BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 08:12 UTC

1,768 CVEs in the CISA Known Exploited Vulnerabilities catalog (added up to Nov 5, 2026) · page 70 of 71

  1. Added to KEVNov 3, 2021
    CVE-2018-159619.8 CRITICAL⚡ Known ExploitedAdobe ColdFusion
    Adobe ColdFusion Unrestricted File Upload VulnerabilityAdobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  2. Added to KEVNov 3, 2021
    CVE-2018-158117.5 HIGH⚡ Known ExploitedDotNetNuke (DNN) DotNetNuke (DNN)
    DotNetNuke (DNN) Inadequate Encryption Strength VulnerabilityDotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:N/A:N
  3. Added to KEVNov 3, 2021
    CVE-2018-145589.8 CRITICAL⚡ Known ExploitedTenda AC7, AC9, and AC10 Routers
    Tenda AC7, AC9, and AC10 Routers Command Injection VulnerabilityTenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  4. Added to KEVNov 3, 2021
    CVE-2018-133799.8 CRITICAL⚡ Known ExploitedFortinet FortiOS
    Fortinet FortiOS SSL VPN Path Traversal VulnerabilityFortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.1CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:P/I:N/A:N
  5. Added to KEVNov 3, 2021
    CVE-2018-117768.1 HIGH⚡ Known ExploitedApache Struts
    Apache Struts Remote Code Execution VulnerabilityApache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.
    ScoreSeverityVersionVector String
    8.1HIGH3.1NVDCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  6. Added to KEVNov 3, 2021
    CVE-2018-86537.5 HIGH⚡ Known ExploitedMicrosoft Internet Explorer
    Microsoft Internet Explorer Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
    7.6HIGH2.0NVDAV:N/AC:H/Au:N/C:C/I:C/A:C
  7. Added to KEVNov 3, 2021
    CVE-2018-76009.8 CRITICAL⚡ Known ExploitedDrupal Drupal Core
    Drupal Core Remote Code Execution VulnerabilityDrupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  8. Added to KEVNov 3, 2021
    CVE-2018-67899.8 CRITICAL⚡ Known ExploitedExim Exim
    Exim Buffer Overflow VulnerabilityExim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  9. Added to KEVNov 3, 2021
    CVE-2018-49399.8 CRITICAL⚡ Known ExploitedAdobe ColdFusion
    Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  10. Added to KEVNov 3, 2021
    CVE-2018-48787.8 HIGH⚡ Known ExploitedAdobe Flash Player
    Adobe Flash Player Use-After-Free VulnerabilityAdobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  11. Added to KEVNov 3, 2021
    CVE-2018-23806.6 MEDIUM⚡ Known ExploitedSAP Customer Relationship Management (CRM)
    SAP Customer Relationship Management (CRM) Path Traversal VulnerabilitySAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
    ScoreSeverityVersionVector String
    6.6MEDIUM3.1NVDCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  12. Added to KEVNov 3, 2021
    CVE-2018-08027.8 HIGH⚡ Known ExploitedMicrosoft Office
    Microsoft Office Memory Corruption VulnerabilityMicrosoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  13. Added to KEVNov 3, 2021
    CVE-2018-07988.8 HIGH⚡ Known ExploitedMicrosoft Office
    Microsoft Office Memory Corruption VulnerabilityMicrosoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  14. Added to KEVNov 3, 2021
    CVE-2018-02967.5 HIGH⚡ Known ExploitedCisco Adaptive Security Appliance (ASA)
    Cisco Adaptive Security Appliance (ASA) Denial-of-Service VulnerabilityCisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    5.0MEDIUM2.0NVDAV:N/AC:L/Au:N/C:N/I:N/A:P
  15. Added to KEVNov 3, 2021
    CVE-2018-01719.8 CRITICAL⚡ Known ExploitedCisco IOS and IOS XE
    Cisco IOS and IOS XE Software Smart Install Remote Code Execution VulnerabilityCisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  16. Added to KEVNov 3, 2021
    CVE-2017-166517.8 HIGH⚡ Known ExploitedRoundcube Roundcube Webmail
    Roundcube Webmail File Disclosure VulnerabilityRoundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    4.6MEDIUM2.0NVDAV:L/AC:L/Au:N/C:P/I:P/A:P
  17. Added to KEVNov 3, 2021
    CVE-2017-118827.8 HIGH⚡ Known ExploitedMicrosoft Office
    Microsoft Office Memory Corruption VulnerabilityMicrosoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  18. Added to KEVNov 3, 2021
    CVE-2017-117747.8 HIGH⚡ Known ExploitedMicrosoft Office
    Microsoft Office Outlook Security Feature Bypass VulnerabilityMicrosoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  19. Added to KEVNov 3, 2021
    CVE-2017-98228.8 HIGH⚡ Known ExploitedDotNetNuke (DNN) DotNetNuke (DNN)
    DotNetNuke (DNN) Remote Code Execution VulnerabilityDotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  20. Added to KEVNov 3, 2021
    CVE-2017-98058.1 HIGH⚡ Known ExploitedApache Struts
    Apache Struts Deserialization of Untrusted Data VulnerabilityApache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
    ScoreSeverityVersionVector String
    8.1HIGH3.1NVDCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    6.8MEDIUM2.0NVDAV:N/AC:M/Au:N/C:P/I:P/A:P
  21. Added to KEVNov 3, 2021
    CVE-2017-92489.8 CRITICAL⚡ Known ExploitedProgress ASP.NET AJAX and Sitefinity
    Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness VulnerabilityProgress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    7.5HIGH2.0NVDAV:N/AC:L/Au:N/C:P/I:P/A:P
  22. Added to KEVNov 3, 2021
    CVE-2017-87597.8 HIGH⚡ Known ExploitedMicrosoft .NET Framework
    Microsoft .NET Framework Remote Code Execution VulnerabilityMicrosoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.
    ScoreSeverityVersionVector String
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    9.3HIGH2.0NVDAV:N/AC:M/Au:N/C:C/I:C/A:C
  23. Added to KEVNov 3, 2021
    CVE-2017-72699.8 CRITICAL⚡ Known ExploitedMicrosoft Internet Information Services (IIS)
    Microsoft Windows Server Buffer Overflow VulnerabilityMicrosoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C
  24. Added to KEVNov 3, 2021
    CVE-2017-63278.8 HIGH⚡ Known ExploitedSymantec Symantec Messaging Gateway
    Symantec Messaging Gateway Remote Code Execution VulnerabilitySymantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    6.5MEDIUM2.0NVDAV:N/AC:L/Au:S/C:P/I:P/A:P
  25. Added to KEVNov 3, 2021
    CVE-2017-56389.8 CRITICAL⚡ Known ExploitedApache Struts
    Apache Struts Remote Code Execution VulnerabilityApache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:12 UTC.

CVE Database: Latest Vulnerabilities | Secure.com