An attacker who already has deep access to an Apple device or certain web browsers could bypass built-in security checks and change protected information or…
Published May 14, 2024 EPSS 0.6% Monitor only
Known exploited vulnerabilities
Vulnerabilities CISA has confirmed are being exploited in the wild. These carry remediation deadlines for US federal agencies, and are a reasonable priority order for everyone else.
1537 in the catalogue · showing 1–50
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during…
Published Oct 31, 2026 EPSS 1.0%
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with…
Published Nov 3, 2026 EPSS 0.8%
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root…
Published Oct 15, 2026 EPSS 0.5%
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat…
Published Oct 28, 2026 EPSS 0.8%
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain…
Published Oct 13, 2026 EPSS 65.2%
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being…
Published Jul 30, 2026 EPSS 0.7%
A Linux kernel networking bug can let someone who already has limited access on a machine overwrite shared memory, which may crash the system, corrupt files…
Published May 23, 2026 EPSS 16.1% Act now
A common compression component used in browsers, mail programs, and web services can be crashed or hijacked by a poisoned compressed response, and attackers…
Published Oct 22, 2026 EPSS 82.6% Act now
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of…
Published Jul 14, 2026 EPSS 47.5%
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for…
Published Oct 21, 2026 EPSS 100.0%
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated…
Published Oct 21, 2026 EPSS 100.0%
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact…
Published Oct 22, 2026 EPSS 1.0%
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September…
Published Oct 14, 2026 EPSS 73.3%
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0…
Published Apr 14, 2026 EPSS 1.3%
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center…
Published Oct 5, 2026 EPSS 99.7%
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security…
Published Oct 13, 2026 EPSS 9.8%
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute…
Published Apr 26, 2016 EPSS 96.5%
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon…
Published Jul 29, 2015 EPSS 99.6%
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands
Published May 18, 2015 EPSS 99.5%
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0…
Published Oct 1, 2026 EPSS 4.6%
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1…
Published Sep 28, 2026 EPSS 26.2%
A flaw in certain Zyxel network switches lets someone nearby on the same network take control of the device by sending a specially made web request…
Published Jun 16, 2026 EPSS 2.8% Act now
Some Linux systems that rewrite ARP network traffic while acting as bridges could accidentally corrupt data, so affected systems should be updated
Published Jun 25, 2026 EPSS 0.9% Next patch cycle
A flaw in the Linux kernel's crypto socket handling allowed simultaneous data writes that could scramble information or cause crashes, and attackers are…
Published Oct 13, 2025 EPSS 1.6% Act now
A problem in the Linux kernel's handling of certain encrypted network messages could let attackers see data they should not have access to
Published Sep 5, 2025 EPSS 3.3% Act now
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive…
Published Aug 12, 2026 EPSS 10.0%
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token…
Published Jul 27, 2026 EPSS 8.6%
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this…
Published Sep 5, 2026 EPSS 1.6%
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS…
Published Sep 5, 2026 EPSS 6.4%
A flaw in Cisco firewall management software lets remote attackers break in without a password and take complete control of the device, potentially exposing…
Published Mar 4, 2026 EPSS 88.7% Act now
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0…
Published Jan 13, 2026 EPSS 3.7%
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally
Published Sep 8, 2026 EPSS 0.4%
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code…
Published Sep 7, 2026 EPSS 3.9%
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14. CVE-2026-86218 is rated critical (CVSS 9.8), is…
Published Sep 6, 2026 EPSS 15.4%
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote…
Published Sep 1, 2026 EPSS 8.0%
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain…
Published Aug 28, 2026 EPSS 14.4%
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and…
Published Jul 17, 2026 EPSS 19.0%
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an…
Published Jul 8, 2026 EPSS 0.8%
A simple URL check error lets outsiders skip login and run any commands they want on the automation system servers
Published Jun 26, 2026 EPSS 2.1% Act now
A common Python web toolkit can be tricked into thinking a visitor asked for a different page than they really did, which may let outsiders reach features that…
Published May 26, 2026 EPSS 70.3% Act now
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions
Published Aug 12, 2026 EPSS 0.7%
A flaw in Linux networking can let someone who already has limited access to a machine crash it and may allow them to gain higher control if the system is not…
Published Jul 4, 2026 EPSS 0.7% Next patch cycle
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of…
Published Nov 21, 2023 EPSS 43.2%
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is…
Published Jun 30, 2026 EPSS 1.0%
A flaw in the core of the Linux operating system lets people who already have access to a machine take complete control or shut it down, and attackers are…
Published Mar 25, 2022 EPSS 8.9% Act now
A vulnerable web or image-processing component could let attackers crash services or take control of affected systems if it is not updated
Published Dec 3, 2021 EPSS 82.6% Monitor only
A flaw in Microsoft SQL Server lets attackers run their own code on the database server from a distance, putting critical data and operations at serious risk
Published Jul 15, 2019 EPSS 57.3% Act now
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a…
Published Dec 7, 2015 EPSS 5.0%
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local…
Published Aug 11, 2015 EPSS 8.5%