4th percentile) | RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. | ||
CVE-2026-87491 | Google Chrome | High 8.8 | — | 1 | — | 0.035 (89.3th percentile) | Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. | ||
CVE-2026-20079 | Cisco Cisco Secure Firewall Management Center (Fmc) +1 | Critical 10.0 | — | 5 | Yes | 0.887 (99.8th percentile) | A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an… | ||
CVE-2026-19490 | Citrix Netscaler Application Delivery Controller +3 | Critical 9.8 | — | 7 | — | 0.333 (98.4th percentile) | Vulnerability in NetScaler ADC and NetScaler Gateway. | ||
CVE-2025-25249 | Fortinet Fortios +3 | High 8.1 | — | 0 | — | 0.037 (89.9th percentile) | A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions… | ||
CVE-2026-86218 | N-Able N-Central | Critical 9.8 | — | 4 | Yes | 0.154 (96.8th percentile) | N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14. | ||
CVE-2026-85880 | Microsoft Windows 10 1607 +20 | High 7.8 | — | 0 | — | 0.004 (33.1th percentile) | Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. | ||
CVE-2026-81963 | Microsoft Windows 11 23h2 +10 | High 7.8 | — | 2 | — | 0.004 (33.9th percentile) | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. | ||
CVE-2026-75650 | Adobe Adobe Commerce +5 | Critical 10.0 | — | 7 | — | 0.994 (99.9th percentile) | Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. | ||
CVE-2026-85046 | Google Chrome +1 | High 8.8 | — | 7 | — | 0.018 (78.7th percentile) | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. | ||
CVE-2026-9586 | Sangoma Switchvox +1 | Critical 9.8 | — | 2 | — | 0.190 (97.3th percentile) | An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates t… | ||
CVE-2026-83549 | SonicWall Sma1000 +3 | High 7.8 | — | 0 | Yes | 0.099 (95.6th percentile) | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) whic… | ||
CVE-2026-83548 | SonicWall Sma1000 +3 | Critical 10.0 | — | 4 | Yes | 0.080 (94.8th percentile) | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. | ||
CVE-2026-82329 | Jfrog Artifactory | Critical 9.8 | — | 8 | — | 0.144 (96.6th percentile) | JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. | ||
CVE-2026-59822 | Berriai Litellm +1 | High 8.2 | — | 1 | — | 0.008 (58.0th percentile) | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. | ||
CVE-2026-49869 | Kestra Kestra +1 | Critical 10.0 | — | 2 | — | 0.021 (81.8th percentile) | Kestra is an open-source, event-driven orchestration platform. | ||
CVE-2026-48710 | Encode Starlette +8 | Medium 6.5 | — | 5 | — | 0.703 (99.4th percentile) | Starlette is a lightweight ASGI framework/toolkit. | ||
CVE-2026-82078 | Papercut Papercut Mf +2 | Critical 9.1 | — | 0 | Yes | 0.630 (99.2th percentile) | An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. | ||
CVE-2026-81578 | Papercut Papercut Mf +2 | Critical 9.8 | — | 2 | Yes | 0.847 (99.7th percentile) | An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. | ||
CVE-2026-66384 | Jfrog Artifactory | Medium 5.3 | — | 1 | — | 0.007 (52.1th percentile) | An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. | ||
CVE-2026-53362 | Linux Linux +2 | High 7.8 | — | 2 | — | 0.007 (53.8th percentile) | In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MOR… | ||
CVE-2023-49105 | — | Critical 9.8 | — | 1 | — | 0.432 (98.7th percentile) | An issue was discovered in ownCloud owncloud/core before 10.13.1. | ||
CVE-2026-8452 | Citrix Netscaler Application Delivery Controller +3 | Critical 9.8 | — | 5 | — | 0.010 (63.5th percentile) | Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy… | ||
CVE-2022-0995 | Fedoraproject Fedora +13 | High 7.8 | — | 5 | Yes | 0.089 (95.2th percentile) | An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. | ||
CVE-2021-23758 | Ajaxpro.2 Project Ajaxpro.2 +2 | High 8.1 | — | 1 | Yes | 0.826 (99.7th percentile) | All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code exec… |