BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 10:08 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 14 of 71

  1. Added to KEVOct 20, 2025
    CVE-2025-27469.8 CRITICAL⚡ Known ExploitedKentico Xperience CMS
    Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityKentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  2. Added to KEVOct 20, 2025
    CVE-2022-485038.8 HIGH⚡ Known ExploitedApple Multiple Products
    Apple Multiple Products Unspecified VulnerabilityApple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  3. Added to KEVOct 15, 2025
    CVE-2025-5425310.0 CRITICAL⚡ Known ExploitedAdobe Experience Manager (AEM) Forms
    Adobe Experience Manager Forms Code Execution VulnerabilityAdobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  4. Added to KEVOct 14, 2025
    CVE-2025-592307.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Improper Access Control VulnerabilityMicrosoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  5. Added to KEVOct 14, 2025
    CVE-2025-478274.6 MEDIUM⚡ Known ExploitedIGEL IGEL OS
    IGEL OS Use of a Key Past its Expiration Date VulnerabilityIGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
    ScoreSeverityVersionVector String
    4.6MEDIUM3.1CISA-ADPCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  6. Added to KEVOct 14, 2025
    CVE-2025-249907.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Untrusted Pointer Dereference VulnerabilityMicrosoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  7. Added to KEVOct 14, 2025
    CVE-2016-78369.8 CRITICAL⚡ Known ExploitedSKYSEA Client View
    SKYSEA Client View Improper Authentication VulnerabilitySKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  8. Added to KEVOct 9, 2025
    CVE-2021-437987.5 HIGH⚡ Known ExploitedGrafana Labs Grafana
    Grafana Path Traversal VulnerabilityGrafana contains a path traversal vulnerability that could allow access to local files.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:N/A:N
  9. Added to KEVOct 7, 2025
    CVE-2025-279155.4 MEDIUM⚡ Known ExploitedSynacor Zimbra Collaboration Suite (ZCS)
    Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilitySynacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
    ScoreSeverityVersionVector String
    5.4MEDIUM3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
  10. Added to KEVOct 6, 2025
    CVE-2025-618829.8 CRITICAL⚡ Known ExploitedOracle E-Business Suite
    Oracle E-Business Suite Unspecified VulnerabilityOracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  11. Added to KEVOct 6, 2025
    CVE-2021-432267.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Privilege Escalation VulnerabilityMicrosoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    4.6MEDIUM2.0NVDAV:L/AC:L/Au:N/C:P/I:P/A:P
  12. Added to KEVOct 6, 2025
    CVE-2021-225558.3 HIGH⚡ Known ExploitedLinux Kernel
    Linux Kernel Heap Out-of-Bounds Write VulnerabilityLinux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
    ScoreSeverityVersionVector String
    8.3HIGH3.1CNACVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    4.6MEDIUM2.0NVDAV:L/AC:L/Au:N/C:P/I:P/A:P
  13. Added to KEVOct 6, 2025
    CVE-2013-39188.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Out-of-Bounds Write VulnerabilityMicrosoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  14. Added to KEVOct 6, 2025
    CVE-2011-34028.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Remote Code Execution VulnerabilityMicrosoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  15. Added to KEVOct 6, 2025
    CVE-2010-39628.1 HIGH⚡ Known ExploitedMicrosoft Internet Explorer
    Microsoft Internet Explorer Uninitialized Memory Corruption VulnerabilityMicrosoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
    ScoreSeverityVersionVector String
    8.1HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  16. Added to KEVOct 6, 2025
    CVE-2010-37659.8 CRITICAL⚡ Known ExploitedMozilla Multiple Products
    Mozilla Multiple Products Remote Code Execution VulnerabilityMozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  17. Added to KEVOct 2, 2025
    CVE-2025-210439.8 CRITICAL⚡ Known ExploitedSamsung Mobile Devices
    Samsung Mobile Devices Out-of-Bounds Write VulnerabilitySamsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  18. Added to KEVOct 2, 2025
    CVE-2025-40088.7 HIGH⚡ Known ExploitedSmartbedded Meteobridge
    Smartbedded Meteobridge Command Injection VulnerabilitySmartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.
    ScoreSeverityVersionVector String
    8.7HIGH4.0CNACVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    8.8HIGH3.1NVDCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  19. Added to KEVOct 2, 2025
    CVE-2017-10003539.8 CRITICAL⚡ Known ExploitedJenkins Jenkins
    Jenkins Remote Code Execution VulnerabilityJenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  20. Added to KEVOct 2, 2025
    CVE-2015-77559.8 CRITICAL⚡ Known ExploitedJuniper ScreenOS
    Juniper ScreenOS Improper Authentication VulnerabilityJuniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  21. Added to KEVOct 2, 2025
    CVE-2014-62788.8 HIGH⚡ Known ExploitedGNU GNU Bash
    GNU Bash OS Command Injection VulnerabilityGNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  22. Added to KEVSep 29, 2025
    CVE-2025-596896.1 MEDIUM⚡ Known ExploitedLibraesva Email Security Gateway
    Libraesva Email Security Gateway Command Injection VulnerabilityLibraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.
    ScoreSeverityVersionVector String
    6.1MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  23. Added to KEVSep 29, 2025
    CVE-2025-324639.3 CRITICAL⚡ Known ExploitedSudo Sudo
    Sudo Inclusion of Functionality from Untrusted Control Sphere VulnerabilitySudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
    ScoreSeverityVersionVector String
    9.3CRITICAL3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  24. Added to KEVSep 29, 2025
    CVE-2025-203527.7 HIGH⚡ Known ExploitedCisco IOS and IOS XE
    Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution VulnerabilityCisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.
    ScoreSeverityVersionVector String
    7.7HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
  25. Added to KEVSep 29, 2025
    CVE-2025-1003510.0 CRITICAL⚡ Known ExploitedFortra GoAnywhere MFT
    Fortra GoAnywhere MFT Deserialization of Untrusted Data VulnerabilityFortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 10:48 UTC.

CVE Database: Latest Vulnerabilities | Secure.com