BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 14:43 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 36 of 71

  1. Added to KEVMar 14, 2023
    CVE-2023-248804.4 MEDIUM⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
    ScoreSeverityVersionVector String
    4.4MEDIUM3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
  2. Added to KEVMar 14, 2023
    CVE-2023-233979.8 CRITICAL⚡ Known ExploitedMicrosoft Office
    Microsoft Office Outlook Privilege Escalation VulnerabilityMicrosoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  3. Added to KEVMar 14, 2023
    CVE-2022-413287.1 HIGH⚡ Known ExploitedFortinet FortiOS
    Fortinet FortiOS Path Traversal VulnerabilityFortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
    ScoreSeverityVersionVector String
    7.1HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
    6.7MEDIUM3.1CNACVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  4. Added to KEVMar 10, 2023
    CVE-2021-391448.5 HIGH⚡ Known ExploitedXStream XStream
    XStream Remote Code Execution VulnerabilityXStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.
    ScoreSeverityVersionVector String
    8.5HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    6.0MEDIUM2.0NVDAV:N/AC:M/Au:S/C:P/I:P/A:P
  5. Added to KEVMar 10, 2023
    CVE-2020-57417.2 HIGH⚡ Known ExploitedPlex Media Server
    Plex Media Server Remote Code Execution VulnerabilityPlex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.
    ScoreSeverityVersionVector String
    7.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  6. Added to KEVMar 7, 2023
    CVE-2022-359149.8 CRITICAL⚡ Known ExploitedTeclib GLPI
    Teclib GLPI Remote Code Execution VulnerabilityTeclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7. Added to KEVMar 7, 2023
    CVE-2022-338918.8 HIGH⚡ Known ExploitedApache Spark
    Apache Spark Command Injection VulnerabilityApache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  8. Added to KEVMar 7, 2023
    CVE-2022-288106.8 MEDIUM⚡ Known ExploitedZoho ManageEngine
    Zoho ManageEngine ADSelfService Plus Remote Code Execution VulnerabilityZoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
    ScoreSeverityVersionVector String
    6.8MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
    7.1HIGH2.0NVDAV:N/AC:H/Au:S/C:C/I:C/A:C
  9. Added to KEVFeb 27, 2023
    CVE-2022-365377.5 HIGH⚡ Known ExploitedZK Framework AuUploader
    ZK Framework AuUploader Unspecified VulnerabilityZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  10. Added to KEVFeb 21, 2023
    CVE-2022-479869.8 CRITICAL⚡ Known ExploitedIBM Aspera Faspex
    IBM Aspera Faspex Code Execution VulnerabilityIBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  11. Added to KEVFeb 21, 2023
    CVE-2022-412236.8 MEDIUM⚡ Known ExploitedMitel MiVoice Connect
    Mitel MiVoice Connect Code Injection VulnerabilityThe Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
    ScoreSeverityVersionVector String
    6.8MEDIUM3.1NVDCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  12. Added to KEVFeb 21, 2023
    CVE-2022-407656.8 MEDIUM⚡ Known ExploitedMitel MiVoice Connect
    Mitel MiVoice Connect Command Injection VulnerabilityThe Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
    ScoreSeverityVersionVector String
    6.8MEDIUM3.1NVDCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  13. Added to KEVFeb 16, 2023
    CVE-2022-461699.8 CRITICAL⚡ Known ExploitedCacti Cacti
    Cacti Command Injection VulnerabilityCacti contains a command injection vulnerability that allows an unauthenticated user to execute code.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  14. Added to KEVFeb 14, 2023
    CVE-2023-235298.8 HIGH⚡ Known ExploitedApple Multiple Products
    Apple Multiple Products WebKit Type Confusion VulnerabilityApple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  15. Added to KEVFeb 14, 2023
    CVE-2023-233767.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityMicrosoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  16. Added to KEVFeb 14, 2023
    CVE-2023-218237.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Graphic Component Privilege Escalation VulnerabilityMicrosoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  17. Added to KEVFeb 14, 2023
    CVE-2023-217157.3 HIGH⚡ Known ExploitedMicrosoft Office
    Microsoft Office Publisher Security Feature Bypass VulnerabilityMicrosoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
    ScoreSeverityVersionVector String
    7.3HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  18. Added to KEVFeb 10, 2023
    CVE-2023-06697.2 HIGH⚡ Known ExploitedFortra GoAnywhere MFT
    Fortra GoAnywhere MFT Remote Code Execution VulnerabilityFortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
    ScoreSeverityVersionVector String
    7.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  19. Added to KEVFeb 10, 2023
    CVE-2022-249909.8 CRITICAL⚡ Known ExploitedTerraMaster TerraMaster OS
    TerraMaster OS Remote Command Execution VulnerabilityTerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  20. Added to KEVFeb 10, 2023
    CVE-2015-22917.8 HIGH⚡ Known ExploitedIntel Ethernet Diagnostics Driver for Windows
    Intel Ethernet Diagnostics Driver for Windows Denial-of-Service VulnerabilityIntel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  21. Added to KEVFeb 2, 2023
    CVE-2023-229528.8 HIGH⚡ Known ExploitedSugarCRM Multiple Products
    Multiple SugarCRM Products Remote Code Execution VulnerabilityMultiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  22. Added to KEVFeb 2, 2023
    CVE-2022-215879.8 CRITICAL⚡ Known ExploitedOracle E-Business Suite
    Oracle E-Business Suite Unspecified VulnerabilityOracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  23. Added to KEVJan 26, 2023
    CVE-2017-113579.8 CRITICAL⚡ Known ExploitedTelerik User Interface (UI) for ASP.NET AJAX
    Telerik UI for ASP.NET AJAX Insecure Direct Object Reference VulnerabilityTelerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  24. Added to KEVJan 23, 2023
    CVE-2022-479669.8 CRITICAL⚡ Known ExploitedZoho ManageEngine
    Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityMultiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  25. Added to KEVJan 17, 2023
    CVE-2022-448779.8 CRITICAL⚡ Known ExploitedCWP Control Web Panel
    CWP Control Web Panel OS Command Injection VulnerabilityCWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 14:59 UTC.

CVE Database: Latest Vulnerabilities | Secure.com