BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 11:09 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 21 of 71

  1. Added to KEVFeb 11, 2025
    CVE-2025-214187.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow VulnerabilityMicrosoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  2. Added to KEVFeb 11, 2025
    CVE-2025-213917.1 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Storage Link Following VulnerabilityMicrosoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.
    ScoreSeverityVersionVector String
    7.1HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
  3. Added to KEVFeb 11, 2025
    CVE-2024-408918.8 HIGH⚡ Known ExploitedZyxel DSL CPE Devices
    Zyxel DSL CPE OS Command Injection VulnerabilityMultiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  4. Added to KEVFeb 11, 2025
    CVE-2024-408908.8 HIGH⚡ Known ExploitedZyxel DSL CPE Devices
    Zyxel DSL CPE OS Command Injection VulnerabilityMultiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  5. Added to KEVFeb 7, 2025
    CVE-2025-09948.6 HIGH⚡ Known ExploitedTrimble Cityworks
    Trimble Cityworks Deserialization VulnerabilityTrimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.
    ScoreSeverityVersionVector String
    8.6HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  6. Added to KEVFeb 6, 2025
    CVE-2025-04117.0 HIGH⚡ Known Exploited7-Zip 7-Zip
    7-Zip Mark of the Web Bypass Vulnerability7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user.
    ScoreSeverityVersionVector String
    7.0HIGH3.1NVDCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
    7.0HIGH3.0CNACVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
  7. Added to KEVFeb 6, 2025
    CVE-2024-214139.8 CRITICAL⚡ Known ExploitedMicrosoft Office Outlook
    Microsoft Outlook Improper Input Validation VulnerabilityMicrosoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  8. Added to KEVFeb 6, 2025
    CVE-2022-237487.8 HIGH⚡ Known ExploitedAudinate Dante Discovery
    Dante Discovery Process Control VulnerabilityDante Discovery contains a process control vulnerability in mDNSResponder.exe that all allows for a DLL sideloading attack. A local attacker can leverage this vulnerability in the Dante Application Library to execute arbitrary code.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  9. Added to KEVFeb 6, 2025
    CVE-2020-295749.8 CRITICAL⚡ Known ExploitedSophos CyberoamOS
    CyberoamOS (CROS) SQL Injection VulnerabilityCyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  10. Added to KEVFeb 6, 2025
    CVE-2020-150699.8 CRITICAL⚡ Known ExploitedSophos XG Firewall
    Sophos XG Firewall Buffer Overflow VulnerabilitySophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  11. Added to KEVFeb 5, 2025
    CVE-2024-531047.8 HIGH⚡ Known ExploitedLinux Kernel
    Linux Kernel Out-of-Bounds Write VulnerabilityLinux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  12. Added to KEVFeb 4, 2025
    CVE-2024-451959.8 CRITICAL⚡ Known ExploitedApache OFBiz
    Apache OFBiz Forced Browsing VulnerabilityApache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  13. Added to KEVFeb 4, 2025
    CVE-2024-290597.5 HIGH⚡ Known ExploitedMicrosoft .NET Framework
    Microsoft .NET Framework Information Disclosure VulnerabilityMicrosoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  14. Added to KEVFeb 4, 2025
    CVE-2018-194109.8 CRITICAL⚡ Known ExploitedPaessler PRTG Network Monitor
    Paessler PRTG Network Monitor Local File Inclusion VulnerabilityPaessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator).
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  15. Added to KEVFeb 4, 2025
    CVE-2018-92767.2 HIGH⚡ Known ExploitedPaessler PRTG Network Monitor
    Paessler PRTG Network Monitor OS Command Injection VulnerabilityPaessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.
    ScoreSeverityVersionVector String
    7.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  16. Added to KEVJan 29, 2025
    CVE-2025-2408510.0 CRITICAL⚡ Known ExploitedApple Multiple Products
    Apple Multiple Products Use-After-Free VulnerabilityApple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  17. Added to KEVJan 24, 2025
    CVE-2025-230069.8 CRITICAL⚡ Known ExploitedSonicWall SMA1000 Appliances
    SonicWall SMA1000 Appliances Deserialization VulnerabilitySonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  18. Added to KEVJan 23, 2025
    CVE-2020-110236.9 MEDIUM⚡ Known ExploitedJQuery JQuery
    JQuery Cross-Site Scripting (XSS) VulnerabilityJQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.
    ScoreSeverityVersionVector String
    6.9MEDIUM3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
    6.1MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    4.3MEDIUM2.0NVDAV:N/AC:M/Au:N/C:N/I:P/A:N
  19. Added to KEVJan 16, 2025
    CVE-2024-5060310.0 CRITICAL⚡ Known ExploitedAviatrix Controllers
    Aviatrix Controllers OS Command Injection VulnerabilityAviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  20. Added to KEVJan 14, 2025
    CVE-2025-213357.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityMicrosoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  21. Added to KEVJan 14, 2025
    CVE-2025-213347.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityMicrosoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  22. Added to KEVJan 14, 2025
    CVE-2025-213337.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow VulnerabilityMicrosoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  23. Added to KEVJan 14, 2025
    CVE-2024-555919.8 CRITICAL⚡ Known ExploitedFortinet FortiOS and FortiProxy
    Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityFortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  24. Added to KEVJan 13, 2025
    CVE-2024-126867.2 HIGH⚡ Known ExploitedBeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)
    BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection VulnerabilityBeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
    ScoreSeverityVersionVector String
    7.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    6.6MEDIUM3.1CNACVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
  25. Added to KEVJan 13, 2025
    CVE-2023-483659.9 CRITICAL⚡ Known ExploitedQlik Sense
    Qlik Sense HTTP Tunneling VulnerabilityQlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
    ScoreSeverityVersionVector String
    9.9CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    9.6CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 12:12 UTC.

CVE Database: Latest Vulnerabilities | Secure.com