BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 14:43 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 37 of 71

  1. Added to KEVJan 10, 2023
    CVE-2023-216748.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation VulnerabilityMicrosoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  2. Added to KEVJan 10, 2023
    CVE-2022-410809.8 CRITICAL⚡ Known ExploitedMicrosoft Exchange Server
    Microsoft Exchange Server Privilege Escalation VulnerabilityMicrosoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  3. Added to KEVDec 29, 2022
    CVE-2018-188096.5 MEDIUM⚡ Known ExploitedTIBCO JasperReports
    TIBCO JasperReports Library Directory Traversal VulnerabilityTIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
    ScoreSeverityVersionVector String
    6.5MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    9.9CRITICAL3.0CNACVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    4.0MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:N/A:N
  4. Added to KEVDec 29, 2022
    CVE-2018-54308.8 HIGH⚡ Known ExploitedTIBCO JasperReports
    TIBCO JasperReports Server Information Disclosure VulnerabilityTIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.7HIGH3.0CNACVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    4.0MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:N/A:N
  5. Added to KEVDec 14, 2022
    CVE-2022-428568.8 HIGH⚡ Known ExploitedApple iOS
    Apple iOS Type Confusion VulnerabilityApple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  6. Added to KEVDec 13, 2022
    CVE-2022-446985.4 MEDIUM⚡ Known ExploitedMicrosoft Defender
    Microsoft Defender SmartScreen Security Feature Bypass VulnerabilityMicrosoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
    ScoreSeverityVersionVector String
    5.4MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
  7. Added to KEVDec 13, 2022
    CVE-2022-424759.8 CRITICAL⚡ Known ExploitedFortinet FortiOS
    Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityMultiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  8. Added to KEVDec 13, 2022
    CVE-2022-275189.8 CRITICAL⚡ Known ExploitedCitrix Application Delivery Controller (ADC) and Gateway
    Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass VulnerabilityCitrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  9. Added to KEVDec 13, 2022
    CVE-2022-265019.8 CRITICAL⚡ Known ExploitedVeeam Backup & Replication
    Veeam Backup & Replication Remote Code Execution VulnerabilityThe Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  10. Added to KEVDec 13, 2022
    CVE-2022-265008.8 HIGH⚡ Known ExploitedVeeam Backup & Replication
    Veeam Backup & Replication Remote Code Execution VulnerabilityThe Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  11. Added to KEVDec 5, 2022
    CVE-2022-42628.8 HIGH⚡ Known ExploitedGoogle Chromium V8
    Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  12. Added to KEVNov 28, 2022
    CVE-2022-41359.6 CRITICAL⚡ Known ExploitedGoogle Chromium GPU
    Google Chromium GPU Heap Buffer Overflow VulnerabilityGoogle Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
    ScoreSeverityVersionVector String
    9.6CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
  13. Added to KEVNov 28, 2022
    CVE-2021-355879.8 CRITICAL⚡ Known ExploitedOracle Fusion Middleware
    Oracle Fusion Middleware Unspecified VulnerabilityOracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  14. Added to KEVNov 14, 2022
    CVE-2022-410495.4 MEDIUM⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityMicrosoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
    ScoreSeverityVersionVector String
    5.4MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
  15. Added to KEVNov 8, 2022
    CVE-2022-411288.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Scripting Languages Remote Code Execution VulnerabilityMicrosoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  16. Added to KEVNov 8, 2022
    CVE-2022-411257.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows CNG Key Isolation Service Privilege Escalation VulnerabilityMicrosoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  17. Added to KEVNov 8, 2022
    CVE-2022-410915.4 MEDIUM⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityMicrosoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
    ScoreSeverityVersionVector String
    5.4MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
  18. Added to KEVNov 8, 2022
    CVE-2022-410737.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Print Spooler Privilege Escalation VulnerabilityMicrosoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  19. Added to KEVNov 8, 2022
    CVE-2021-253706.1 MEDIUM⚡ Known ExploitedSamsung Mobile Devices
    Samsung Mobile Devices Memory Corruption VulnerabilitySamsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.
    ScoreSeverityVersionVector String
    6.1MEDIUM3.1CNACVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
    4.4MEDIUM3.1NVDCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
    4.9MEDIUM2.0NVDAV:L/AC:L/Au:N/C:N/I:N/A:C
  20. Added to KEVNov 8, 2022
    CVE-2021-253696.2 MEDIUM⚡ Known ExploitedSamsung Mobile Devices
    Samsung Mobile Devices Improper Access Control VulnerabilitySamsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.
    ScoreSeverityVersionVector String
    6.2MEDIUM3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    5.5MEDIUM3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    2.1LOW2.0NVDAV:L/AC:L/Au:N/C:P/I:N/A:N
  21. Added to KEVNov 8, 2022
    CVE-2021-253377.1 HIGH⚡ Known ExploitedSamsung Mobile Devices
    Samsung Mobile Devices Improper Access Control VulnerabilitySamsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.
    ScoreSeverityVersionVector String
    7.1HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
    4.4MEDIUM3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    5.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:N
  22. Added to KEVOct 28, 2022
    CVE-2022-37238.8 HIGH⚡ Known ExploitedGoogle Chromium V8
    Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  23. Added to KEVOct 25, 2022
    CVE-2022-428277.8 HIGH⚡ Known ExploitedApple iOS and iPadOS
    Apple iOS and iPadOS Out-of-Bounds Write VulnerabilityApple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  24. Added to KEVOct 24, 2022
    CVE-2020-34337.8 HIGH⚡ Known ExploitedCisco AnyConnect Secure
    Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking VulnerabilityCisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  25. Added to KEVOct 24, 2022
    CVE-2020-31536.5 MEDIUM⚡ Known ExploitedCisco AnyConnect Secure
    Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path VulnerabilityCisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.
    ScoreSeverityVersionVector String
    6.5MEDIUM3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
    6.5MEDIUM3.0CNACVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
    4.9MEDIUM2.0NVDAV:L/AC:L/Au:N/C:N/I:C/A:N

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 15:05 UTC.

CVE Database: Latest Vulnerabilities | Secure.com