BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 12:12 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 25 of 71

  1. Added to KEVSep 10, 2024
    CVE-2024-382267.3 HIGH⚡ Known ExploitedMicrosoft Publisher
    Microsoft Publisher Protection Mechanism Failure VulnerabilityMicrosoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.
    ScoreSeverityVersionVector String
    7.3HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  2. Added to KEVSep 10, 2024
    CVE-2024-382175.4 MEDIUM⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure VulnerabilityMicrosoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.
    ScoreSeverityVersionVector String
    5.4MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
  3. Added to KEVSep 10, 2024
    CVE-2024-380147.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Installer Improper Privilege Management VulnerabilityMicrosoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  4. Added to KEVSep 9, 2024
    CVE-2024-407669.8 CRITICAL⚡ Known ExploitedSonicWall SonicOS
    SonicWall SonicOS Improper Access Control VulnerabilitySonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.3CRITICAL3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
  5. Added to KEVSep 9, 2024
    CVE-2017-10002537.8 HIGH⚡ Known ExploitedLinux Kernel
    Linux Kernel PIE Stack Buffer Corruption Vulnerability Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  6. Added to KEVSep 9, 2024
    CVE-2016-37148.4 HIGH⚡ Known ExploitedImageMagick ImageMagick
    ImageMagick Improper Input Validation VulnerabilityImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.
    ScoreSeverityVersionVector String
    8.4HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  7. Added to KEVSep 3, 2024
    CVE-2024-72629.3 CRITICAL⚡ Known ExploitedKingsoft WPS Office
    Kingsoft WPS Office Path Traversal VulnerabilityKingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.
    ScoreSeverityVersionVector String
    9.3CRITICAL4.0CNACVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/RE:L
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  8. Added to KEVSep 3, 2024
    CVE-2021-201247.5 HIGH⚡ Known ExploitedDrayTek VigorConnect
    Draytek VigorConnect Path Traversal Vulnerability Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    7.8HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:N/A:N
  9. Added to KEVSep 3, 2024
    CVE-2021-201237.5 HIGH⚡ Known ExploitedDrayTek VigorConnect
    Draytek VigorConnect Path Traversal Vulnerability Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    7.8HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:N/A:N
  10. Added to KEVAug 28, 2024
    CVE-2024-79658.8 HIGH⚡ Known ExploitedGoogle Chromium V8
    Google Chromium V8 Inappropriate Implementation VulnerabilityGoogle Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  11. Added to KEVAug 27, 2024
    CVE-2024-388569.8 CRITICAL⚡ Known ExploitedApache OFBiz
    Apache OFBiz Incorrect Authorization VulnerabilityApache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.1HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
  12. Added to KEVAug 26, 2024
    CVE-2024-79719.6 CRITICAL⚡ Known ExploitedGoogle Chromium V8
    Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
    ScoreSeverityVersionVector String
    9.6CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    8.8HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  13. Added to KEVAug 23, 2024
    CVE-2024-397177.2 HIGH⚡ Known ExploitedVersa Director
    Versa Director Dangerous File Type Upload VulnerabilityThe Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.
    ScoreSeverityVersionVector String
    7.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    6.6MEDIUM3.0CNACVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
  14. Added to KEVAug 21, 2024
    CVE-2022-01858.4 HIGH⚡ Known ExploitedLinux Kernel
    Linux Kernel Heap-Based Buffer Overflow VulnerabilityLinux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.
    ScoreSeverityVersionVector String
    8.4HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  15. Added to KEVAug 21, 2024
    CVE-2021-330459.8 CRITICAL⚡ Known ExploitedDahua IP Camera Firmware
    Dahua IP Camera Authentication Bypass VulnerabilityDahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  16. Added to KEVAug 21, 2024
    CVE-2021-330449.8 CRITICAL⚡ Known ExploitedDahua IP Camera Firmware
    Dahua IP Camera Authentication Bypass VulnerabilityDahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  17. Added to KEVAug 21, 2024
    CVE-2021-311967.2 HIGH⚡ Known ExploitedMicrosoft Exchange Server
    Microsoft Exchange Server Information Disclosure VulnerabilityMicrosoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.
    ScoreSeverityVersionVector String
    7.2HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  18. Added to KEVAug 19, 2024
    CVE-2024-238979.8 CRITICAL⚡ Known ExploitedJenkins Jenkins Command Line Interface (CLI)
    Jenkins Command Line Interface (CLI) Path Traversal VulnerabilityJenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  19. Added to KEVAug 15, 2024
    CVE-2024-289869.8 CRITICAL⚡ Known ExploitedSolarWinds Web Help Desk
    SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilitySolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  20. Added to KEVAug 13, 2024
    CVE-2024-382136.5 MEDIUM⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.
    ScoreSeverityVersionVector String
    6.5MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
  21. Added to KEVAug 13, 2024
    CVE-2024-381937.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation VulnerabilityMicrosoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  22. Added to KEVAug 13, 2024
    CVE-2024-381898.8 HIGH⚡ Known ExploitedMicrosoft Project
    Microsoft Project Remote Code Execution Vulnerability Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  23. Added to KEVAug 13, 2024
    CVE-2024-381787.5 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Scripting Engine Memory Corruption VulnerabilityMicrosoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
  24. Added to KEVAug 13, 2024
    CVE-2024-381077.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Power Dependency Coordinator Privilege Escalation VulnerabilityMicrosoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  25. Added to KEVAug 13, 2024
    CVE-2024-381067.0 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Kernel Privilege Escalation VulnerabilityMicrosoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.
    ScoreSeverityVersionVector String
    7.0HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 12:51 UTC.

CVE Database: Latest Vulnerabilities | Secure.com