BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 11:09 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 58 of 71

  1. Added to KEVJan 21, 2022
    CVE-2021-352475.3 MEDIUM⚡ Known ExploitedSolarWinds Serv-U
    SolarWinds Serv-U Improper Input Validation VulnerabilitySolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.
    ScoreSeverityVersionVector String
    5.3MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    4.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:N/I:P/A:N
  2. Added to KEVJan 21, 2022
    CVE-2018-84537.8 HIGH⚡ Known ExploitedMicrosoft Win32k
    Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  3. Added to KEVJan 21, 2022
    CVE-2012-03919.8 CRITICAL⚡ Known ExploitedApache Struts 2
    Apache Struts 2 Improper Input Validation VulnerabilityThe ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  4. Added to KEVJan 21, 2022
    CVE-2006-15477.5 HIGH⚡ Known ExploitedApache Struts 1
    Apache Struts 1 ActionForm Denial-of-Service VulnerabilityActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    7.8HIGH2.0NVDAV:N/AC:L/Au:N/C:N/I:N/A:C
  5. Added to KEVJan 18, 2022
    CVE-2021-408709.8 CRITICAL⚡ Known ExploitedAviatrix Aviatrix Controller
    Aviatrix Controller Unrestricted Upload of FileUnrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  6. Added to KEVJan 18, 2022
    CVE-2021-337667.5 HIGH⚡ Known ExploitedMicrosoft Exchange Server
    Microsoft Exchange Server Information DisclosureMicrosoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    7.3HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:N/A:N
  7. Added to KEVJan 18, 2022
    CVE-2021-326489.1 CRITICAL⚡ Known ExploitedOctober CMS October CMS
    October CMS Improper AuthenticationIn affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
    ScoreSeverityVersionVector String
    9.1CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    8.2HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    6.4MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:N
  8. Added to KEVJan 18, 2022
    CVE-2021-252988.8 HIGH⚡ Known ExploitedNagios Nagios XI
    Nagios XI OS Command InjectionNagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  9. Added to KEVJan 18, 2022
    CVE-2021-252978.8 HIGH⚡ Known ExploitedNagios Nagios XI
    Nagios XI OS Command InjectionNagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  10. Added to KEVJan 18, 2022
    CVE-2021-252968.8 HIGH⚡ Known ExploitedNagios Nagios XI
    Nagios XI OS Command InjectionNagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  11. Added to KEVJan 18, 2022
    CVE-2021-229919.8 CRITICAL⚡ Known ExploitedF5 BIG-IP Traffic Management Microkernel
    F5 BIG-IP Traffic Management Microkernel Buffer OverflowThe Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  12. Added to KEVJan 18, 2022
    CVE-2021-219759.8 CRITICAL⚡ Known ExploitedVMware vRealize Operations Manager API
    VMware Server Side Request Forgery in vRealize Operations Manager APIServer Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:N/A:N
  13. Added to KEVJan 18, 2022
    CVE-2021-213157.8 HIGH⚡ Known ExploitedNpm package System Information Library for Node.JS
    System Information Library for Node.JS Command InjectionIn this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.1HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
    4.6MEDIUM2.0NVDAV:L/AC:L/Au:N/C:P/I:P/A:P
  14. Added to KEVJan 18, 2022
    CVE-2020-148647.5 HIGH⚡ Known ExploitedOracle Intelligence Enterprise Edition
    Oracle Business Intelligence Enterprise Edition Path TransversalPath traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    7.8HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:N/A:N
  15. Added to KEVJan 18, 2022
    CVE-2020-139279.8 CRITICAL⚡ Known ExploitedApache Airflow's Experimental API
    Apache Airflow's Experimental API Authentication BypassThe previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  16. Added to KEVJan 18, 2022
    CVE-2020-136718.8 HIGH⚡ Known ExploitedDrupal Drupal core
    Drupal core Un-restricted Upload of FileImproper sanitization in the extension file names is present in Drupal core.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  17. Added to KEVJan 18, 2022
    CVE-2020-119788.8 HIGH⚡ Known ExploitedApache Airflow
    Apache Airflow Command InjectionA remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  18. Added to KEVJan 10, 2022
    CVE-2021-362609.8 CRITICAL⚡ Known ExploitedHikvision Security cameras web server
    Hikvision Improper Input ValidationA command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  19. Added to KEVJan 10, 2022
    CVE-2021-278609.8 CRITICAL⚡ Known ExploitedFatPipe WARP, IPVPN, and MPVPN software
    FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploitA vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  20. Added to KEVJan 10, 2022
    CVE-2021-220175.3 MEDIUM⚡ Known ExploitedVMware vCenter Server
    VMware vCenter Server Improper Access ControlRhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
    ScoreSeverityVersionVector String
    5.3MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:N/A:N
  21. Added to KEVJan 10, 2022
    CVE-2020-65728.8 HIGH⚡ Known ExploitedGoogle Chrome Media
    Google Chrome Media Use-After-Free VulnerabilityGoogle Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  22. Added to KEVJan 10, 2022
    CVE-2019-101499.8 CRITICAL⚡ Known ExploitedExim Mail Transfer Agent (MTA)
    Exim Mail Transfer Agent (MTA) Improper Input ValidationImproper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.0CRITICAL3.0CNACVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  23. Added to KEVJan 10, 2022
    CVE-2019-96709.8 CRITICAL⚡ Known ExploitedSynacor Zimbra Collaboration Suite (ZCS)
    Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity ReferenceSynacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  24. Added to KEVJan 10, 2022
    CVE-2019-760910.0 CRITICAL⚡ Known ExploitedElastic Kibana
    Kibana Arbitrary Code ExecutionKibana contain an arbitrary code execution flaw in the Timelion visualizer.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    9.8CRITICAL3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  25. Added to KEVJan 10, 2022
    CVE-2019-27259.8 CRITICAL⚡ Known ExploitedOracle WebLogic Server
    Oracle WebLogic Server, InjectionInjection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH3.0CNACVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 11:24 UTC.