BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 10:41 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 59 of 71

  1. Added to KEVJan 10, 2022
    CVE-2019-15798.1 HIGH⚡ Known ExploitedPalo Alto Networks PAN-OS
    Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityRemote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
    ScoreSeverityVersionVector String
    8.1HIGH3.1NVDCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  2. Added to KEVJan 10, 2022
    CVE-2019-14587.8 HIGH⚡ Known ExploitedMicrosoft Win32k
    Microsoft Win32k Privilege Escalation VulnerabilityA privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  3. Added to KEVJan 10, 2022
    CVE-2018-133836.5 MEDIUM⚡ Known ExploitedFortinet FortiOS and FortiProxy
    Fortinet FortiOS and FortiProxy Out-of-bounds WriteA heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
    ScoreSeverityVersionVector String
    6.5MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
    4.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
    4.3MEDIUM2.0NVDAV:N/AC:M/Au:N/C:N/I:N/A:P
  4. Added to KEVJan 10, 2022
    CVE-2018-133829.1 CRITICAL⚡ Known ExploitedFortinet FortiOS and FortiProxy
    Fortinet FortiOS and FortiProxy Improper AuthorizationAn Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
    ScoreSeverityVersionVector String
    9.1CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:N/I:P/A:N
  5. Added to KEVJan 10, 2022
    CVE-2017-10004869.8 CRITICAL⚡ Known ExploitedPrimetek Primefaces Application
    Primetek Primefaces Remote Code Execution VulnerabilityPrimetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  6. Added to KEVJan 10, 2022
    CVE-2015-74509.8 CRITICAL⚡ Known ExploitedIBM WebSphere Application Server and Server Hypervisor Edition
    IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  7. Added to KEVJan 10, 2022
    CVE-2013-39008.8 HIGH⚡ Known ExploitedMicrosoft WinVerifyTrust function
    Microsoft WinVerifyTrust function Remote Code ExecutionA remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    5.5MEDIUM3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
    7.6HIGH2.0NVDAV:N/AC:H/Au:N/C:C/I:C/A:C
  8. Added to KEVDec 15, 2021
    CVE-2021-438907.1 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows AppX Installer Spoofing VulnerabilityMicrosoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.
    ScoreSeverityVersionVector String
    7.1HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
    6.0MEDIUM2.0NVDAV:N/AC:M/Au:S/C:P/I:P/A:P
  9. Added to KEVDec 15, 2021
    CVE-2021-41028.8 HIGH⚡ Known ExploitedGoogle Chromium V8
    Google Chromium V8 Use-After-Free VulnerabilityGoogle Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  10. Added to KEVDec 10, 2021
    CVE-2021-445159.8 CRITICAL⚡ Known ExploitedZoho Desktop Central
    Zoho Desktop Central Authentication Bypass VulnerabilityZoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  11. Added to KEVDec 10, 2021
    CVE-2021-4422810.0 CRITICAL⚡ Known ExploitedApache Log4j2
    Apache Log4j2 Remote Code Execution VulnerabilityApache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  12. Added to KEVDec 10, 2021
    CVE-2021-441687.8 HIGH⚡ Known ExploitedFortinet FortiOS
    Fortinet FortiOS Arbitrary File DownloadFortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    3.3LOW3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    4.6MEDIUM2.0NVDAV:L/AC:L/Au:N/C:P/I:P/A:P
  13. Added to KEVDec 10, 2021
    CVE-2021-353949.8 CRITICAL⚡ Known ExploitedRealtek Jungle Software Development Kit (SDK)
    Realtek Jungle SDK Remote Code Execution VulnerabilityRealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  14. Added to KEVDec 10, 2021
    CVE-2020-174639.8 CRITICAL⚡ Known ExploitedFuel CMS Fuel CMS
    Fuel CMS SQL Injection VulnerabilityFUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  15. Added to KEVDec 10, 2021
    CVE-2020-88167.2 HIGH⚡ Known ExploitedPi-hole AdminLTE
    Pi-Hole AdminLTE Remote Code Execution VulnerabilityPi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
    ScoreSeverityVersionVector String
    7.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    9.1CRITICAL3.0CNACVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  16. Added to KEVDec 10, 2021
    CVE-2019-132727.8 HIGH⚡ Known ExploitedLinux Kernel
    Linux Kernel Improper Privilege Management VulnerabilityKernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  17. Added to KEVDec 10, 2021
    CVE-2019-107589.9 CRITICAL⚡ Known ExploitedMongoDB mongo-express
    MongoDB mongo-express Remote Code Execution Vulnerabilitymongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.
    ScoreSeverityVersionVector String
    9.9CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  18. Added to KEVDec 10, 2021
    CVE-2019-72389.8 CRITICAL⚡ Known ExploitedSonatype Nexus Repository Manager
    Sonatype Nexus Repository Manager Incorrect Access Control VulnerabilitySonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  19. Added to KEVDec 10, 2021
    CVE-2019-01937.2 HIGH⚡ Known ExploitedApache Solr
    Apache Solr DataImportHandler Code Injection VulnerabilityThe optional Apache Solr module DataImportHandler contains a code injection vulnerability.
    ScoreSeverityVersionVector String
    7.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  20. Added to KEVDec 10, 2021
    CVE-2017-175628.1 HIGH⚡ Known ExploitedEmbedthis GoAhead
    Embedthis GoAhead Remote Code Execution VulnerabilityEmbedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
    ScoreSeverityVersionVector String
    8.1HIGH3.1NVDCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  21. Added to KEVDec 10, 2021
    CVE-2017-121499.8 CRITICAL⚡ Known ExploitedRed Hat JBoss Application Server
    Red Hat JBoss Application Server Remote Code Execution VulnerabilityThe JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  22. Added to KEVDec 10, 2021
    CVE-2010-18718.8 HIGH⚡ Known ExploitedRed Hat JBoss Seam 2
    Red Hat Linux JBoss Seam 2 Remote Code Execution VulnerabilityJBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  23. Added to KEVDec 1, 2021
    CVE-2021-440779.8 CRITICAL⚡ Known ExploitedZoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
    Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityZoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  24. Added to KEVDec 1, 2021
    CVE-2021-404389.0 CRITICAL⚡ Known ExploitedApache Apache
    Apache HTTP Server-Side Request Forgery (SSRF)A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
    ScoreSeverityVersionVector String
    9.0CRITICAL3.1NVDCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  25. Added to KEVDec 1, 2021
    CVE-2021-374159.8 CRITICAL⚡ Known ExploitedZoho ManageEngine ServiceDesk Plus (SDP)
    Zoho ManageEngine ServiceDesk Authentication Bypass VulnerabilityZoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 11:18 UTC.

CVE Database: Latest Vulnerabilities | Secure.com