BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 11:52 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 22 of 71

  1. Added to KEVJan 8, 2025
    CVE-2025-02829.0 CRITICAL⚡ Known ExploitedIvanti Connect Secure, Policy Secure, and ZTA Gateways
    Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityIvanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
    ScoreSeverityVersionVector String
    9.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
  2. Added to KEVJan 7, 2025
    CVE-2024-555504.4 MEDIUM⚡ Known ExploitedMitel MiCollab
    Mitel MiCollab Path Traversal VulnerabilityMitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
    ScoreSeverityVersionVector String
    4.4MEDIUM3.1CISA-ADPCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
    2.7LOW3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
  3. Added to KEVJan 7, 2025
    CVE-2024-417139.1 CRITICAL⚡ Known ExploitedMitel MiCollab
    Mitel MiCollab Path Traversal VulnerabilityMitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
    ScoreSeverityVersionVector String
    9.1CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  4. Added to KEVJan 7, 2025
    CVE-2020-28839.8 CRITICAL⚡ Known ExploitedOracle WebLogic Server
    Oracle WebLogic Server Unspecified VulnerabilityOracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.8CRITICAL3.0CNACVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  5. Added to KEVDec 30, 2024
    CVE-2024-33938.7 HIGH⚡ Known ExploitedPalo Alto Networks PAN-OS
    Palo Alto Networks PAN-OS Malicious DNS Packet VulnerabilityPalo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
    ScoreSeverityVersionVector String
    8.7HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:U/V:C/RE:M/U:Amber
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  6. Added to KEVDec 23, 2024
    CVE-2021-442078.1 HIGH⚡ Known ExploitedAcclaim Systems USAHERDS
    Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.
    ScoreSeverityVersionVector String
    8.1HIGH3.1NVDCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  7. Added to KEVDec 19, 2024
    CVE-2024-123569.8 CRITICAL⚡ Known ExploitedBeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)
    BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  8. Added to KEVDec 18, 2024
    CVE-2022-232279.8 CRITICAL⚡ Known ExploitedNUUO NVRmini2 Devices
    NUUO NVRmini2 Devices Missing Authentication Vulnerability NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  9. Added to KEVDec 18, 2024
    CVE-2021-404077.2 HIGH⚡ Known ExploitedReolink RLC-410W IP Camera
    Reolink RLC-410W IP Camera OS Command Injection Vulnerability Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.
    ScoreSeverityVersionVector String
    7.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    9.1CRITICAL3.0CNACVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  10. Added to KEVDec 18, 2024
    CVE-2019-110017.2 HIGH⚡ Known ExploitedReolink Multiple IP Cameras
    Reolink Multiple IP Cameras OS Command Injection VulnerabilityReolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.
    ScoreSeverityVersionVector String
    7.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  11. Added to KEVDec 18, 2024
    CVE-2018-149339.8 CRITICAL⚡ Known ExploitedNUUO NVRmini Devices
    NUUO NVRmini Devices OS Command Injection Vulnerability NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  12. Added to KEVDec 17, 2024
    CVE-2024-559569.8 CRITICAL⚡ Known ExploitedCleo Multiple Products
    Cleo Multiple Products Unauthenticated File Upload VulnerabilityCleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  13. Added to KEVDec 16, 2024
    CVE-2024-352507.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  14. Added to KEVDec 16, 2024
    CVE-2024-207677.4 HIGH⚡ Known ExploitedAdobe ColdFusion
    Adobe ColdFusion Improper Access Control VulnerabilityAdobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
    ScoreSeverityVersionVector String
    7.4HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  15. Added to KEVDec 13, 2024
    CVE-2024-506239.8 CRITICAL⚡ Known ExploitedCleo Multiple Products
    Cleo Multiple Products Unrestricted File Upload VulnerabilityCleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  16. Added to KEVDec 10, 2024
    CVE-2024-491387.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityMicrosoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  17. Added to KEVDec 4, 2024
    CVE-2024-5137810.0 CRITICAL⚡ Known ExploitedCyberPersons CyberPanel
    CyberPanel Incorrect Default Permissions VulnerabilityCyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  18. Added to KEVDec 3, 2024
    CVE-2024-116809.8 CRITICAL⚡ Known ExploitedProjectSend ProjectSend
    ProjectSend Improper Authentication VulnerabilityProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  19. Added to KEVDec 3, 2024
    CVE-2024-116679.8 CRITICAL⚡ Known ExploitedZyxel Multiple Firewalls
    Zyxel Multiple Firewalls Path Traversal VulnerabilityMultiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  20. Added to KEVDec 3, 2024
    CVE-2023-457277.5 HIGH⚡ Known ExploitedNorth Grid Proself
    North Grid Proself Improper Restriction of XML External Entity (XXE) Reference VulnerabilityNorth Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  21. Added to KEVNov 25, 2024
    CVE-2023-284619.8 CRITICAL⚡ Known ExploitedArray Networks AG/vxAG ArrayOS
    Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function VulnerabilityArray Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  22. Added to KEVNov 21, 2024
    CVE-2024-443096.3 MEDIUM⚡ Known ExploitedApple Multiple Products
    Apple Multiple Products Cross-Site Scripting (XSS) VulnerabilityApple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack.
    ScoreSeverityVersionVector String
    6.3MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
  23. Added to KEVNov 21, 2024
    CVE-2024-443088.8 HIGH⚡ Known ExploitedApple Multiple Products
    Apple Multiple Products Code Execution VulnerabilityApple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  24. Added to KEVNov 21, 2024
    CVE-2024-212877.5 HIGH⚡ Known ExploitedOracle Agile Product Lifecycle Management (PLM)
    Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization VulnerabilityOracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  25. Added to KEVNov 20, 2024
    CVE-2024-388139.8 CRITICAL⚡ Known ExploitedVMware vCenter Server
    VMware vCenter Server Privilege Escalation VulnerabilityVMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 12:23 UTC.

CVE Database: Latest Vulnerabilities | Secure.com