BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 08:12 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 6 of 71

  1. Added to KEVJul 15, 2026
    CVE-2023-43467.5 HIGH⚡ Known ExploitedKNX Association KNX Protocol Connection Authorization Option 1
    KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism VulnerabilityKNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  2. Added to KEVJul 14, 2026
    CVE-2026-561649.8 CRITICAL⚡ Known ExploitedMicrosoft SharePoint Server
    Microsoft SharePoint Server Missing Authentication for Critical Function VulnerabilityMicrosoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    5.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  3. Added to KEVJul 14, 2026
    CVE-2026-561557.8 HIGH⚡ Known ExploitedMicrosoft Active Directory Federation Services
    Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  4. Added to KEVJul 14, 2026
    CVE-2026-154107.2 HIGH⚡ Known ExploitedSonicWall SMA1000 Appliances
    SonicWall SMA1000 Appliances Code Injection VulnerabilitySonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
    ScoreSeverityVersionVector String
    7.2HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  5. Added to KEVJul 14, 2026
    CVE-2026-1540910.0 CRITICAL⚡ Known ExploitedSonicWall SMA1000 Appliances
    SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilitySonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  6. Added to KEVJul 13, 2026
    CVE-2008-41288.1 HIGH⚡ Known ExploitedCisco IOS
    Cisco IOS Cross-Site Request Forgery VulnerabilityCisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.
    ScoreSeverityVersionVector String
    8.1HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  7. Added to KEVJul 10, 2026
    CVE-2026-5629110.0 CRITICAL⚡ Known ExploitedBalbooa Forms
    Balbooa Forms Unrestricted Upload of File with Dangerous Type VulnerabilityBalbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.
    ScoreSeverityVersionVector String
    10.0CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  8. Added to KEVJul 10, 2026
    CVE-2026-4893910.0 CRITICAL⚡ Known ExploitediCagenda iCagenda
    iCagenda Unrestricted Upload of File with Dangerous Type VulnerabilityiCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
    ScoreSeverityVersionVector String
    10.0CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  9. Added to KEVJul 7, 2026
    CVE-2026-5629010.0 CRITICAL⚡ Known ExploitedJoomlack Page Builder
    Joomlack Page Builder Improper Access Control VulnerabilityJoomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.
    ScoreSeverityVersionVector String
    10.0CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  10. Added to KEVJul 7, 2026
    CVE-2026-552558.4 HIGH⚡ Known ExploitedLangflow Langflow
    Langflow Authorization Bypass Through User-Controlled Key VulnerabilityLangflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
    ScoreSeverityVersionVector String
    8.4HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
  11. Added to KEVJul 7, 2026
    CVE-2026-4890810.0 CRITICAL⚡ Known ExploitedJoomShaper SP Page Builder
    JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type VulnerabilityJoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
    ScoreSeverityVersionVector String
    10.0CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  12. Added to KEVJul 7, 2026
    CVE-2026-4828210.0 CRITICAL⚡ Known ExploitedAdobe ColdFusion
    Adobe ColdFusion Path Traversal VulnerabilityAdobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  13. Added to KEVJul 1, 2026
    CVE-2026-456598.8 HIGH⚡ Known ExploitedMicrosoft SharePoint Server
    Microsoft SharePoint Server Deserialization of Untrusted Data VulnerabilityMicrosoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  14. Added to KEVJun 29, 2026
    CVE-2026-485589.5 CRITICAL⚡ Known ExploitedSimpleHelp SimpleHelp
    SimpleHelp Authentication Bypass VulnerabilitySimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.
    ScoreSeverityVersionVector String
    9.5CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  15. Added to KEVJun 25, 2026
    CVE-2026-202308.6 HIGH⚡ Known ExploitedCisco Unified Communications Manager
    Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) VulnerabilityCisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.
    ScoreSeverityVersionVector String
    8.6HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
  16. Added to KEVJun 25, 2026
    CVE-2026-125699.3 CRITICAL⚡ Known ExploitedPTC Windchill and FlexPLM
    PTC Windchill and FlexPLM Improper Input Validation VulnerabilityPTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.
    ScoreSeverityVersionVector String
    9.3CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/U:Red
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  17. Added to KEVJun 23, 2026
    CVE-2026-3491010.0 CRITICAL⚡ Known ExploitedUbiquiti UniFi OS
    Ubiquiti UniFi OS Improper Input Validation VulnerabilityUbiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  18. Added to KEVJun 23, 2026
    CVE-2026-3490910.0 CRITICAL⚡ Known ExploitedUbiquiti UniFi OS
    Ubiquiti UniFi OS Path Traversal VulnerabilityUbiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  19. Added to KEVJun 23, 2026
    CVE-2026-3490810.0 CRITICAL⚡ Known ExploitedUbiquiti UniFi OS
    Ubiquiti UniFi OS Improper Access Control VulnerabilityUbiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  20. Added to KEVJun 23, 2026
    CVE-2025-670389.3 CRITICAL⚡ Known ExploitedLantronix EDS5000
    Lantronix EDS5000 Code Injection VulnerabilityLantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
    ScoreSeverityVersionVector String
    9.3CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  21. Added to KEVJun 18, 2026
    CVE-2026-202539.8 CRITICAL⚡ Known ExploitedSplunk Enterprise
    Splunk Enterprise Missing Authentication for Critical Function VulnerabilitySplunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  22. Added to KEVJun 16, 2026
    CVE-2026-4890710.0 CRITICAL⚡ Known ExploitedWidget Factory Joomla Content Editor
    Widget Factory Joomla Content Editor Improper Access Control VulnerabilityWidget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.
    ScoreSeverityVersionVector String
    10.0CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  23. Added to KEVJun 15, 2026
    CVE-2026-544208.5 HIGH⚡ Known ExploitedLiteSpeed cPanel Plugin
    LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following VulnerabilityLiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.
    ScoreSeverityVersionVector String
    8.5HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
  24. Added to KEVJun 15, 2026
    CVE-2026-202626.5 MEDIUM⚡ Known ExploitedCisco Catalyst SD-WAN Manager
    Cisco Catalyst SD-WAN Manager Directory or Path Traversal VulnerabilityCisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.
    ScoreSeverityVersionVector String
    6.5MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
  25. Added to KEVJun 12, 2026
    CVE-2026-352739.8 CRITICAL⚡ Known ExploitedOracle PeopleSoft Enterprise PeopleTools
    Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function VulnerabilityOracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:25 UTC.

CVE Database: Latest Vulnerabilities | Secure.com