CVE Radar:Know what’s exposed. Fix what matters.
Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.
1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 18 of 71
- Added to KEVMay 15, 2025CVE-2024-129876.9 MEDIUM⚡ Known ExploitedDrayTek Vigor RoutersDrayTek Vigor Routers OS Command Injection VulnerabilityDrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.
Score Severity Version Vector String 6.9 MEDIUM 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N 9.8 CRITICAL 3.1NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 7.3 HIGH 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 HIGH 2.0CNA AV:N/AC:L/Au:N/C:P/I:P/A:P - Added to KEVMay 14, 2025CVE-2025-327569.8 CRITICAL⚡ Known ExploitedFortinet Multiple ProductsFortinet Multiple Products Stack-Based Buffer Overflow VulnerabilityFortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.
Score Severity Version Vector String 9.8 CRITICAL 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Added to KEVMay 13, 2025CVE-2025-327097.8 HIGH⚡ Known ExploitedMicrosoft WindowsMicrosoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityMicrosoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.
Score Severity Version Vector String 7.8 HIGH 3.1CNA CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Added to KEVMay 13, 2025CVE-2025-327067.8 HIGH⚡ Known ExploitedMicrosoft WindowsMicrosoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityMicrosoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally.
Score Severity Version Vector String 7.8 HIGH 3.1CNA CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Added to KEVMay 13, 2025CVE-2025-327017.8 HIGH⚡ Known ExploitedMicrosoft WindowsMicrosoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityMicrosoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Score Severity Version Vector String 7.8 HIGH 3.1CNA CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Added to KEVMay 13, 2025CVE-2025-304007.8 HIGH⚡ Known ExploitedMicrosoft WindowsMicrosoft Windows DWM Core Library Use-After-Free VulnerabilityMicrosoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Score Severity Version Vector String 7.8 HIGH 3.1CNA CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Added to KEVMay 13, 2025CVE-2025-303977.5 HIGH⚡ Known ExploitedMicrosoft WindowsMicrosoft Windows Scripting Engine Type Confusion VulnerabilityMicrosoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.
Score Severity Version Vector String 7.5 HIGH 3.1CNA CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Added to KEVMay 12, 2025CVE-2025-477294.9 MEDIUM⚡ Known ExploitedTeleMessage TM SGNLTeleMessage TM SGNL Hidden Functionality VulnerabilityTeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users.
Score Severity Version Vector String 4.9 MEDIUM 3.1NVD CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N 1.9 LOW 3.1CNA CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N - Added to KEVMay 7, 2025CVE-2024-111209.8 CRITICAL⚡ Known ExploitedGeoVision Multiple DevicesGeoVision Devices OS Command Injection VulnerabilityMultiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Score Severity Version Vector String 9.8 CRITICAL 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Added to KEVMay 7, 2025CVE-2024-60479.8 CRITICAL⚡ Known ExploitedGeoVision Multiple DevicesGeoVision Devices OS Command Injection VulnerabilityMultiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Score Severity Version Vector String 9.8 CRITICAL 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Added to KEVMay 6, 2025CVE-2025-273638.1 HIGH⚡ Known ExploitedFreeType FreeTypeFreeType Out-of-Bounds Write VulnerabilityFreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.
Score Severity Version Vector String 8.1 HIGH 3.1CNA CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Added to KEVMay 5, 2025CVE-2025-32489.8 CRITICAL⚡ Known ExploitedLangflow LangflowLangflow Missing Authentication VulnerabilityLangflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.
Score Severity Version Vector String 9.8 CRITICAL 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Added to KEVMay 2, 2025CVE-2025-340289.3 CRITICAL⚡ Known ExploitedCommvault Command CenterCommvault Command Center Path Traversal VulnerabilityCommvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
Score Severity Version Vector String 9.3 CRITICAL 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H 10.0 CRITICAL 3.1NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Added to KEVMay 2, 2025CVE-2024-581369.8 CRITICAL⚡ Known ExploitedYiiframework YiiYiiframework Yii Improper Protection of Alternate Path VulnerabilityYii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.
Score Severity Version Vector String 9.8 CRITICAL 3.1NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.0 CRITICAL 3.1CNA CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Added to KEVMay 1, 2025CVE-2024-384759.1 CRITICAL⚡ Known ExploitedApache HTTP ServerApache HTTP Server Improper Escaping of Output VulnerabilityApache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
Score Severity Version Vector String 9.1 CRITICAL 3.1NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Added to KEVMay 1, 2025CVE-2023-442217.2 HIGH⚡ Known ExploitedSonicWall SMA100 AppliancesSonicWall SMA100 Appliances OS Command Injection VulnerabilitySonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
Score Severity Version Vector String 7.2 HIGH 3.1NVD CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Added to KEVApr 29, 2025CVE-2025-3132410.0 CRITICAL⚡ Known ExploitedSAP NetWeaverSAP NetWeaver Unrestricted File Upload VulnerabilitySAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
Score Severity Version Vector String 10.0 CRITICAL 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 9.8 CRITICAL 3.1NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Added to KEVApr 28, 2025CVE-2025-425999.8 CRITICAL⚡ Known ExploitedQualitia Active! MailQualitia Active! Mail Stack-Based Buffer Overflow VulnerabilityQualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.
Score Severity Version Vector String 9.8 CRITICAL 3.1NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.8 CRITICAL 3.0CNA CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Added to KEVApr 28, 2025CVE-2025-39288.7 HIGH⚡ Known ExploitedCommvault Web ServerCommvault Web Server Unspecified VulnerabilityCommvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.
Score Severity Version Vector String 8.7 HIGH 4.0CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 8.8 HIGH 3.1CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Added to KEVApr 28, 2025CVE-2025-19768.6 HIGH⚡ Known ExploitedBroadcom Brocade Fabric OSBroadcom Brocade Fabric OS Code Injection VulnerabilityBroadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.
Score Severity Version Vector String 8.6 HIGH 4.0CNA CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 6.7 MEDIUM 3.1NVD CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Added to KEVApr 17, 2025CVE-2025-312019.8 CRITICAL⚡ Known ExploitedApple Multiple ProductsApple Multiple Products Arbitrary Read and Write VulnerabilityApple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.
Score Severity Version Vector String 9.8 CRITICAL 3.1CISA-ADP CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Added to KEVApr 17, 2025CVE-2025-312009.8 CRITICAL⚡ Known ExploitedApple Multiple ProductsApple Multiple Products Memory Corruption VulnerabilityApple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.
Score Severity Version Vector String 9.8 CRITICAL 3.1CISA-ADP CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Added to KEVApr 17, 2025CVE-2025-240546.5 MEDIUM⚡ Known ExploitedMicrosoft WindowsMicrosoft Windows NTLM Hash Disclosure Spoofing VulnerabilityMicrosoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Score Severity Version Vector String 6.5 MEDIUM 3.1CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 5.4 MEDIUM 3.1NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Added to KEVApr 16, 2025CVE-2021-200356.5 MEDIUM⚡ Known ExploitedSonicWall SMA100 AppliancesSonicWall SMA100 Appliances OS Command Injection VulnerabilitySonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
Score Severity Version Vector String 6.5 MEDIUM 3.1NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 6.8 MEDIUM 2.0NVD AV:N/AC:L/Au:S/C:N/I:N/A:C - Added to KEVApr 9, 2025CVE-2024-531977.8 HIGH⚡ Known ExploitedLinux KernelLinux Kernel Out-of-Bounds Access VulnerabilityLinux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.
Score Severity Version Vector String 7.8 HIGH 3.1CISA-ADP CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H