BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 12:12 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 49 of 71

  1. Added to KEVMar 25, 2022
    CVE-2022-219997.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Print Spooler Privilege Escalation VulnerabilityMicrosoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    4.6MEDIUM2.0NVDAV:L/AC:L/Au:N/C:P/I:P/A:P
  2. Added to KEVMar 25, 2022
    CVE-2021-422379.8 CRITICAL⚡ Known ExploitedSitecore XP
    Sitecore XP Remote Command Execution VulnerabilitySitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  3. Added to KEVMar 25, 2022
    CVE-2021-229419.8 CRITICAL⚡ Known ExploitedCitrix ShareFile
    Citrix ShareFile Improper Access Control VulnerabilityImproper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  4. Added to KEVMar 25, 2022
    CVE-2020-252239.8 CRITICAL⚡ Known ExploitedSophos SG UTM
    Sophos SG UTM Remote Code Execution VulnerabilityA remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  5. Added to KEVMar 25, 2022
    CVE-2020-93778.8 HIGH⚡ Known ExploitedD-Link DIR-610 Devices
    D-Link DIR-610 Devices Remote Command ExecutionD-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  6. Added to KEVMar 25, 2022
    CVE-2020-90549.8 CRITICAL⚡ Known ExploitedZyxel Multiple Network-Attached Storage (NAS) Devices
    Zyxel Multiple NAS Devices OS Command Injection VulnerabilityMultiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  7. Added to KEVMar 25, 2022
    CVE-2020-72479.8 CRITICAL⚡ Known ExploitedOpenBSD OpenSMTPD
    OpenSMTPD Remote Code Execution Vulnerabilitysmtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  8. Added to KEVMar 25, 2022
    CVE-2020-54107.5 HIGH⚡ Known ExploitedVMware Tanzu Spring Cloud Configuration (Config) Server
    VMware Tanzu Spring Cloud Config Directory Traversal VulnerabilitySpring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:N/A:N
  9. Added to KEVMar 25, 2022
    CVE-2020-25069.8 CRITICAL⚡ Known ExploitedQNAP Systems Helpdesk
    QNAP Helpdesk Improper Access Control VulnerabilityQNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.3HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  10. Added to KEVMar 25, 2022
    CVE-2020-202110.0 CRITICAL⚡ Known ExploitedPalo Alto Networks PAN-OS
    Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityPalo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  11. Added to KEVMar 25, 2022
    CVE-2020-19568.8 HIGH⚡ Known ExploitedApache Kylin
    Apache Kylin OS Command Injection VulnerabilityApache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  12. Added to KEVMar 25, 2022
    CVE-2020-16319.8 CRITICAL⚡ Known ExploitedJuniper Junos OS
    Juniper Junos OS Path Traversal VulnerabilityA path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  13. Added to KEVMar 25, 2022
    CVE-2019-10030309.9 CRITICAL⚡ Known ExploitedJenkins Matrix Project Plugin
    Jenkins Matrix Project Plugin Remote Code Execution VulnerabilityJenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.
    ScoreSeverityVersionVector String
    9.9CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  14. Added to KEVMar 25, 2022
    CVE-2019-169209.8 CRITICAL⚡ Known ExploitedD-Link Multiple Routers
    D-Link Multiple Routers Command Injection VulnerabilityMultiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  15. Added to KEVMar 25, 2022
    CVE-2019-151079.8 CRITICAL⚡ Known ExploitedWebmin Webmin
    Webmin Command Injection VulnerabilityAn issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  16. Added to KEVMar 25, 2022
    CVE-2019-129918.8 HIGH⚡ Known ExploitedCitrix SD-WAN and NetScaler
    Citrix SD-WAN and NetScaler Command Injection VulnerabilityAuthenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  17. Added to KEVMar 25, 2022
    CVE-2019-129899.8 CRITICAL⚡ Known ExploitedCitrix SD-WAN and NetScaler
    Citrix SD-WAN and NetScaler SQL Injection VulnerabilityCitrix SD-WAN and NetScaler SD-WAN allow SQL Injection.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  18. Added to KEVMar 25, 2022
    CVE-2019-110439.8 CRITICAL⚡ Known ExploitedPHP FastCGI Process Manager (FPM)
    PHP FastCGI Process Manager (FPM) Buffer Overflow VulnerabilityIn some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.7HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  19. Added to KEVMar 25, 2022
    CVE-2019-100689.8 CRITICAL⚡ Known ExploitedKentico Xperience
    Kentico Xperience Deserialization of Untrusted Data VulnerabilityKentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  20. Added to KEVMar 25, 2022
    CVE-2019-63408.1 HIGH⚡ Known ExploitedDrupal Core
    Drupal Core Remote Code Execution VulnerabilityIn Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
    ScoreSeverityVersionVector String
    8.1HIGH3.1NVDCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  21. Added to KEVMar 25, 2022
    CVE-2019-26167.2 HIGH⚡ Known ExploitedOracle BI Publisher (Formerly XML Publisher)
    Oracle BI Publisher Unauthorized Access VulnerabilityOracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.
    ScoreSeverityVersionVector String
    7.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    6.4MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:N
  22. Added to KEVMar 25, 2022
    CVE-2019-09038.8 HIGH⚡ Known ExploitedMicrosoft Graphics Device Interface (GDI)
    Microsoft GDI Remote Code Execution VulnerabilityA remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  23. Added to KEVMar 25, 2022
    CVE-2018-148399.8 CRITICAL⚡ Known ExploitedLG N1A1 NAS
    LG N1A1 NAS Remote Command Execution VulnerabilityLG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  24. Added to KEVMar 25, 2022
    CVE-2018-111389.8 CRITICAL⚡ Known ExploitedQuest KACE System Management Appliance
    Quest KACE System Management Appliance Remote Command Execution VulnerabilityThe '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  25. Added to KEVMar 25, 2022
    CVE-2018-84148.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Shell Remote Code Execution VulnerabilityA remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 12:59 UTC.

CVE Database: Latest Vulnerabilities | Secure.com