CISA Known Exploited Vulnerabilities catalog (page 3)
Page 3 of 18 of the CISA Known Exploited Vulnerabilities catalog, newest additions first, with PoC counts, Metasploit and EPSS.
Known exploited CVEs, newest addition first (page 3 of 18)
| CVE | Product | Severity | Added to KEV | Due date | Ransomware use | Public PoCs | Metasploit | EPSS | Summary |
|---|---|---|---|---|---|---|---|---|---|
CVE-2024-57726 | — | Critical 9.9 | Known | 0 | — | 0.664 (99.3th percentile) | SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. | ||
CVE-2026-39987 | Coreweave Marimo +1 | Critical 9.8 | — | 37 | — | 0.997 (100.0th percentile) | marimo is a reactive Python notebook. | ||
CVE-2026-33825 | Microsoft Defender Antimalware Platform +1 | High 7.8 | Known | 10 | — | 0.067 (94.0th percentile) | Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally. | ||
CVE-2026-20133 | Cisco Catalyst Sd-Wan Manager +1 | Medium 6.5 | — | 0 | — | 0.353 (98.5th percentile) | A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient fil… | ||
CVE-2026-20128 | Cisco Catalyst Sd-Wan Manager +1 | High 7.5 | — | 0 | — | 0.083 (95.0th percentile) | A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This… | ||
CVE-2026-20122 | Cisco Catalyst Sd-Wan Manager +1 | Medium 5.4 | — | 0 | — | 0.258 (98.0th percentile) | A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. | ||
CVE-2025-48700 | — | Medium 6.1 | — | 0 | — | 0.017 (77.6th percentile) | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. | ||
CVE-2025-32975 | — | Critical 10.0 | — | 0 | — | 0.025 (84.8th percentile) | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an… | ||
CVE-2025-2749 | Kentico Xperience | High 7.2 | — | 0 | — | 0.040 (90.7th percentile) | An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. | ||
CVE-2024-27199 | Jetbrains Teamcity | High 7.3 | Known | 0 | — | 1.000 (100.0th percentile) | In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible | ||
CVE-2023-27351 | Papercut Ng +2 | High 7.5 | Known | 0 | — | 0.781 (99.6th percentile) | This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). | ||
CVE-2026-34197 | Apache Activemq +4 | High 8.8 | — | 19 | Yes | 0.983 (99.9th percentile) | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. | ||
CVE-2026-32201 | Microsoft Microsoft Sharepoint Enterprise Server 2016 +3 | Medium 6.5 | — | 1 | — | 0.434 (98.7th percentile) | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | ||
CVE-2009-0238 | Microsoft Excel +5 | High 8.8 | — | 0 | — | 0.429 (98.7th percentile) | Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in… | ||
CVE-2026-34621 | Adobe Acrobat +5 | High 8.6 | — | 5 | — | 0.073 (94.4th percentile) | Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could re… | ||
CVE-2026-21643 | Fortinet Forticlientems | Critical 9.8 | — | 4 | — | 0.977 (99.9th percentile) | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized co… | ||
CVE-2025-60710 | Microsoft Windows 11 24h2 +6 | High 7.8 | Known | 2 | — | 0.046 (91.8th percentile) | Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally. | ||
CVE-2023-36424 | Microsoft Windows 10 1507 +37 | High 7.8 | — | 2 | — | 0.121 (96.2th percentile) | Windows Common Log File System Driver Elevation of Privilege Vulnerability | ||
CVE-2023-21529 | Microsoft Exchange Server +4 | High 8.8 | Known | 1 | — | 0.593 (99.1th percentile) | Microsoft Exchange Server Remote Code Execution Vulnerability | ||
CVE-2020-9715 | Adobe Acrobat Dc +2 | High 7.8 | — | 3 | — | 0.333 (98.4th percentile) | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. | ||
CVE-2012-1854 | Microsoft Office +3 | High 7.8 | — | 0 | — | 0.209 (97.6th percentile) | Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic… | ||
CVE-2026-1340 | Ivanti Endpoint Manager Mobile | Critical 9.8 | — | 0 | Yes | 0.986 (99.9th percentile) | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. | ||
CVE-2026-35616 | Fortinet Forticlientems | Critical 9.8 | — | 12 | — | 0.940 (99.8th percentile) | A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. | ||
CVE-2026-3502 | Trueconf Trueconf +1 | High 7.8 | — | 2 | — | 0.058 (93.2th percentile) | TrueConf Client downloads application update code and applies it without performing verification. | ||
CVE-2026-5281 | Google Chrome | High 8.8 | — | 5 | — | 0.137 (96.5th percentile) | Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. | ||
CVE-2026-3055 | Citrix Netscaler Application Delivery Controller +3 | Critical 9.8 | — | 7 | Yes | 0.915 (99.8th percentile) | Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread | ||
CVE-2025-53521 | F5 Big-Ip +1 | Critical 9.8 | — | 0 | — | 0.023 (83.4th percentile) | When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical S… | ||
CVE-2026-33634 | Aquasec Setup-Trivy +9 | High 8.8 | — | 5 | — | 0.604 (99.2th percentile) | Trivy is a security scanner. | ||
CVE-2026-33017 | Langflow Langflow +1 | Critical 9.8 | — | 33 | Yes | 0.964 (99.9th percentile) | Langflow is a tool for building and deploying AI-powered agents and workflows. | ||
CVE-2025-54068 | Laravel Livewire +1 | Critical 9.8 | — | 10 | — | 0.963 (99.9th percentile) | Livewire is a full-stack framework for Laravel. | ||
CVE-2025-43520 | Apple iOS And Ipados +6 | Medium 5.5 | — | 1 | — | 0.004 (37.1th percentile) | A memory corruption issue was addressed with improved memory handling. | ||
CVE-2025-43510 | Apple iOS And Ipados +6 | High 7.8 | — | 0 | — | 0.004 (29.6th percentile) | A memory corruption issue was addressed with improved lock state checking. | ||
CVE-2025-32432 | Craftcms Cms +1 | Critical 10.0 | — | 20 | Yes | 0.998 (100.0th percentile) | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. | ||
CVE-2025-31277 | Apple iOS And Ipados +15 | High 8.8 | — | 2 | — | 0.017 (77.1th percentile) | The issue was addressed with improved memory handling. | ||
CVE-2026-20131 | Cisco Cisco Secure Firewall Management Center (Fmc) +1 | Critical 10.0 | Known | 8 | — | 0.444 (98.8th percentile) | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root&… | ||
CVE-2026-20963 | Microsoft Microsoft Sharepoint Enterprise Server 2016 +3 | Critical 9.8 | — | 1 | — | 0.292 (98.2th percentile) | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | ||
CVE-2025-66376 | Synacor Zimbra Collaboration Suite +1 | High 7.2 | — | 0 | — | 0.202 (97.5th percentile) | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message. | ||
CVE-2025-47813 | Wftpserver Wing FTP Server +1 | Medium 4.3 | — | 0 | — | 0.625 (99.2th percentile) | loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. | ||
CVE-2026-3910 | Google Chrome | High 8.8 | — | 1 | — | 0.027 (85.9th percentile) | Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | ||
CVE-2026-3909 | Google Chrome | High 8.8 | — | 2 | — | 0.023 (83.7th percentile) | Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. | ||
CVE-2025-68613 | N8n N8n +1 | Critical 9.9 | — | 39 | Yes | 0.990 (99.9th percentile) | n8n is an open source workflow automation platform. | ||
CVE-2026-1603 | Ivanti Endpoint Manager | High 8.6 | — | 0 | — | 0.883 (99.8th percentile) | An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data. | ||
CVE-2025-26399 | Solarwinds Web Help Desk +1 | Critical 9.8 | Known | 2 | — | 0.906 (99.8th percentile) | SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on… | ||
CVE-2021-22054 | VMware Workspace One Uem Console +1 | High 7.5 | — | 1 | — | 0.997 (100.0th percentile) | VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. | ||
CVE-2023-43000 | Apple iOS And Ipados +4 | High 8.8 | — | 0 | — | 0.040 (90.7th percentile) | A use-after-free issue was addressed with improved memory management. | ||
CVE-2023-41974 | Apple iOS And Ipados +2 | High 7.8 | — | 1 | — | 0.020 (80.4th percentile) | A use-after-free issue was addressed with improved memory management. | ||
CVE-2021-30952 | Apple iOS And Ipados +10 | High 7.8 | — | 0 | — | 0.070 (94.2th percentile) | An integer overflow was addressed with improved input validation. | ||
CVE-2021-22681 | Rockwell Automation Studio 5000 Logix Designer, Rslogix 5000, Logix Controllers +3 | Critical 9.8 | — | 1 | — | 0.636 (99.2th percentile) | Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactL… | ||
CVE-2017-7921 | Hikvision Ds-2cd2032-I Firmware +58 | Critical 9.8 | — | 36 | Yes | 1.000 (100.0th percentile) | An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2x… | ||
CVE-2026-22719 | VMware Aria Operations +7 | High 8.1 | — | 0 | — | 0.183 (97.2th percentile) | VMware Aria Operations contains a command injection vulnerability. | ||
CVE-2026-21385 | Qualcomm 5g Fixed Wireless Access Platform Firmware +237 | High 7.8 | — | 2 | — | 0.013 (71.0th percentile) | Memory corruption while using alignments for memory allocation. | ||
CVE-2026-20127 | Cisco Catalyst Sd-Wan Manager +3 | Critical 10.0 | — | 11 | Yes | 0.876 (99.8th percentile) | A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator… | ||
CVE-2022-20775 | Cisco Catalyst Sd-Wan Manager +9 | High 7.8 | — | 0 | — | 0.120 (96.2th percentile) | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands with… | ||
CVE-2026-25108 | Soliton Filezen +1 | High 8.8 | — | 0 | — | 0.052 (92.6th percentile) | FileZen contains an OS command injection vulnerability. | ||
CVE-2025-68461 | Roundcube Webmail | High 7.2 | — | 2 | — | 0.274 (98.1th percentile) | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. | ||
CVE-2025-49113 | Debian Debian Linux +1 | Critical 9.9 | — | 27 | Yes | 0.996 (99.9th percentile) | Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.ph… | ||
CVE-2026-22769 | Dell Recoverpoint For Virtual Machines +1 | Critical 10.0 | — | 0 | — | 0.135 (96.5th percentile) | Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. | ||
CVE-2021-22175 | GitLab GitLab | Medium 6.8 | — | 0 | — | 0.534 (99.0th percentile) | When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthen… | ||
CVE-2026-2441 | Google Chrome | High 8.8 | — | 7 | — | 0.545 (99.0th percentile) | Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | ||
CVE-2024-7694 | Teamt5 Threatsonar Anti-Ransomware +1 | High 7.2 | — | 0 | — | 0.018 (78.6th percentile) | ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. | ||
CVE-2020-7796 | — | Critical 9.8 | — | 0 | — | 0.936 (99.8th percentile) | Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. | ||
CVE-2008-0015 | Microsoft Windows 2003 Server +2 | High 8.8 | — | 0 | Yes | 0.766 (99.5th percentile) | Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microso… | ||
CVE-2026-1731 | Beyondtrust Privileged Remote Access +2 | Critical 9.8 | Known | 7 | Yes | 0.939 (99.8th percentile) | BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. | ||
CVE-2026-20700 | Apple iOS And Ipados +6 | High 7.8 | — | 2 | — | 0.017 (76.8th percentile) | A memory corruption issue was addressed with improved state management. | ||
CVE-2025-40536 | Solarwinds Web Help Desk +1 | High 8.1 | — | 1 | Yes | 0.736 (99.5th percentile) | SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functio… | ||
CVE-2025-15556 | Notepad-Plus-Plus Notepad\+\+ +1 | High 7.5 | — | 2 | — | 0.017 (78.0th percentile) | Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically veri… | ||
CVE-2024-43468 | Microsoft Configuration Manager 2403 +3 | Critical 9.8 | — | 3 | — | 0.810 (99.6th percentile) | Microsoft Configuration Manager Remote Code Execution Vulnerability | ||
CVE-2026-21533 | Microsoft Windows 10 1607 +33 | High 7.8 | — | 2 | — | 0.043 (91.3th percentile) | Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. | ||
CVE-2026-21525 | Microsoft Windows 10 1607 +33 | Medium 6.2 | — | 0 | — | 0.050 (92.4th percentile) | Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally. | ||
CVE-2026-21519 | Microsoft Windows 10 1607 +28 | High 7.8 | — | 0 | — | 0.026 (85.3th percentile) | Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | ||
CVE-2026-21514 | Microsoft 365 Apps +6 | High 7.8 | — | 1 | — | 0.016 (75.8th percentile) | Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | ||
CVE-2026-21513 | Microsoft Windows 10 1607 +33 | High 8.8 | — | 0 | — | 0.159 (96.9th percentile) | Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. | ||
CVE-2026-21510 | Microsoft Windows 10 1607 +33 | High 8.8 | — | 2 | — | 0.612 (99.2th percentile) | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | ||
CVE-2026-24423 | Smartertools Smartermail | Critical 9.8 | Known | 3 | — | 0.882 (99.8th percentile) | SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. | ||
CVE-2025-11953 | React-Native-Community React Native Community Cli | Critical 9.8 | — | 5 | — | 0.940 (99.8th percentile) | The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. | ||
CVE-2025-64328 | Freepbx Filestore +1 | High 7.2 | — | 1 | Yes | 0.846 (99.7th percentile) | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. | ||
CVE-2025-40551 | Solarwinds Web Help Desk +1 | Critical 9.8 | — | 0 | Yes | 0.842 (99.7th percentile) | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the… | ||
CVE-2021-39935 | GitLab GitLab | Medium 6.8 | — | 0 | — | 0.361 (98.5th percentile) | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. | ||
CVE-2019-19006 | — | Critical 9.8 | — | 0 | — | 0.547 (99.0th percentile) | Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. | ||
CVE-2026-1281 | Ivanti Endpoint Manager Mobile | Critical 9.8 | — | 3 | Yes | 0.987 (99.9th percentile) | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. | ||
CVE-2026-24858 | Fortinet Fortianalyzer +6 | Critical 9.8 | — | 5 | — | 0.866 (99.7th percentile) | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0… | ||
CVE-2026-24061 | Debian Debian Linux +1 | Critical 9.8 | — | 82 | Yes | 0.990 (99.9th percentile) | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. | ||
CVE-2026-23760 | Smartertools Smartermail | Critical 9.8 | Known | 3 | — | 0.964 (99.9th percentile) | SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. | ||
CVE-2026-21509 | Microsoft 365 Apps +7 | High 7.8 | — | 13 | — | 0.708 (99.4th percentile) | Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally. | ||
CVE-2025-52691 | Smartertools Smartermail | Critical 10.0 | Known | 10 | Yes | 0.857 (99.7th percentile) | Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. | ||
CVE-2018-14634 | Canonical Ubuntu Linux +28 | High 7.8 | — | 1 | — | 0.147 (96.7th percentile) | An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. | ||
CVE-2024-37079 | VMware Cloud Foundation +3 | Critical 9.8 | — | 1 | — | 0.224 (97.7th percentile) | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. | ||
CVE-2025-68645 | — | High 8.8 | — | 12 | — | 0.506 (98.9th percentile) | A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFil… | ||
CVE-2025-54313 | Alexghr Got-Fetch +6 | High 7.5 | — | 2 | — | 0.051 (92.5th percentile) | eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. | ||
CVE-2025-34026 | Versa Concerto +1 | High 7.5 | — | 0 | — | 0.818 (99.6th percentile) | The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. | ||
CVE-2025-31125 | Vitejs Vite | Medium 5.3 | — | 6 | — | 0.749 (99.5th percentile) | Vite is a frontend tooling framework for javascript. | ||
CVE-2026-20045 | Cisco Cisco Unified Communications Manager +5 | High 8.2 | — | 1 | — | 0.045 (91.6th percentile) | A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & P… | ||
CVE-2026-20805 | Microsoft Windows 10 1607 +31 | Medium 5.5 | — | 7 | — | 0.075 (94.5th percentile) | Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally. | ||
CVE-2025-8110 | Gogs Gogs | High 8.8 | — | 30 | — | 0.803 (99.6th percentile) | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | ||
CVE-2025-37164 | Hewlett Packard Enterprise (HPE) HPE Oneview +1 | Critical 10.0 | — | 3 | Yes | 0.902 (99.8th percentile) | A remote code execution issue exists in HPE OneView. | ||
CVE-2009-0556 | Microsoft Office Powerpoint +2 | High 8.8 | — | 0 | — | 0.673 (99.3th percentile) | Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineT… | ||
CVE-2025-14847 | MongoDB MongoDB +1 | High 7.5 | — | 47 | Yes | 0.832 (99.7th percentile) | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. | ||
CVE-2023-52163 | Digiever Ds-2105 Pro\+ Firmware +2 | High 8.8 | — | 0 | — | 0.971 (99.9th percentile) | Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. | ||
CVE-2025-14733 | Watchguard Fireware +1 | Critical 9.8 | Known | 1 | — | 0.294 (98.2th percentile) | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. | ||
CVE-2025-59374 | ASUS Live Update +1 | Critical 9.8 | — | 0 | — | 0.012 (68.6th percentile) | "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could ca… |