Known Exploited Vulnerabilities
Page 3 of 18. 1731 CVEs confirmed as actively exploited, per the CISA KEV catalog.
Catalog Entries
1731 total| CVE | Vulnerability | CVSS | EPSS | Added | Due |
|---|---|---|---|---|---|
| CVE-2026-22719 | Broadcom VMware Aria Operations Command Injection Vulnerability | 8.1 | 17.7% | 2026-03-03 | 2026-03-24 |
| CVE-2026-21385 | Qualcomm Multiple Chipsets Memory Corruption Vulnerability | 7.8 | 1.3% | 2026-03-03 | 2026-03-24 |
| CVE-2026-20127 | Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability | 10.0 | 88.5% | 2026-02-25 | 2026-02-27 |
| CVE-2022-20775 | Cisco SD-WAN Path Traversal Vulnerability | 7.8 | 12.5% | 2026-02-25 | 2026-02-27 |
| CVE-2026-25108 | Soliton Systems K.K FileZen OS Command Injection Vulnerability | 8.8 | 5.1% | 2026-02-24 | 2026-03-17 |
| CVE-2025-68461 | RoundCube Webmail Cross-site Scripting Vulnerability | 7.2 | 26.8% | 2026-02-20 | 2026-03-13 |
| CVE-2025-49113 | RoundCube Webmail Deserialization of Untrusted Data Vulnerability | 9.9 | 98.9% | 2026-02-20 | 2026-03-13 |
| CVE-2026-22769 | Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability | 10.0 | 13.3% | 2026-02-18 | 2026-02-21 |
| CVE-2021-22175 | GitLab Server-Side Request Forgery (SSRF) Vulnerability | 6.8 | 53.4% | 2026-02-18 | 2026-03-11 |
| CVE-2026-2441 | Google Chromium CSS Use-After-Free Vulnerability | 8.8 | 55.1% | 2026-02-17 | 2026-03-10 |
| CVE-2024-7694 | TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability | 7.2 | 1.8% | 2026-02-17 | 2026-03-10 |
| CVE-2020-7796 | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability | 9.8 | 84.4% | 2026-02-17 | 2026-03-10 |
| CVE-2008-0015 | Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability | 8.8 | 76.6% | 2026-02-17 | 2026-03-10 |
| CVE-2026-1731 | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability Ransomware | 9.9 | 91.0% | 2026-02-13 | 2026-02-16 |
| CVE-2026-20700 | Apple Multiple Buffer Overflow Vulnerability | 7.8 | 1.4% | 2026-02-12 | 2026-03-05 |
| CVE-2025-40536 | SolarWinds Web Help Desk Security Control Bypass Vulnerability | 8.1 | 73.6% | 2026-02-12 | 2026-02-15 |
| CVE-2025-15556 | Notepad++ Download of Code Without Integrity Check Vulnerability | 7.7 | 1.7% | 2026-02-12 | 2026-03-05 |
| CVE-2024-43468 | Microsoft Configuration Manager SQL Injection Vulnerability | 9.8 | 80.9% | 2026-02-12 | 2026-03-05 |
| CVE-2026-21533 | Microsoft Windows Improper Privilege Management Vulnerability | 7.8 | 4.1% | 2026-02-10 | 2026-03-03 |
| CVE-2026-21525 | Microsoft Windows NULL Pointer Dereference Vulnerability | 6.2 | 4.8% | 2026-02-10 | 2026-03-03 |
| CVE-2026-21519 | Microsoft Windows Type Confusion Vulnerability | 7.8 | 2.5% | 2026-02-10 | 2026-03-03 |
| CVE-2026-21514 | Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability | 7.8 | 1.6% | 2026-02-10 | 2026-03-03 |
| CVE-2026-21513 | Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability | 8.8 | 15.6% | 2026-02-10 | 2026-03-03 |
| CVE-2026-21510 | Microsoft Windows Shell Protection Mechanism Failure Vulnerability | 8.8 | 24.2% | 2026-02-10 | 2026-03-03 |
| CVE-2026-24423 | SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability Ransomware | 9.3 | 88.2% | 2026-02-05 | 2026-02-26 |
| CVE-2025-11953 | React Native Community CLI OS Command Injection Vulnerability | 9.8 | 94.0% | 2026-02-05 | 2026-02-26 |
| CVE-2025-64328 | Sangoma FreePBX OS Command Injection Vulnerability | 8.6 | 84.6% | 2026-02-03 | 2026-02-24 |
| CVE-2025-40551 | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | 9.8 | 84.2% | 2026-02-03 | 2026-02-06 |
| CVE-2021-39935 | GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability | 6.8 | 35.6% | 2026-02-03 | 2026-02-24 |
| CVE-2019-19006 | Sangoma FreePBX Improper Authentication Vulnerability | 9.8 | 55.9% | 2026-02-03 | 2026-02-24 |
| CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | 9.8 | 98.7% | 2026-01-29 | 2026-02-01 |
| CVE-2026-24858 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability | 9.4 | 85.8% | 2026-01-27 | 2026-01-30 |
| CVE-2026-24061 | GNU InetUtils Argument Injection Vulnerability | 9.8 | 99.0% | 2026-01-26 | 2026-02-16 |
| CVE-2026-23760 | SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability Ransomware | 9.3 | 96.5% | 2026-01-26 | 2026-02-16 |
| CVE-2026-21509 | Microsoft Office Security Feature Bypass Vulnerability | 7.8 | 70.8% | 2026-01-26 | 2026-02-16 |
| CVE-2025-52691 | SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability Ransomware | 10.0 | 85.7% | 2026-01-26 | 2026-02-16 |
| CVE-2018-14634 | Linux Kernel Integer Overflow Vulnerability | 7.8 | 14.7% | 2026-01-26 | 2026-02-16 |
| CVE-2024-37079 | Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability | 9.8 | 22.4% | 2026-01-23 | 2026-02-13 |
| CVE-2025-68645 | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | 8.8 | 48.9% | 2026-01-22 | 2026-02-12 |
| CVE-2025-54313 | Prettier eslint-config-prettier Embedded Malicious Code Vulnerability | 7.5 | 4.5% | 2026-01-22 | 2026-02-12 |
| CVE-2025-34026 | Versa Concerto Improper Authentication Vulnerability | 9.2 | 81.9% | 2026-01-22 | 2026-02-12 |
| CVE-2025-31125 | Vite Vitejs Improper Access Control Vulnerability | 5.3 | 64.7% | 2026-01-22 | 2026-02-12 |
| CVE-2026-20045 | Cisco Unified Communications Products Code Injection Vulnerability | 8.2 | 4.5% | 2026-01-21 | 2026-02-11 |
| CVE-2026-20805 | Microsoft Windows Information Disclosure Vulnerability | 5.5 | 7.2% | 2026-01-13 | 2026-02-03 |
| CVE-2025-8110 | Gogs Path Traversal Vulnerability | 8.7 | 85.2% | 2026-01-12 | 2026-02-02 |
| CVE-2025-37164 | Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability | 10.0 | 90.2% | 2026-01-07 | 2026-01-28 |
| CVE-2009-0556 | Microsoft Office PowerPoint Code Injection Vulnerability | 8.8 | 67.3% | 2026-01-07 | 2026-01-28 |
| CVE-2025-14847 | MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability | 8.7 | 83.2% | 2025-12-29 | 2026-01-19 |
| CVE-2023-52163 | Digiever DS-2105 Pro Missing Authorization Vulnerability | 8.8 | 96.9% | 2025-12-22 | 2026-01-12 |
| CVE-2025-14733 | WatchGuard Firebox Out of Bounds Write Vulnerability Ransomware | 9.3 | 26.5% | 2025-12-19 | 2025-12-26 |
| CVE-2025-59374 | ASUS Live Update Embedded Malicious Code Vulnerability | 9.3 | 1.2% | 2025-12-17 | 2026-01-07 |
| CVE-2025-40602 | SonicWall SMA1000 Missing Authorization Vulnerability | 6.6 | 2.8% | 2025-12-17 | 2025-12-24 |
| CVE-2025-20393 | Cisco Multiple Products Improper Input Validation Vulnerability | 10.0 | 32.4% | 2025-12-17 | 2025-12-24 |
| CVE-2025-59718 | Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability | 9.1 | 68.3% | 2025-12-16 | 2025-12-23 |
| CVE-2025-43529 | Apple Multiple Products Use-After-Free WebKit Vulnerability | 8.8 | 8.8% | 2025-12-15 | 2026-01-05 |
| CVE-2025-14611 | Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability | 7.1 | 53.3% | 2025-12-15 | 2026-01-05 |
| CVE-2025-14174 | Google Chromium Out of Bounds Memory Access Vulnerability | 8.8 | 22.3% | 2025-12-12 | 2026-01-02 |
| CVE-2018-4063 | Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability | 8.8 | 27.1% | 2025-12-12 | 2026-01-02 |
| CVE-2025-58360 | OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability | 8.2 | 60.5% | 2025-12-11 | 2026-01-01 |
| CVE-2025-62221 | Microsoft Windows Use After Free Vulnerability | 7.8 | 2.5% | 2025-12-09 | 2025-12-30 |
| CVE-2025-6218 | RARLAB WinRAR Path Traversal Vulnerability | 7.8 | 90.5% | 2025-12-09 | 2025-12-30 |
| CVE-2025-66644 | Array Networks ArrayOS AG OS Command Injection Vulnerability | 7.2 | 3.4% | 2025-12-08 | 2025-12-29 |
| CVE-2022-37055 | D-Link Routers Buffer Overflow Vulnerability | 9.8 | 55.5% | 2025-12-08 | 2025-12-29 |
| CVE-2025-55182 | Meta React Server Components Remote Code Execution Vulnerability Ransomware | 10.0 | 99.8% | 2025-12-05 | 2025-12-12 |
| CVE-2021-26828 | OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability | 8.8 | 39.4% | 2025-12-03 | 2025-12-24 |
| CVE-2025-48633 | Android Framework Information Disclosure Vulnerability | 5.5 | 0.3% | 2025-12-02 | 2025-12-23 |
| CVE-2025-48572 | Android Framework Privilege Escalation Vulnerability | 7.8 | 0.3% | 2025-12-02 | 2025-12-23 |
| CVE-2021-26829 | OpenPLC ScadaBR Cross-site Scripting Vulnerability | 5.4 | 48.0% | 2025-11-28 | 2025-12-19 |
| CVE-2025-61757 | Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability | 9.8 | 88.6% | 2025-11-21 | 2025-12-12 |
| CVE-2025-13223 | Google Chromium V8 Type Confusion Vulnerability | 8.8 | 5.0% | 2025-11-19 | 2025-12-10 |
| CVE-2025-58034 | Fortinet FortiWeb OS Command Injection Vulnerability | 6.7 | 55.6% | 2025-11-18 | 2025-11-25 |
| CVE-2025-64446 | Fortinet FortiWeb Path Traversal Vulnerability | 9.4 | 91.8% | 2025-11-14 | 2025-11-21 |
| CVE-2025-9242 | WatchGuard Firebox Out-of-Bounds Write Vulnerability | 9.3 | 91.3% | 2025-11-12 | 2025-12-03 |
| CVE-2025-62215 | Microsoft Windows Race Condition Vulnerability | 7.0 | 6.0% | 2025-11-12 | 2025-12-03 |
| CVE-2025-12480 | Gladinet Triofox Improper Access Control Vulnerability | 9.1 | 95.4% | 2025-11-12 | 2025-12-03 |
| CVE-2025-21042 | Samsung Mobile Devices Out-of-Bounds Write Vulnerability | 8.8 | 33.2% | 2025-11-10 | 2025-12-01 |
| CVE-2025-48703 | CWP Control Web Panel OS Command Injection Vulnerability | 9.0 | 99.7% | 2025-11-04 | 2025-11-25 |
| CVE-2025-11371 | Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability | 7.5 | 92.1% | 2025-11-04 | 2025-11-25 |
| CVE-2025-41244 | Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability | 7.8 | 8.4% | 2025-10-30 | 2025-11-20 |
| CVE-2025-24893 | XWiki Platform Eval Injection Vulnerability | 9.8 | 99.9% | 2025-10-30 | 2025-11-20 |
| CVE-2025-6205 | Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability | 9.1 | 73.3% | 2025-10-28 | 2025-11-18 |
| CVE-2025-6204 | Dassault Systèmes DELMIA Apriso Code Injection Vulnerability | 8.0 | 78.0% | 2025-10-28 | 2025-11-18 |
| CVE-2025-59287 | Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability | 9.8 | 100.0% | 2025-10-24 | 2025-11-14 |
| CVE-2025-54236 | Adobe Commerce and Magento Improper Input Validation Vulnerability | 9.1 | 94.5% | 2025-10-24 | 2025-11-14 |
| CVE-2025-61932 | Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability | 9.8 | 2.8% | 2025-10-22 | 2025-11-12 |
| CVE-2025-61884 | Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability Ransomware | 7.5 | 95.9% | 2025-10-20 | 2025-11-10 |
| CVE-2025-33073 | Microsoft Windows SMB Client Improper Access Control Vulnerability | 8.8 | 82.7% | 2025-10-20 | 2025-11-10 |
| CVE-2025-2747 | Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability | 9.8 | 97.2% | 2025-10-20 | 2025-11-10 |
| CVE-2025-2746 | Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability | 9.8 | 73.0% | 2025-10-20 | 2025-11-10 |
| CVE-2022-48503 | Apple Multiple Products Unspecified Vulnerability | 8.8 | 3.2% | 2025-10-20 | 2025-11-10 |
| CVE-2025-54253 | Adobe Experience Manager Forms Code Execution Vulnerability | 10.0 | 88.0% | 2025-10-15 | 2025-11-05 |
| CVE-2025-59230 | Microsoft Windows Improper Access Control Vulnerability | 7.8 | 2.7% | 2025-10-14 | 2025-11-04 |
| CVE-2025-47827 | IGEL OS Use of a Key Past its Expiration Date Vulnerability | 4.6 | 4.9% | 2025-10-14 | 2025-11-04 |
| CVE-2025-24990 | Microsoft Windows Untrusted Pointer Dereference Vulnerability | 7.8 | 6.4% | 2025-10-14 | 2025-11-04 |
| CVE-2016-7836 | SKYSEA Client View Improper Authentication Vulnerability | 9.8 | 19.2% | 2025-10-14 | 2025-11-04 |
| CVE-2021-43798 | Grafana Path Traversal Vulnerability | 7.5 | 88.5% | 2025-10-09 | 2025-10-30 |
| CVE-2025-27915 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | 5.4 | 4.0% | 2025-10-07 | 2025-10-28 |
| CVE-2025-61882 | Oracle E-Business Suite Unspecified Vulnerability Ransomware | 9.8 | 99.7% | 2025-10-06 | 2025-10-27 |
| CVE-2021-43226 | Microsoft Windows Privilege Escalation Vulnerability Ransomware | 7.8 | 3.1% | 2025-10-06 | 2025-10-27 |
| CVE-2021-22555 | Linux Kernel Heap Out-of-Bounds Write Vulnerability | 8.3 | 78.7% | 2025-10-06 | 2025-10-27 |