BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 07:44 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 67 of 71

  1. Added to KEVNov 3, 2021
    CVE-2020-44279.8 CRITICAL⚡ Known ExploitedIBM Data Risk Manager
    IBM Data Risk Manager Security Bypass VulnerabilityIBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.0CRITICAL3.0CNACVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  2. Added to KEVNov 3, 2021
    CVE-2020-40069.1 CRITICAL⚡ Known ExploitedVMware Multiple Products
    Multiple VMware Products Command Injection VulnerabilityVMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.
    ScoreSeverityVersionVector String
    9.1CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C
  3. Added to KEVNov 3, 2021
    CVE-2020-39929.8 CRITICAL⚡ Known ExploitedVMware ESXi
    VMware ESXi OpenSLP Use-After-Free VulnerabilityVMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  4. Added to KEVNov 3, 2021
    CVE-2020-39529.8 CRITICAL⚡ Known ExploitedVMware vCenter Server
    VMware vCenter Server Information Disclosure VulnerabilityVMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  5. Added to KEVNov 3, 2021
    CVE-2020-39507.8 HIGH⚡ Known ExploitedVMware Multiple Products
    VMware Multiple Products Privilege Escalation VulnerabilityVMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  6. Added to KEVNov 3, 2021
    CVE-2020-35806.1 MEDIUM⚡ Known ExploitedCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
    Cisco ASA and FTD Cross-Site Scripting (XSS) VulnerabilityCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.
    ScoreSeverityVersionVector String
    6.1MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    2.6LOW2.0NVDAV:N/AC:H/Au:N/C:N/I:P/A:N
  7. Added to KEVNov 3, 2021
    CVE-2020-35698.6 HIGH⚡ Known ExploitedCisco IOS XR
    Cisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityCisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.
    ScoreSeverityVersionVector String
    8.6HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:N/I:N/A:P
  8. Added to KEVNov 3, 2021
    CVE-2020-35668.6 HIGH⚡ Known ExploitedCisco IOS XR
    Cisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityCisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.
    ScoreSeverityVersionVector String
    8.6HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
    7.8HIGH2.0NVDAV:N/AC:L/Au:N/C:N/I:N/A:C
  9. Added to KEVNov 3, 2021
    CVE-2020-34527.5 HIGH⚡ Known ExploitedCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
    Cisco ASA and FTD Read-Only Path Traversal VulnerabilityCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:N/A:N
  10. Added to KEVNov 3, 2021
    CVE-2020-31619.8 CRITICAL⚡ Known ExploitedCisco Cisco IP Phones
    Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service VulnerabilityCisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.8CRITICAL3.0CNACVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  11. Added to KEVNov 3, 2021
    CVE-2020-31188.8 HIGH⚡ Known ExploitedCisco IOS XR
    Cisco IOS XR Software Discovery Protocol Format String VulnerabilityCisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.8HIGH3.0CNACVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    8.3HIGH2.0NVDAV:A/AC:L/Au:N/C:C/I:C/A:C
  12. Added to KEVNov 3, 2021
    CVE-2020-25559.8 CRITICAL⚡ Known ExploitedOracle Multiple Products
    Oracle Multiple Products Remote Code Execution VulnerabilityMultiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.8CRITICAL3.0CNACVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  13. Added to KEVNov 3, 2021
    CVE-2020-147210.0 CRITICAL⚡ Known ExploitedMicrosoft Netlogon
    Microsoft Netlogon Privilege Escalation VulnerabilityMicrosoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    5.5MEDIUM3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  14. Added to KEVNov 3, 2021
    CVE-2020-14647.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Spoofing VulnerabilityMicrosoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    5.5MEDIUM3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
    2.1LOW2.0NVDAV:L/AC:L/Au:N/C:N/I:P/A:N
  15. Added to KEVNov 3, 2021
    CVE-2020-13808.8 HIGH⚡ Known ExploitedMicrosoft Internet Explorer
    Microsoft Internet Explorer Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.6HIGH2.0NVDAV:N/AC:H/Au:N/C:C/I:C/A:C
  16. Added to KEVNov 3, 2021
    CVE-2020-135010.0 CRITICAL⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  17. Added to KEVNov 3, 2021
    CVE-2020-11477.8 HIGH⚡ Known ExploitedMicrosoft .NET Framework, SharePoint, Visual Studio
    Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution VulnerabilityMicrosoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  18. Added to KEVNov 3, 2021
    CVE-2020-10547.8 HIGH⚡ Known ExploitedMicrosoft Win32k
    Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.0HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  19. Added to KEVNov 3, 2021
    CVE-2020-10409.0 CRITICAL⚡ Known ExploitedMicrosoft Hyper-V RemoteFX
    Microsoft Hyper-V RemoteFX vGPU Remote Code Execution VulnerabilityMicrosoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system.
    ScoreSeverityVersionVector String
    9.0CRITICAL3.1NVDCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    7.7HIGH2.0NVDAV:A/AC:L/Au:S/C:C/I:C/A:C
  20. Added to KEVNov 3, 2021
    CVE-2020-10208.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Adobe Font Manager Library Remote Code Execution VulnerabilityMicrosoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  21. Added to KEVNov 3, 2021
    CVE-2020-09867.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Kernel Privilege Escalation VulnerabilityMicrosoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    7.2HIGH2.0NVDAV:L/AC:L/Au:N/C:C/I:C/A:C
  22. Added to KEVNov 3, 2021
    CVE-2020-09687.5 HIGH⚡ Known ExploitedMicrosoft Internet Explorer
    Microsoft Internet Explorer Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
    7.6HIGH2.0NVDAV:N/AC:H/Au:N/C:C/I:C/A:C
  23. Added to KEVNov 3, 2021
    CVE-2020-09387.8 HIGH⚡ Known ExploitedMicrosoft Windows
    Microsoft Windows Adobe Font Manager Library Remote Code Execution VulnerabilityMicrosoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  24. Added to KEVNov 3, 2021
    CVE-2020-08787.5 HIGH⚡ Known ExploitedMicrosoft Edge and Internet Explorer
    Microsoft Edge and Internet Explorer Memory Corruption VulnerabilityMicrosoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
    4.2MEDIUM3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
    5.1MEDIUM2.0NVDAV:N/AC:H/Au:N/C:P/I:P/A:P
  25. Added to KEVNov 3, 2021
    CVE-2020-06888.8 HIGH⚡ Known ExploitedMicrosoft Exchange Server
    Microsoft Exchange Server Validation Key Remote Code Execution VulnerabilityMicrosoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    9.0HIGH2.0NVDAV:N/AC:L/Au:S/C:C/I:C/A:C

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:25 UTC.

CVE Database: Latest Vulnerabilities | Secure.com