BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 11:24 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 19 of 71

  1. Added to KEVApr 9, 2025
    CVE-2024-531507.1 HIGH⚡ Known ExploitedLinux Kernel
    Linux Kernel Out-of-Bounds Read VulnerabilityLinux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.
    ScoreSeverityVersionVector String
    7.1HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
  2. Added to KEVApr 8, 2025
    CVE-2025-304069.8 CRITICAL⚡ Known ExploitedGladinet CentreStack
    Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key VulnerabilityGladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
  3. Added to KEVApr 8, 2025
    CVE-2025-298247.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityMicrosoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  4. Added to KEVApr 7, 2025
    CVE-2025-311619.8 CRITICAL⚡ Known ExploitedCrushFTP CrushFTP
    CrushFTP Authentication Bypass VulnerabilityCrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  5. Added to KEVApr 4, 2025
    CVE-2025-224579.8 CRITICAL⚡ Known ExploitedIvanti Connect Secure, Policy Secure, and ZTA Gateways
    Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityIvanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
  6. Added to KEVApr 1, 2025
    CVE-2025-2481310.0 CRITICAL⚡ Known ExploitedApache Tomcat
    Apache Tomcat Path Equivalence VulnerabilityApache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7. Added to KEVMar 31, 2025
    CVE-2024-204399.8 CRITICAL⚡ Known ExploitedCisco Smart Licensing Utility
    Cisco Smart Licensing Utility Static Credential VulnerabilityCisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  8. Added to KEVMar 27, 2025
    CVE-2025-27838.3 HIGH⚡ Known ExploitedGoogle Chromium Mojo
    Google Chromium Mojo Sandbox Escape VulnerabilityGoogle Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
    ScoreSeverityVersionVector String
    8.3HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
  9. Added to KEVMar 26, 2025
    CVE-2019-98758.8 HIGH⚡ Known ExploitedSitecore CMS and Experience Platform (XP)
    Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilitySitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  10. Added to KEVMar 26, 2025
    CVE-2019-98749.8 CRITICAL⚡ Known ExploitedSitecore CMS and Experience Platform (XP)
    Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilitySitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  11. Added to KEVMar 24, 2025
    CVE-2025-301548.6 HIGH⚡ Known Exploitedreviewdog action-setup GitHub Action
    reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerabilityreviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.
    ScoreSeverityVersionVector String
    8.6HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
  12. Added to KEVMar 19, 2025
    CVE-2025-13169.3 CRITICAL⚡ Known ExploitedEdimax IC-7100 IP Camera
    Edimax IC-7100 IP Camera OS Command Injection VulnerabilityEdimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
    ScoreSeverityVersionVector String
    9.3CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  13. Added to KEVMar 19, 2025
    CVE-2024-482488.6 HIGH⚡ Known ExploitedNAKIVO Backup and Replication
    NAKIVO Backup and Replication Absolute Path Traversal VulnerabilityNAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.
    ScoreSeverityVersionVector String
    8.6HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
  14. Added to KEVMar 19, 2025
    CVE-2017-126377.5 HIGH⚡ Known ExploitedSAP NetWeaver
    SAP NetWeaver Directory Traversal VulnerabilitySAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:N/A:N
  15. Added to KEVMar 18, 2025
    CVE-2025-300668.6 HIGH⚡ Known Exploitedtj-actions changed-files GitHub Action
    tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerabilitytj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.
    ScoreSeverityVersionVector String
    8.6HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
  16. Added to KEVMar 18, 2025
    CVE-2025-244728.1 HIGH⚡ Known ExploitedFortinet FortiOS and FortiProxy
    Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
    ScoreSeverityVersionVector String
    8.1HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  17. Added to KEVMar 13, 2025
    CVE-2025-2420110.0 CRITICAL⚡ Known ExploitedApple Multiple Products
    Apple Multiple Products WebKit Out-of-Bounds Write VulnerabilityApple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  18. Added to KEVMar 13, 2025
    CVE-2025-215906.7 MEDIUM⚡ Known ExploitedJuniper Junos OS
    Juniper Junos OS Improper Isolation or Compartmentalization VulnerabilityJuniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.
    ScoreSeverityVersionVector String
    6.7MEDIUM4.0CNACVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
    4.4MEDIUM3.1CNACVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
  19. Added to KEVMar 11, 2025
    CVE-2025-266337.0 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Management Console (MMC) Improper Neutralization VulnerabilityMicrosoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.
    ScoreSeverityVersionVector String
    7.0HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
  20. Added to KEVMar 11, 2025
    CVE-2025-249937.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows NTFS Heap-Based Buffer Overflow VulnerabilityMicrosoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  21. Added to KEVMar 11, 2025
    CVE-2025-249915.5 MEDIUM⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows NTFS Out-Of-Bounds Read VulnerabilityMicrosoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.
    ScoreSeverityVersionVector String
    5.5MEDIUM3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
  22. Added to KEVMar 11, 2025
    CVE-2025-249857.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Fast FAT File System Driver Integer Overflow VulnerabilityMicrosoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  23. Added to KEVMar 11, 2025
    CVE-2025-249844.6 MEDIUM⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows NTFS Information Disclosure VulnerabilityMicrosoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.
    ScoreSeverityVersionVector String
    4.6MEDIUM3.1CNACVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  24. Added to KEVMar 11, 2025
    CVE-2025-249837.0 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Win32k Use-After-Free VulnerabilityMicrosoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.0HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  25. Added to KEVMar 10, 2025
    CVE-2025-251817.5 HIGH⚡ Known ExploitedAdvantive VeraCore
    Advantive VeraCore SQL Injection VulnerabilityAdvantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    5.8MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 11:48 UTC.

CVE Database: Latest Vulnerabilities | Secure.com