Is it exploited?
Vulnerabilities under active attack
Every vulnerability with evidence of exploitation in the wild — 1,655 of them. Not a list of everything that has a CVE number. A list of what someone has already used against someone.
- CVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Fortinet · FortiOS
- CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability Arista · VeloCloud Orchestrator
- CVE-2026-16232 Check Point SmartConsole Improper Authentication Vulnerability Check Point · SmartConsole
- CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft · SharePoint
- CVE-2026-60137 WordPress Core SQL Injection Vulnerability WordPress · Core
- CVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability WordPress · Core
- CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability Langflow · Langflow
- CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability DD-WRT · DD-WRT
- CVE-2026-58644 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft · SharePoint
- CVE-2026-25089 Fortinet FortiSandbox OS Command Injection Vulnerability Fortinet · FortiSandbox
- CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability Fortinet · FortiSandbox
- CVE-2026-46817 Oracle E-Business Suite Improper Privilege Management Vulnerability Oracle · E-Business Suite
- CVE-2023-4346 KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability KNX Association · KNX Protocol Connection Authorization Option 1
- CVE-2026-56155 Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability Microsoft · Active Directory Federation Services
- CVE-2026-56164 Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability Microsoft · SharePoint Server
- CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability SonicWall · SMA1000 Appliances
- CVE-2026-15410 SonicWall SMA1000 Appliances Code Injection Vulnerability SonicWall · SMA1000 Appliances
- CVE-2008-4128 Cisco IOS Cross-Site Request Forgery Vulnerability Cisco · IOS
- CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability Balbooa · Forms
- CVE-2026-48939 iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability iCagenda · iCagenda
- CVE-2026-48908 JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability JoomShaper · SP Page Builder
- CVE-2026-55255 Langflow Authorization Bypass Through User-Controlled Key Vulnerability Langflow · Langflow
- CVE-2026-56290 Joomlack Page Builder Improper Access Control Vulnerability Joomlack · Page Builder
- CVE-2026-48282 Adobe ColdFusion Path Traversal Vulnerability Adobe · ColdFusion
- CVE-2026-45659 Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability Microsoft · SharePoint Server
- CVE-2026-48558 SimpleHelp Authentication Bypass Vulnerability SimpleHelp · SimpleHelp
- CVE-2026-12569 PTC Windchill and FlexPLM Improper Input Validation Vulnerability PTC · Windchill and FlexPLM
- CVE-2026-20230 Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability Cisco · Unified Communications Manager
- CVE-2025-67038 Lantronix EDS5000 Code Injection Vulnerability Lantronix · EDS5000
- CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation Vulnerability Ubiquiti · UniFi OS
- CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability Ubiquiti · UniFi OS
- CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability Ubiquiti · UniFi OS
- CVE-2026-20253 Splunk Enterprise Missing Authentication for Critical Function Vulnerability Splunk · Enterprise
- CVE-2026-48907 Widget Factory Joomla Content Editor Improper Access Control Vulnerability Widget Factory · Joomla Content Editor
- CVE-2026-54420 LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability LiteSpeed · cPanel Plugin
- CVE-2026-20262 Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability Cisco · Catalyst SD-WAN Manager
- CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Oracle · PeopleSoft Enterprise PeopleTools
- CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability Ivanti · Sentry
- CVE-2026-11645 Google Chromium V8 Out-of-Bounds Read and Write Vulnerability Google · Chromium V8
- CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability Arista · Extensible Operating System
- CVE-2026-20245 Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability Cisco · Catalyst SD-WAN Manager
- CVE-2026-42271 BerriAI LiteLLM Command Injection Vulnerability BerriAI · LiteLLM
- CVE-2026-50751 Check Point Security Gateway Improper Authentication Vulnerability Check Point · Security Gateway
- CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability SolarWinds · Serv-U
- CVE-2026-45247 Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability Mirasvit · Mirasvit Full Page Cache Warmer
- CVE-2022-0492 Linux Kernel Improper Authentication Vulnerability Linux · Kernel
- CVE-2025-48595 Android Framework Integer Overflow Vulnerability Android · Framework
- CVE-2024-21182 Oracle WebLogic Server Unspecified Vulnerability Oracle · WebLogic Server
- CVE-2026-0257 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Palo Alto Networks · PAN-OS
- CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability Nx · Nx Console
- CVE-2026-45321 TanStack Unspecified Vulnerability TanStack · TanStack
- CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability Daemon · Daemon Tools Lite
- CVE-2026-48172 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability LiteSpeed · cPanel Plugin
- CVE-2026-9082 Drupal Core SQL Injection Vulnerability Drupal · Core
- CVE-2025-34291 Langflow Origin Validation Error Vulnerability Langflow · Langflow
- CVE-2026-34926 Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability Trend Micro · Apex One
- CVE-2008-4250 Microsoft Windows Buffer Overflow Vulnerability Microsoft · Windows
- CVE-2009-1537 Microsoft DirectX NULL Byte Overwrite Vulnerability Microsoft · DirectX
- CVE-2009-3459 Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability Adobe · Acrobat and Reader
- CVE-2010-0249 Microsoft Internet Explorer Use-After-Free Vulnerability Microsoft · Internet Explorer
- CVE-2010-0806 Microsoft Internet Explorer Use-After-Free Vulnerability Microsoft · Internet Explorer
- CVE-2026-41091 Microsoft Defender Link Following Vulnerability Microsoft · Defender
- CVE-2026-45498 Microsoft Defender Denial of Service Vulnerability Microsoft · Defender
- CVE-2026-42897 Microsoft Exchange Server Cross-Site Scripting Vulnerability Microsoft · Microsoft
- CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability Cisco · Catalyst SD-WAN
- CVE-2026-42208 BerriAI LiteLLM SQL Injection Vulnerability BerriAI · LiteLLM
- CVE-2026-6973 Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability Ivanti · Endpoint Manager Mobile (EPMM)
- CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability Palo Alto Networks · PAN-OS
- CVE-2026-31431 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability Linux · Kernel
- CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability WebPros · cPanel & WHM and WP2 (WordPress Squared)
- CVE-2024-1708 ConnectWise ScreenConnect Path Traversal Vulnerability ConnectWise · ScreenConnect
- CVE-2026-32202 Microsoft Windows Protection Mechanism Failure Vulnerability Microsoft · Windows
- CVE-2025-29635 D-Link DIR-823X Command Injection Vulnerability D-Link · DIR-823X
- CVE-2024-7399 Samsung MagicINFO 9 Server Path Traversal Vulnerability Samsung · MagicINFO 9 Server
- CVE-2024-57728 SimpleHelp Path Traversal Vulnerability SimpleHelp · SimpleHelp
- CVE-2024-57726 SimpleHelp Missing Authorization Vulnerability SimpleHelp · SimpleHelp
- CVE-2026-39987 Marimo Remote Code Execution Vulnerability Marimo · Marimo
- CVE-2026-33825 Microsoft Defender Insufficient Granularity of Access Control Vulnerability Microsoft · Defender
- CVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability Cisco · Catalyst SD-WAN Manger
- CVE-2026-20133 Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Cisco · Catalyst SD-WAN Manager
- CVE-2025-2749 Kentico Xperience Path Traversal Vulnerability Kentico · Kentico Xperience
- CVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability PaperCut · NG/MF
- CVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability Synacor · Zimbra Collaboration Suite (ZCS)
- CVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability Cisco · Catalyst SD-WAN Manager
- CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability Quest · KACE Systems Management Appliance (SMA)
- CVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability JetBrains · TeamCity
- CVE-2026-34197 Apache ActiveMQ Improper Input Validation Vulnerability Apache · ActiveMQ
- CVE-2009-0238 Microsoft Office Remote Code Execution Microsoft · Office
- CVE-2026-32201 Microsoft SharePoint Server Improper Input Validation Vulnerability Microsoft · SharePoint Server
- CVE-2012-1854 Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability Microsoft · Visual Basic for Applications (VBA)
- CVE-2025-60710 Microsoft Windows Link Following Vulnerability Microsoft · Windows
- CVE-2023-21529 Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability Microsoft · Exchange Server
- CVE-2023-36424 Microsoft Windows Out-of-Bounds Read Vulnerability Microsoft · Windows
- CVE-2020-9715 Adobe Acrobat Use-After-Free Vulnerability Adobe · Acrobat
- CVE-2026-21643 Fortinet FortiClient EMS SQL Injection Vulnerability Fortinet · FortiClient EMS
- CVE-2026-34621 Adobe Acrobat and Reader Prototype Pollution Vulnerability Adobe · Acrobat and Reader
- CVE-2026-1340 Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability Ivanti · Endpoint Manager Mobile (EPMM)
- CVE-2026-35616 Fortinet FortiClient EMS Improper Access Control Vulnerability Fortinet · FortiClient EMS
- CVE-2026-3502 TrueConf Client Download of Code Without Integrity Check Vulnerability TrueConf · Client
- CVE-2026-5281 Google Dawn Use-After-Free Vulnerability Google · Dawn
- CVE-2026-3055 Citrix NetScaler Out-of-Bounds Read Vulnerability Citrix · NetScaler
- CVE-2025-53521 F5 BIG-IP Stack-Based Buffer Overflow Vulnerability F5 · BIG-IP
- CVE-2026-33634 Aquasecurity Trivy Embedded Malicious Code Vulnerability Aquasecurity · Trivy
- CVE-2026-33017 Langflow Code Injection Vulnerability Langflow · Langflow
- CVE-2025-32432 Craft CMS Code Injection Vulnerability Craft CMS · Craft CMS
- CVE-2025-54068 Laravel Livewire Code Injection Vulnerability Laravel · Livewire
- CVE-2025-43510 Apple Multiple Products Improper Locking Vulnerability Apple · Multiple Products
- CVE-2025-43520 Apple Multiple Products Classic Buffer Overflow Vulnerability Apple · Multiple Products
- CVE-2025-31277 Apple Multiple Products Buffer Overflow Vulnerability Apple · Multiple Products
- CVE-2026-20131 Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability Cisco · Secure Firewall Management Center (FMC)
- CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Synacor · Zimbra Collaboration Suite (ZCS)
- CVE-2026-20963 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft · SharePoint
- CVE-2025-47813 Wing FTP Server Information Disclosure Vulnerability Wing FTP Server · Wing FTP Server
- CVE-2026-3910 Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability Google · Chromium V8
- CVE-2026-3909 Google Skia Out-of-Bounds Write Vulnerability Google · Skia
- CVE-2025-68613 n8n Improper Control of Dynamically-Managed Code Resources Vulnerability n8n · n8n
- CVE-2021-22054 Omnissa Workspace ONE Server-Side Request Forgery Omnissa · Workspace One UEM
- CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability SolarWinds · Web Help Desk
- CVE-2026-1603 Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability Ivanti · Endpoint Manager (EPM)
- CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability Hikvision · Multiple Products
Nothing on this page matches that filter.