BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 08:46 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 65 of 71

  1. Added to KEVNov 3, 2021
    CVE-2020-170877.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Kernel Privilege Escalation VulnerabilityMicrosoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  2. Added to KEVNov 3, 2021
    CVE-2020-168469.8 CRITICAL⚡ Known ExploitedSaltStack Salt
    SaltStack Salt Shell Injection VulnerabilitySaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  3. Added to KEVNov 3, 2021
    CVE-2020-160179.6 CRITICAL⚡ Known ExploitedGoogle Chrome
    Google Chrome Use-After-Free VulnerabilityGoogle Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
    ScoreSeverityVersionVector String
    9.6CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  4. Added to KEVNov 3, 2021
    CVE-2020-160138.8 HIGH⚡ Known ExploitedGoogle Chromium V8
    Google Chromium V8 Incorrect Implementation VulnerabililtyGoogle Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  5. Added to KEVNov 3, 2021
    CVE-2020-160109.6 CRITICAL⚡ Known ExploitedGoogle Chrome for Android UI
    Google Chrome for Android UI Heap Buffer Overflow VulnerabilityGoogle Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
    ScoreSeverityVersionVector String
    9.6CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  6. Added to KEVNov 3, 2021
    CVE-2020-160098.8 HIGH⚡ Known ExploitedGoogle Chromium V8
    Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  7. Added to KEVNov 3, 2021
    CVE-2020-159999.6 CRITICAL⚡ Known ExploitedGoogle Chrome FreeType
    Google Chrome FreeType Heap Buffer Overflow VulnerabilityGoogle Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.
    ScoreSeverityVersionVector String
    9.6CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    4.3MEDIUM2.0NVDAV:N/AC:M/Au:N/C:N/I:N/A:P
  8. Added to KEVNov 3, 2021
    CVE-2020-155059.8 CRITICAL⚡ Known ExploitedIvanti MobileIron Multiple Products
    Ivanti MobileIron Multiple Products Remote Code Execution VulnerabilityIvanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  9. Added to KEVNov 3, 2021
    CVE-2020-148837.2 HIGH⚡ Known ExploitedOracle WebLogic Server
    Oracle WebLogic Server Unspecified VulnerabilityOracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
    ScoreSeverityVersionVector String
    7.2HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  10. Added to KEVNov 3, 2021
    CVE-2020-148829.8 CRITICAL⚡ Known ExploitedOracle WebLogic Server
    Oracle WebLogic Server Remote Code Execution VulnerabilityOracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  11. Added to KEVNov 3, 2021
    CVE-2020-1487110.0 CRITICAL⚡ Known ExploitedOracle Solaris and Zettabyte File System (ZFS)
    Oracle Solaris and Zettabyte File System (ZFS) Unspecified VulnerabilityOracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  12. Added to KEVNov 3, 2021
    CVE-2020-147509.8 CRITICAL⚡ Known ExploitedOracle WebLogic Server
    Oracle WebLogic Server Remote Code Execution VulnerabilityOracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  13. Added to KEVNov 3, 2021
    CVE-2020-128129.8 CRITICAL⚡ Known ExploitedFortinet FortiOS
    Fortinet FortiOS SSL VPN Improper Authentication VulnerabilityFortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  14. Added to KEVNov 3, 2021
    CVE-2020-122719.8 CRITICAL⚡ Known ExploitedSophos SFOS
    Sophos SFOS SQL Injection VulnerabilitySophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0CRITICAL3.0CNACVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  15. Added to KEVNov 3, 2021
    CVE-2020-117387.5 HIGH⚡ Known ExploitedWordPress Snap Creek Duplicator Plugin
    WordPress Snap Creek Duplicator Plugin File Download VulnerabilityWordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    7.5HIGH3.0CNACVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:N/A:N
  16. Added to KEVNov 3, 2021
    CVE-2020-116526.5 MEDIUM⚡ Known ExploitedSaltStack Salt
    SaltStack Salt Path Traversal VulnerabilitySaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
    ScoreSeverityVersionVector String
    6.5MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    4.0MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:N/A:N
  17. Added to KEVNov 3, 2021
    CVE-2020-116519.8 CRITICAL⚡ Known ExploitedSaltStack Salt
    SaltStack Salt Authentication Bypass VulnerabilitySaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  18. Added to KEVNov 3, 2021
    CVE-2020-109879.8 CRITICAL⚡ Known ExploitedTenda AC1900 Router AC15 Model
    Tenda AC1900 Router AC15 Model Remote Code Execution VulnerabilityTenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  19. Added to KEVNov 3, 2021
    CVE-2020-102218.8 HIGH⚡ Known ExploitedrConfig rConfig
    rConfig OS Command Injection VulnerabilityrConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  20. Added to KEVNov 3, 2021
    CVE-2020-101998.8 HIGH⚡ Known ExploitedSonatype Nexus Repository
    Sonatype Nexus Repository Remote Code Execution VulnerabilitySonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  21. Added to KEVNov 3, 2021
    CVE-2020-101899.8 CRITICAL⚡ Known ExploitedZoho ManageEngine
    Zoho ManageEngine Desktop Central File Upload VulnerabilityZoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.8CRITICAL3.0CNACVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  22. Added to KEVNov 3, 2021
    CVE-2020-101819.8 CRITICAL⚡ Known ExploitedSumavision Enhanced Multimedia Router (EMR)
    Sumavision EMR Cross-Site Request Forgery (CSRF) VulnerabilitySumavision Enhanced Multimedia Router (EMR) contains a cross-site request forgery (CSRF) vulnerability allowing the creation of users with elevated privileges as administrator on a device.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  23. Added to KEVNov 3, 2021
    CVE-2020-101489.8 CRITICAL⚡ Known ExploitedSolarWinds Orion
    SolarWinds Orion Authentication Bypass VulnerabilitySolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  24. Added to KEVNov 3, 2021
    CVE-2020-98597.8 HIGH⚡ Known ExploitedApple Multiple Products
    Apple Multiple Products Code Execution VulnerabilityApple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  25. Added to KEVNov 3, 2021
    CVE-2020-98194.3 MEDIUM⚡ Known ExploitedApple iOS, iPadOS, and watchOS
    Apple iOS, iPadOS, and watchOS Memory Corruption VulnerabilityApple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.
    ScoreSeverityVersionVector String
    4.3MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
    4.3MEDIUM2.0NVDAV:N/AC:M/Au:N/C:N/I:N/A:P

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 09:04 UTC.

CVE Database: Latest Vulnerabilities | Secure.com