BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 12:12 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 29 of 71

  1. Added to KEVJan 17, 2024
    CVE-2024-05198.8 HIGH⚡ Known ExploitedGoogle Chromium V8
    Google Chromium V8 Out-of-Bounds Memory Access VulnerabilityGoogle Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  2. Added to KEVJan 17, 2024
    CVE-2023-65498.2 HIGH⚡ Known ExploitedCitrix NetScaler ADC and NetScaler Gateway
    Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow VulnerabilityCitrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
    ScoreSeverityVersionVector String
    8.2HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  3. Added to KEVJan 17, 2024
    CVE-2023-65488.8 HIGH⚡ Known ExploitedCitrix NetScaler ADC and NetScaler Gateway
    Citrix NetScaler ADC and NetScaler Gateway Code Injection VulnerabilityCitrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    5.5MEDIUM3.1CNACVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
  4. Added to KEVJan 16, 2024
    CVE-2018-151338.1 HIGH⚡ Known ExploitedLaravel Laravel Framework
    Laravel Deserialization of Untrusted Data VulnerabilityLaravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).
    ScoreSeverityVersionVector String
    8.1HIGH3.1NVDCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  5. Added to KEVJan 10, 2024
    CVE-2024-218879.1 CRITICAL⚡ Known ExploitedIvanti Connect Secure and Policy Secure
    Ivanti Connect Secure and Policy Secure Command Injection VulnerabilityIvanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.
    ScoreSeverityVersionVector String
    9.1CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
    9.1CRITICAL3.0CNACVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
  6. Added to KEVJan 10, 2024
    CVE-2023-468058.2 HIGH⚡ Known ExploitedIvanti Connect Secure and Policy Secure
    Ivanti Connect Secure and Policy Secure Authentication Bypass VulnerabilityIvanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.
    ScoreSeverityVersionVector String
    8.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    8.2HIGH3.0CNACVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
  7. Added to KEVJan 10, 2024
    CVE-2023-293579.8 CRITICAL⚡ Known ExploitedMicrosoft SharePoint Server
    Microsoft SharePoint Server Privilege Escalation VulnerabilityMicrosoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  8. Added to KEVJan 8, 2024
    CVE-2023-419907.8 HIGH⚡ Known ExploitedApple Multiple Products
    Apple Multiple Products Code Execution VulnerabilityApple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  9. Added to KEVJan 8, 2024
    CVE-2023-382039.8 CRITICAL⚡ Known ExploitedAdobe ColdFusion
    Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  10. Added to KEVJan 8, 2024
    CVE-2023-293009.8 CRITICAL⚡ Known ExploitedAdobe ColdFusion
    Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  11. Added to KEVJan 8, 2024
    CVE-2023-275249.8 CRITICAL⚡ Known ExploitedApache Superset
    Apache Superset Insecure Default Initialization of Resource VulnerabilityApache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.9HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
  12. Added to KEVJan 8, 2024
    CVE-2023-237525.3 MEDIUM⚡ Known ExploitedJoomla! Joomla!
    Joomla! Improper Access Control VulnerabilityJoomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.
    ScoreSeverityVersionVector String
    5.3MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  13. Added to KEVJan 8, 2024
    CVE-2016-200179.8 CRITICAL⚡ Known ExploitedD-Link DSL-2750B Devices
    D-Link DSL-2750B Devices Command Injection VulnerabilityD-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  14. Added to KEVJan 2, 2024
    CVE-2023-71017.8 HIGH⚡ Known ExploitedSpreadsheet::ParseExcel Spreadsheet::ParseExcel
    Spreadsheet::ParseExcel Remote Code Execution VulnerabilitySpreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  15. Added to KEVJan 2, 2024
    CVE-2023-70248.8 HIGH⚡ Known ExploitedGoogle Chromium WebRTC
    Google Chromium WebRTC Heap Buffer Overflow VulnerabilityGoogle Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  16. Added to KEVDec 21, 2023
    CVE-2023-498978.8 HIGH⚡ Known ExploitedFXC AE1021, AE1021PE
    FXC AE1021, AE1021PE OS Command Injection VulnerabilityFXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  17. Added to KEVDec 21, 2023
    CVE-2023-475658.8 HIGH⚡ Known ExploitedQNAP VioStor NVR
    QNAP VioStor NVR OS Command Injection VulnerabilityQNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    8.0HIGH3.1CNACVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  18. Added to KEVDec 11, 2023
    CVE-2023-64489.8 CRITICAL⚡ Known ExploitedUnitronics Vision PLC and HMI
    Unitronics Vision PLC and HMI Insecure Default Password VulnerabilityUnitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  19. Added to KEVDec 7, 2023
    CVE-2023-412668.2 HIGH⚡ Known ExploitedQlik Sense
    Qlik Sense Path Traversal VulnerabilityQlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.
    ScoreSeverityVersionVector String
    8.2HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    6.5MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  20. Added to KEVDec 7, 2023
    CVE-2023-412659.9 CRITICAL⚡ Known ExploitedQlik Sense
    Qlik Sense HTTP Tunneling VulnerabilityQlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
    ScoreSeverityVersionVector String
    9.9CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    9.6CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
  21. Added to KEVDec 5, 2023
    CVE-2023-331078.4 HIGH⚡ Known ExploitedQualcomm Multiple Chipsets
    Qualcomm Multiple Chipsets Integer Overflow VulnerabilityMultiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
    ScoreSeverityVersionVector String
    8.4HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  22. Added to KEVDec 5, 2023
    CVE-2023-331068.4 HIGH⚡ Known ExploitedQualcomm Multiple Chipsets
    Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset VulnerabilityMultiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
    ScoreSeverityVersionVector String
    8.4HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  23. Added to KEVDec 5, 2023
    CVE-2023-330637.8 HIGH⚡ Known ExploitedQualcomm Multiple Chipsets
    Qualcomm Multiple Chipsets Use-After-Free VulnerabilityMultiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  24. Added to KEVDec 5, 2023
    CVE-2022-220718.4 HIGH⚡ Known ExploitedQualcomm Multiple Chipsets
    Qualcomm Multiple Chipsets Use-After-Free VulnerabilityMultiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.
    ScoreSeverityVersionVector String
    8.4HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  25. Added to KEVDec 4, 2023
    CVE-2023-429178.8 HIGH⚡ Known ExploitedApple Multiple Products
    Apple Multiple Products WebKit Memory Corruption VulnerabilityApple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 13:35 UTC.

CVE Database: Latest Vulnerabilities | Secure.com