BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 07:44 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 7 of 71

  1. Added to KEVJun 11, 2026
    CVE-2026-1052010.0 CRITICAL⚡ Known ExploitedIvanti Sentry
    Ivanti Sentry OS Command Injection VulnerabilityIvanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.
    ScoreSeverityVersionVector String
    10.0CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  2. Added to KEVJun 9, 2026
    CVE-2026-202457.8 HIGH⚡ Known ExploitedCisco Catalyst SD-WAN Manager
    Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output VulnerabilityCisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  3. Added to KEVJun 9, 2026
    CVE-2026-116458.8 HIGH⚡ Known ExploitedGoogle Chromium V8
    Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityGoogle Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  4. Added to KEVJun 9, 2026
    CVE-2026-74736.9 MEDIUM⚡ Known ExploitedArista Extensible Operating System
    Arista Extensible Operating System Incomplete Comparison with Missing Factors VulnerabilityArista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.
    ScoreSeverityVersionVector String
    6.9MEDIUM4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
    5.8MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
  5. Added to KEVJun 8, 2026
    CVE-2026-507519.3 CRITICAL⚡ Known ExploitedCheck Point Security Gateway
    Check Point Security Gateway Improper Authentication VulnerabilityCheck Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
    ScoreSeverityVersionVector String
    9.3CRITICAL3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
  6. Added to KEVJun 8, 2026
    CVE-2026-422718.7 HIGH⚡ Known ExploitedBerriAI LiteLLM
    BerriAI LiteLLM Command Injection VulnerabilityBerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.
    ScoreSeverityVersionVector String
    8.7HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  7. Added to KEVJun 5, 2026
    CVE-2026-283187.5 HIGH⚡ Known ExploitedSolarWinds Serv-U
    SolarWinds Serv-U Uncontrolled Resource Consumption VulnerabilitySolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  8. Added to KEVJun 3, 2026
    CVE-2026-452479.3 CRITICAL⚡ Known ExploitedMirasvit Mirasvit Full Page Cache Warmer
    Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data VulnerabilityMirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.
    ScoreSeverityVersionVector String
    9.3CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  9. Added to KEVJun 2, 2026
    CVE-2025-485958.4 HIGH⚡ Known ExploitedAndroid Framework
    Android Framework Integer Overflow VulnerabilityAndroid Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.
    ScoreSeverityVersionVector String
    8.4HIGH3.1CISA-ADPCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  10. Added to KEVJun 2, 2026
    CVE-2022-04927.8 HIGH⚡ Known ExploitedLinux Kernel
    Linux Kernel Improper Authentication VulnerabilityLinux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    6.9MEDIUM2.0NVDAV:L/AC:M/Au:N/C:C/I:C/A:C
  11. Added to KEVJun 1, 2026
    CVE-2024-211827.5 HIGH⚡ Known ExploitedOracle WebLogic Server
    Oracle WebLogic Server Unspecified VulnerabilityOracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  12. Added to KEVMay 29, 2026
    CVE-2026-02577.8 HIGH⚡ Known ExploitedPalo Alto Networks PAN-OS
    Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityPalo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
    ScoreSeverityVersionVector String
    7.8HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red
    9.1CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  13. Added to KEVMay 27, 2026
    CVE-2026-480279.3 CRITICAL⚡ Known ExploitedNx Nx Console
    Nx Console Embedded Malicious Code VulnerabilityNx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.
    ScoreSeverityVersionVector String
    9.3CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  14. Added to KEVMay 27, 2026
    CVE-2026-453219.6 CRITICAL⚡ Known ExploitedTanStack TanStack
    TanStack Unspecified VulnerabilityTanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
    ScoreSeverityVersionVector String
    9.6CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
  15. Added to KEVMay 27, 2026
    CVE-2026-83989.3 CRITICAL⚡ Known ExploitedDaemon Daemon Tools Lite
    Daemon Tools Lite Embedded Malicious Code VulnerabilityDaemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.
    ScoreSeverityVersionVector String
    9.3CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  16. Added to KEVMay 26, 2026
    CVE-2026-4817210.0 CRITICAL⚡ Known ExploitedLiteSpeed cPanel Plugin
    LiteSpeed cPanel Plugin Privilege Escalation VulnerabilityLiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.
    ScoreSeverityVersionVector String
    10.0CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  17. Added to KEVMay 22, 2026
    CVE-2026-90829.8 CRITICAL⚡ Known ExploitedDrupal Core
    Drupal Core SQL Injection VulnerabilityDrupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  18. Added to KEVMay 21, 2026
    CVE-2026-349266.7 MEDIUM⚡ Known ExploitedTrend Micro Apex One
    Trend Micro Apex One (On-Premise) Directory Traversal VulnerabilityTrend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
    ScoreSeverityVersionVector String
    6.7MEDIUM3.1CNACVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
  19. Added to KEVMay 21, 2026
    CVE-2025-342919.4 CRITICAL⚡ Known ExploitedLangflow Langflow
    Langflow Origin Validation Error VulnerabilityLangflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.
    ScoreSeverityVersionVector String
    9.4CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  20. Added to KEVMay 20, 2026
    CVE-2026-454987.5 HIGH⚡ Known ExploitedMicrosoft Defender
    Microsoft Defender Denial of Service VulnerabilityMicrosoft Defender contains an unspecified vulnerability that allows for denial of service.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    4.0MEDIUM3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  21. Added to KEVMay 20, 2026
    CVE-2026-410917.8 HIGH⚡ Known ExploitedMicrosoft Defender
    Microsoft Defender Link Following VulnerabilityMicrosoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    7.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  22. Added to KEVMay 20, 2026
    CVE-2010-08068.8 HIGH⚡ Known ExploitedMicrosoft Internet Explorer
    Microsoft Internet Explorer Use-After-Free VulnerabilityMicrosoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  23. Added to KEVMay 20, 2026
    CVE-2010-02498.8 HIGH⚡ Known ExploitedMicrosoft Internet Explorer
    Microsoft Internet Explorer Use-After-Free VulnerabilityMicrosoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  24. Added to KEVMay 20, 2026
    CVE-2009-34598.8 HIGH⚡ Known ExploitedAdobe Acrobat and Reader
    Adobe Acrobat and Reader Heap-Based Buffer Overflow VulnerabilityAdobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  25. Added to KEVMay 20, 2026
    CVE-2009-15378.8 HIGH⚡ Known ExploitedMicrosoft DirectX
    Microsoft DirectX NULL Byte Overwrite VulnerabilityMicrosoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:46 UTC.

CVE Database: Latest Vulnerabilities | Secure.com