BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 10:08 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 13 of 71

  1. Added to KEVDec 5, 2025
    CVE-2025-5518210.0 CRITICAL⚡ Known ExploitedMeta React Server Components
    Meta React Server Components Remote Code Execution VulnerabilityMeta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  2. Added to KEVDec 3, 2025
    CVE-2021-268288.8 HIGH⚡ Known ExploitedOpenPLC ScadaBR
    OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type VulnerabilityOpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  3. Added to KEVDec 2, 2025
    CVE-2025-486335.5 MEDIUM⚡ Known ExploitedAndroid Framework
    Android Framework Information Disclosure VulnerabilityAndroid Framework contains an unspecified vulnerability that allows for information disclosure.
    ScoreSeverityVersionVector String
    5.5MEDIUM3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  4. Added to KEVDec 2, 2025
    CVE-2025-485727.8 HIGH⚡ Known ExploitedAndroid Framework
    Android Framework Privilege Escalation VulnerabilityAndroid Framework contains an unspecified vulnerability that allows for privilege escalation.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CISA-ADPCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  5. Added to KEVNov 28, 2025
    CVE-2021-268295.4 MEDIUM⚡ Known ExploitedOpenPLC ScadaBR
    OpenPLC ScadaBR Cross-site Scripting VulnerabilityOpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.
    ScoreSeverityVersionVector String
    5.4MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    3.5LOW2.0NVDAV:N/AC:M/Au:S/C:N/I:P/A:N
  6. Added to KEVNov 21, 2025
    CVE-2025-617579.8 CRITICAL⚡ Known ExploitedOracle Fusion Middleware
    Oracle Fusion Middleware Missing Authentication for Critical Function VulnerabilityOracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7. Added to KEVNov 19, 2025
    CVE-2025-132238.8 HIGH⚡ Known ExploitedGoogle Chromium V8
    Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 contains a type confusion vulnerability that allows for heap corruption.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  8. Added to KEVNov 18, 2025
    CVE-2025-580347.2 HIGH⚡ Known ExploitedFortinet FortiWeb
    Fortinet FortiWeb OS Command Injection VulnerabilityFortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
    ScoreSeverityVersionVector String
    7.2HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  9. Added to KEVNov 14, 2025
    CVE-2025-644469.8 CRITICAL⚡ Known ExploitedFortinet FortiWeb
    Fortinet FortiWeb Path Traversal VulnerabilityFortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  10. Added to KEVNov 12, 2025
    CVE-2025-622157.0 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Race Condition VulnerabilityMicrosoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.
    ScoreSeverityVersionVector String
    7.0HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  11. Added to KEVNov 12, 2025
    CVE-2025-124809.1 CRITICAL⚡ Known ExploitedGladinet Triofox
    Gladinet Triofox Improper Access Control VulnerabilityGladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.
    ScoreSeverityVersionVector String
    9.1CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  12. Added to KEVNov 12, 2025
    CVE-2025-92429.3 CRITICAL⚡ Known ExploitedWatchGuard Firebox
    WatchGuard Firebox Out-of-Bounds Write VulnerabilityWatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.
    ScoreSeverityVersionVector String
    9.3CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  13. Added to KEVNov 10, 2025
    CVE-2025-210429.8 CRITICAL⚡ Known ExploitedSamsung Mobile Devices
    Samsung Mobile Devices Out-of-Bounds Write VulnerabilitySamsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  14. Added to KEVNov 4, 2025
    CVE-2025-487039.0 CRITICAL⚡ Known ExploitedCWP Control Web Panel
    CWP Control Web Panel OS Command Injection VulnerabilityCWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
    ScoreSeverityVersionVector String
    9.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
  15. Added to KEVNov 4, 2025
    CVE-2025-113717.5 HIGH⚡ Known ExploitedGladinet CentreStack and Triofox
    Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties VulnerabilityGladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  16. Added to KEVOct 30, 2025
    CVE-2025-412447.8 HIGH⚡ Known ExploitedBroadcom VMware Aria Operations and VMware Tools
    Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions VulnerabilityBroadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  17. Added to KEVOct 30, 2025
    CVE-2025-248939.8 CRITICAL⚡ Known ExploitedXWiki Platform
    XWiki Platform Eval Injection VulnerabilityXWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  18. Added to KEVOct 28, 2025
    CVE-2025-62059.1 CRITICAL⚡ Known ExploitedDassault Systèmes DELMIA Apriso
    Dassault Systèmes DELMIA Apriso Missing Authorization VulnerabilityDassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.
    ScoreSeverityVersionVector String
    9.1CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  19. Added to KEVOct 28, 2025
    CVE-2025-62048.0 HIGH⚡ Known ExploitedDassault Systèmes DELMIA Apriso
    Dassault Systèmes DELMIA Apriso Code Injection VulnerabilityDassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.
    ScoreSeverityVersionVector String
    8.0HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
  20. Added to KEVOct 24, 2025
    CVE-2025-592879.8 CRITICAL⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data VulnerabilityMicrosoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  21. Added to KEVOct 24, 2025
    CVE-2025-542369.1 CRITICAL⚡ Known ExploitedAdobe Commerce and Magento
    Adobe Commerce and Magento Improper Input Validation VulnerabilityAdobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
    ScoreSeverityVersionVector String
    9.1CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  22. Added to KEVOct 22, 2025
    CVE-2025-619329.3 CRITICAL⚡ Known ExploitedMotex LANSCOPE Endpoint Manager
    Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel VulnerabilityMotex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.
    ScoreSeverityVersionVector String
    9.3CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    9.8CRITICAL3.0CNACVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  23. Added to KEVOct 20, 2025
    CVE-2025-618847.5 HIGH⚡ Known ExploitedOracle E-Business Suite
    Oracle E-Business Suite Server-Side Request Forgery (SSRF) VulnerabilityOracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  24. Added to KEVOct 20, 2025
    CVE-2025-330738.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows SMB Client Improper Access Control VulnerabilityMicrosoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  25. Added to KEVOct 20, 2025
    CVE-2025-27479.8 CRITICAL⚡ Known ExploitedKentico Xperience CMS
    Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityKentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 10:34 UTC.

CVE Database: Latest Vulnerabilities | Secure.com