BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 10:41 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 15 of 71

  1. Added to KEVSep 29, 2025
    CVE-2021-213117.2 HIGH⚡ Known ExploitedAdminer Adminer
    Adminer Server-Side Request Forgery VulnerabilityAdminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.
    ScoreSeverityVersionVector String
    7.2HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    6.4MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:N
  2. Added to KEVSep 25, 2025
    CVE-2025-203628.6 HIGH⚡ Known ExploitedCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
    Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization VulnerabilityCisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.
    ScoreSeverityVersionVector String
    8.6HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
    6.5MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  3. Added to KEVSep 25, 2025
    CVE-2025-203339.9 CRITICAL⚡ Known ExploitedCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
    Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow VulnerabilityCisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.
    ScoreSeverityVersionVector String
    9.9CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  4. Added to KEVSep 23, 2025
    CVE-2025-105859.8 CRITICAL⚡ Known ExploitedGoogle Chromium V8
    Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.8HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  5. Added to KEVSep 11, 2025
    CVE-2025-50869.0 CRITICAL⚡ Known ExploitedDassault Systèmes DELMIA Apriso
    Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data VulnerabilityDassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.
    ScoreSeverityVersionVector String
    9.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
  6. Added to KEVSep 4, 2025
    CVE-2025-536909.0 CRITICAL⚡ Known ExploitedSitecore Multiple Products
    Sitecore Multiple Products Deserialization of Untrusted Data VulnerabilitySitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
    ScoreSeverityVersionVector String
    9.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
  7. Added to KEVSep 4, 2025
    CVE-2025-485438.8 HIGH⚡ Known ExploitedAndroid Runtime
    Android Runtime Use-After-Free VulnerabilityAndroid Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CISA-ADPCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  8. Added to KEVSep 4, 2025
    CVE-2025-383527.8 HIGH⚡ Known ExploitedLinux Kernel
    Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition VulnerabilityLinux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  9. Added to KEVSep 3, 2025
    CVE-2025-93778.6 HIGH⚡ Known ExploitedTP-Link Multiple Routers
    TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection VulnerabilityTP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
    ScoreSeverityVersionVector String
    8.6HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    7.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  10. Added to KEVSep 3, 2025
    CVE-2023-502246.5 MEDIUM⚡ Known ExploitedTP-Link TL-WR841N
    TP-Link TL-WR841N Authentication Bypass by Spoofing VulnerabilityTP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
    ScoreSeverityVersionVector String
    6.5MEDIUM3.1CNACVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  11. Added to KEVSep 2, 2025
    CVE-2025-551775.4 MEDIUM⚡ Known ExploitedMeta Platforms WhatsApp
    Meta Platforms WhatsApp Incorrect Authorization VulnerabilityMeta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.
    ScoreSeverityVersionVector String
    5.4MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
  12. Added to KEVSep 2, 2025
    CVE-2020-243638.8 HIGH⚡ Known ExploitedTP-Link TL-WA855RE
    TP-link TL-WA855RE Missing Authentication for Critical Function VulnerabilityTP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.3HIGH2.0NVDAV:A/AC:L/Au:N/C:C/I:C/A:C
  13. Added to KEVAug 29, 2025
    CVE-2025-5781910.0 CRITICAL⚡ Known ExploitedSangoma FreePBX
    Sangoma FreePBX Authentication Bypass VulnerabilitySangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
    ScoreSeverityVersionVector String
    10.0CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  14. Added to KEVAug 26, 2025
    CVE-2025-77759.2 CRITICAL⚡ Known ExploitedCitrix NetScaler
    Citrix NetScaler Memory Overflow VulnerabilityCitrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.
    ScoreSeverityVersionVector String
    9.2CRITICAL4.0CNACVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  15. Added to KEVAug 25, 2025
    CVE-2025-483848.0 HIGH⚡ Known ExploitedGit Git
    Git Link Following VulnerabilityGit contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.
    ScoreSeverityVersionVector String
    8.0HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
  16. Added to KEVAug 25, 2025
    CVE-2024-80695.1 MEDIUM⚡ Known ExploitedCitrix Session Recording
    Citrix Session Recording Deserialization of Untrusted Data VulnerabilityCitrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.
    ScoreSeverityVersionVector String
    5.1MEDIUM4.0CNACVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
    8.0HIGH3.1NVDCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  17. Added to KEVAug 25, 2025
    CVE-2024-80685.1 MEDIUM⚡ Known ExploitedCitrix Session Recording
    Citrix Session Recording Improper Privilege Management VulnerabilityCitrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.
    ScoreSeverityVersionVector String
    5.1MEDIUM4.0CNACVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
    8.0HIGH3.1NVDCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  18. Added to KEVAug 21, 2025
    CVE-2025-4330010.0 CRITICAL⚡ Known ExploitedApple iOS, iPadOS, and macOS
    Apple iOS, iPadOS, and macOS Out-of-Bounds Write VulnerabilityApple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  19. Added to KEVAug 18, 2025
    CVE-2025-549489.8 CRITICAL⚡ Known ExploitedTrend Micro Apex One
    Trend Micro Apex One OS Command Injection VulnerabilityTrend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.4CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
  20. Added to KEVAug 13, 2025
    CVE-2025-88769.4 CRITICAL⚡ Known ExploitedN-able N-Central
    N-able N-Central Command Injection VulnerabilityN-able N-Central contains a command injection vulnerability via improper sanitization of user input.
    ScoreSeverityVersionVector String
    9.4CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  21. Added to KEVAug 13, 2025
    CVE-2025-88759.4 CRITICAL⚡ Known ExploitedN-able N-Central
    N-able N-Central Insecure Deserialization VulnerabilityN-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.
    ScoreSeverityVersionVector String
    9.4CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  22. Added to KEVAug 12, 2025
    CVE-2025-80888.4 HIGH⚡ Known ExploitedRARLAB WinRAR
    RARLAB WinRAR Path Traversal VulnerabilityRARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.
    ScoreSeverityVersionVector String
    8.4HIGH4.0CNACVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  23. Added to KEVAug 12, 2025
    CVE-2013-38938.8 HIGH⚡ Known ExploitedMicrosoft Internet Explorer
    Microsoft Internet Explorer Resource Management Errors VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  24. Added to KEVAug 12, 2025
    CVE-2007-06718.8 HIGH⚡ Known ExploitedMicrosoft Office
    Microsoft Office Excel Remote Code Execution VulnerabilityMicrosoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  25. Added to KEVAug 5, 2025
    CVE-2022-407998.8 HIGH⚡ Known ExploitedD-Link DNR-322L
    D-Link DNR-322L Download of Code Without Integrity Check VulnerabilityD-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 11:18 UTC.

CVE Database: Latest Vulnerabilities | Secure.com