←Intelligence

CVE Index

351 CVEs covered across our intelligence reports.

UNASSIGNED1 report
highGemini CLI Workspace Trust Bypass: RCE via Malicious Environment Configuration in CI/CD25 April 2026
MNDT-2026-00091 report
criticalViewState Deserialization RCE in KnowledgeDeliver LMS: Japanese Educational Sector at Risk25 May 2026
GHSA-xjvp-7243-rg9h1 report
criticalPath Traversal in Charm Wish SCP Middleware - Directory Escape via Unvalidated Symbolic Resolution18 April 2026
GHSA-xhj4-g6w8-2xjw1 report
highgo-zserio Unbounded Memory Allocation via Untrusted Deserialization25 April 2026
GHSA-vj3m-2g9h-vm4p1 report
criticalGrav CMS Multiple RCE Vectors: Unsafe Deserialization & Command Injection6 May 2026
GHSA-rqpp-rjj8-7wv81 report
highOpenClaw WebSocket Scope Elevation: Shared-Auth Authorization Bypass14 March 2026
GHSA-fxc9-7j2w-vx541 report
criticalAuthentication & Authorization Bypass in mpp Payment Handler - Request Replay and Session Hijacking30 March 2026
GHSA-9cp7-j3f8-p5jx1 report
criticalDaptin Unauthenticated Path Traversal in File Upload Handler11 April 2026
GHSA-8m29-fpq5-89jj1 report
criticalConsensus Divergence in Zebra Zcash Implementation - Sighash Validation Bypass18 April 2026
GHSA-5wr9-m6jw-xx441 report
highScriban TemplateContext Cache Poisoning: MemberFilter Bypass via Accessor Reuse25 March 2026
GHSA-47wq-cj9q-wpmp1 report
criticalCross-Tenant Agent API Token Minting via Missing Authorization Checks17 April 2026
GHSA-2wvh-87g2-89hr1 report
criticalOpenC3 COSMOS Script Runner: Privilege Escalation via Docker Network Access and Credential Exposure24 April 2026
CVE-2026-92771 report
highshell-quote Input Validation Bypass: Newline Injection in Object Token Operators10 June 2026
CVE-2026-90821 report
criticalDrupal CVE-2026-9082 Exploitation Begins Within Days of Disclosure, Affecting Thousands23 May 2026
CVE-2026-87321 report
criticalUnauthenticated Admin Account Creation in WP Maps Pro Exposes Thousands of WordPress Installations2 June 2026
CVE-2026-80431 report
criticalMulti-vendor RCE patch wave signals coordinated disclosure cycle with Ivanti Xtraction critical flaw leading18 May 2026
CVE-2026-74821 report
criticalOllama Memory Disclosure via Out-of-Bounds Read Affects 300k+ Deployments11 May 2026
CVE-2026-54261 report
highHard-coded ASP.NET Keys in KnowledgeDeliver LMS Enabled Zero-Day Godzilla and Cobalt Strike Deployment26 May 2026
CVE-2026-54121 report
criticalJuju Controller CloudSpec API Unauthorized Credential Exposure11 April 2026
CVE-2026-52811 report
highActive Chrome Dawn Use-After-Free Exploitation Signals Shift Toward GPU API Attack Surface2 April 2026
CVE-2026-477441 report
criticalShopper Admin: Chained Authorization Defects Enable RBAC Privilege Escalation6 June 2026
CVE-2026-477241 report
criticalnebula-mesh: Authorization Bypass in API Endpoints Enabling Cross-Operator Privilege Escalation9 June 2026
CVE-2026-477081 report
criticalMCP-for-Stata Command Injection via Unsanitized log_file_name Parameter5 June 2026
CVE-2026-474291 report
highVitest UI API Path Traversal via Improper URL Normalization on Windows2 June 2026
CVE-2026-474161 report
criticalVertical Privilege Escalation in PraisonAI Platform Workspace Member Management30 May 2026
CVE-2026-474131 report
criticalPrivilege Escalation via Insufficient Authorization Check in Workspace Member Addition2 June 2026
CVE-2026-474101 report
criticalHardcoded JWT Secret in Default Configuration Enables Unauthenticated Privilege Escalation30 May 2026
CVE-2026-474071 report
criticalPraisonAI Platform: Cross-Workspace IDOR and Unenforceed Role-Based Access Control30 May 2026
CVE-2026-472521 report
highAppleScript Code Injection in Anyquery Chrome Plugin via Unescaped URL Interpolation9 June 2026
CVE-2026-46811 report
criticalPTC Windchill RCE affecting 11 versions across PDMLink and FlexPLM: widescale PLM ecosystem at risk27 March 2026
CVE-2026-467161 report
criticalNezha Monitoring: Authentication Bypass Enables Cross-Tenant RCE via Cron API23 May 2026
CVE-2026-466951 report
criticalBoxLite Capability-Based Permission Bypass Enabling Read-Only Mount Remounting22 May 2026
CVE-2026-466701 report
criticalYesWiki Unauthenticated SQL Injection in Form Import Handler23 May 2026
CVE-2026-466331 report
criticalTwig Template Engine: Single Quote Escape Bypass in PHP Code Generation22 May 2026
CVE-2026-464211 report
criticalSupply Chain Compromise: Malicious CAP.js Package Versions with Credential Harvesting21 May 2026
CVE-2026-463541 report
criticalCoder Azure Instance Identity PKCS#7 Signature Validation Bypass20 May 2026
CVE-2026-456251 report
criticalArcane Backend: Broken Access Control on GitOps Credential Management Endpoints19 May 2026
CVE-2026-454111 report
criticalVM2 Sandbox Escape via Async Generator Type Confusion15 May 2026
CVE-2026-453751 report
criticalSiYuan Bazaar Stored XSS via Unescaped Package Metadata Leading to Electron RCE14 May 2026
CVE-2026-453211 report
criticalSupply Chain Compromise via GitHub Actions OIDC Token Extraction and Cache Poisoning12 May 2026
CVE-2026-452881 report
criticalMarten Full-Text Search SQL Injection via Unparameterized regConfig15 May 2026
CVE-2026-451851 report
criticalExim BDAT use-after-free in GnuTLS builds creates RCE window for mail infrastructure13 May 2026
CVE-2026-450831 report
criticalUnauthenticated Solr Streaming Expression Proxy in Goobi Viewer REST API14 May 2026
CVE-2026-446721 report
criticalMapfish Print Unauthenticated Remote Code Execution via Dynamic Table Processing13 May 2026
CVE-2026-446491 report
criticalSillyTavern Header-Based SSO Authentication Bypass – Untrusted Proxy Trust Model13 May 2026
CVE-2026-443301 report
criticalUnauthenticated NEF PFD Management API—Authentication Bypass in free5GC10 May 2026
CVE-2026-442211 report
criticalArcadeDB Authorization Bypass via Uninitialized Security Context and Disabled Schema Enforcement6 May 2026
CVE-2026-440051 report
criticalSandbox Escape via Mutable Proxies in vm27 May 2026
CVE-2026-439991 report
criticalNodeVM Builtin Allowlist Bypass via Module Loading7 May 2026
CVE-2026-43701 report
criticalJuju Dqlite Cluster Authentication Bypass - Unauthenticated Database Access2 April 2026
CVE-2026-429451 report
criticalNGINX CVE-2026-42945 heap overflow under active exploitation with RCE potential17 May 2026
CVE-2026-426131 report
criticalGrav Login Plugin: Unauthenticated Privilege Escalation via Missing Server-Side Validation of User Metadata Fields6 May 2026
CVE-2026-425601 report
criticalPatreon OAuth Provider Identity Collapse: Cryptographic Hash Collision Enabling Cross-User Impersonation3 May 2026
CVE-2026-422311 report
criticaln8n Prototype Pollution via XML Webhook Parser Leading to RCE30 April 2026
CVE-2026-422081 report
criticalLiteLLM SQLi exploitation accelerating: 36-hour weaponisation window exposes pre-auth data access risk29 April 2026
CVE-2026-415861 report
criticalUnsafe Java Deserialization in fabric-sdk-java ObjectInputStream without Filter30 April 2026
CVE-2026-415011 report
criticalCommand Injection in electerm via Unsafe Shell Execution in Package Installation25 April 2026
CVE-2026-402811 report
criticalGotenberg ExifTool Stdin Injection via Metadata Value Newlines - Incomplete Sanitization Bypass3 May 2026
CVE-2026-377091 report
criticalSnipe-IT API Authorization Bypass Enables Unauthenticated File Upload & Code Execution10 May 2026
CVE-2026-36501 report
highMemory Leak in GDCM Medical Imaging Parser Enables Remote Denial of Service25 March 2026
CVE-2026-35871 report
criticalWAGO Industrial Switches: Unauthenticated CLI Escape Grants Full Device Compromise27 March 2026
CVE-2026-356161 report
criticalFortiClient EMS pre-authentication bypass enables unauthenticated privilege escalation in active exploitation5 April 2026
CVE-2026-354591 report
highServer-Side Request Forgery (SSRF) via HTTP Redirect Bypass in pyLoad – Incomplete CVE-2026-33992 Fix5 April 2026
CVE-2026-352161 report
criticalBudibase Unauthenticated RCE via Public Webhook + Bash Automation Template Injection5 April 2026
CVE-2026-349531 report
criticalAuthentication Bypass in PraisonAI OAuthManager - Empty Token Store Logic Flaw2 April 2026
CVE-2026-349521 report
criticalPraisonAI WebSocket Gateway Missing Authentication – Agent Enumeration and Arbitrary Message Injection2 April 2026
CVE-2026-345581 report
criticalStored DOM XSS in Methods Management - Global Persistent Code Execution via Navigation Rendering1 April 2026
CVE-2026-345571 report
criticalStored DOM XSS in Permission Management - Administrative Context RCE & Account Takeover1 April 2026
CVE-2026-342431 report
criticalGitHub Actions Command Injection via Unsanitized Issue Comment Input30 March 2026
CVE-2026-342201 report
criticalMikroORM SQL Injection via Duck-Type Object Marker Detection30 March 2026
CVE-2026-342021 report
criticalZebra Node Remote DoS via Malformed V5 Transaction Deserialization28 March 2026
CVE-2026-339921 report
highServer-Side Request Forgery (SSRF) via HTTP Redirect Bypass in pyLoad – Incomplete CVE-2026-33992 Fix5 April 2026
CVE-2026-338641 report
criticalConvict Prototype Pollution via String.prototype.startsWith Override27 March 2026
CVE-2026-338631 report
criticalConvict Prototype Pollution via Unsafe Recursive Merge and Schema Initialization27 March 2026
CVE-2026-337161 report
criticalAVideo Live Stream Authentication Bypass via Untrusted Token Verification Redirect26 March 2026
CVE-2026-337011 report
criticalOpenTelemetry RMI Deserialization RCE - Unsafe Gadget Chain Exploitation Vector26 March 2026
CVE-2026-336601 report
criticaln8n Merge Node SQL Injection Leading to RCE via AlaSQL Sandbox Escape26 March 2026
CVE-2026-336341 report
criticalTrivy Supply Chain Compromise via Credential Theft - Multi-Repository Malware Injection25 March 2026
CVE-2026-33561 report
highAnritsu Remote Spectrum Monitor: Unauthenticated Configuration Alteration in Critical RF Test Equipment1 April 2026
CVE-2026-335021 report
criticalUnauthenticated SSRF in AVideo Live Plugin Enables Internal Network Reconnaissance21 March 2026
CVE-2026-333511 report
criticalAVideo Unauthenticated SSRF via webSiteRootURL Parameter – Standalone Deployment Risk20 March 2026
CVE-2026-333221 report
criticalJWT Algorithm Confusion in MinIO OIDC Authentication - Defensive Analysis20 March 2026
CVE-2026-332111 report
criticalPath Traversal in Tekton Pipelines Git Resolver - Arbitrary File Read via Parameter Injection19 March 2026
CVE-2026-331861 report
criticalgRPC-Go Authorization Bypass via Non-Canonical :path Header Validation19 March 2026
CVE-2026-331801 report
highHTTP Header Leakage During Redirect Following in HAPI FHIR19 March 2026
CVE-2026-331371 report
criticalXWiki Platform Unauthenticated XAR Import via REST API - Authentication Bypass27 May 2026
CVE-2026-330172 reports
criticalActive exploitation of Langflow CVE-2026-33017 signals targeting of AI orchestration infrastructure27 March 2026highLangflow Code Injection Added to CISA KEV Catalog as Active Exploitation Confirmed26 March 2026
CVE-2026-33001 report
criticalActive exploitation of Everest Forms Pro RCE enables WordPress site takeover7 June 2026
CVE-2026-327671 report
criticalSiYuan Authorization Bypass: Unauthenticated SQL Execution via Inconsistent Middleware Chain17 March 2026
CVE-2026-327601 report
criticalPrivilege Escalation via Unsafe Default Permission Application in User Signup17 March 2026
CVE-2026-326211 report
criticalApollo Federation Prototype Pollution via Incomplete Key Sanitization14 March 2026
CVE-2026-32611 report
criticalSQL Injection Vulnerability in itsourcecode School Management System1 March 2026
CVE-2026-323011 report
criticalJWT Signature Verification Order-of-Operations Flaw Enables Unauthenticated SSRF in Centrifugo14 March 2026
CVE-2026-322481 report
criticalParse Server Operator Injection in Authentication Provider - Account Takeover Risk13 March 2026
CVE-2026-322421 report
criticalParse Server OAuth2 Singleton State Leakage - Concurrent Provider Token Validation Bypass13 March 2026
CVE-2026-319761 report
criticalSupply Chain Compromise via Mutable Git Tag Poisoning in GitHub Actions12 March 2026
CVE-2026-319381 report
highjsPDF HTML Injection via Unsafe Options Serialization in New Window Output18 March 2026
CVE-2026-318711 report
criticalParse Server PostgreSQL SQL Injection via Dot-Notation Sub-key11 March 2026
CVE-2026-31351 report
criticalSQL Injection Vulnerability in itsourcecode News Portal Project27 February 2026
CVE-2026-31341 report
criticalSQL Injection Vulnerability in itsourcecode News Portal Project27 February 2026
CVE-2026-31331 report
criticalSQL Injection Vulnerability in itsourcecode Document Management System27 February 2026
CVE-2026-309601 report
criticalArbitrary Code Execution via Unvalidated JIT Instruction Generation10 March 2026
CVE-2026-309571 report
criticalOneUptime Synthetic Monitor Remote Code Execution Vulnerability Analysis10 March 2026
CVE-2026-30371 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-292011 report
highcPanel/WHM Patches Three Privilege Escalation and RCE Vulnerabilities Affecting Hosting Infrastructure10 May 2026
CVE-2026-291911 report
criticalZitadel /saml-post Endpoint XSS Vulnerability Analysis5 March 2026
CVE-2026-291831 report
highSiYuan SanitizeSVG Bypass via XML MIME Type Omission – Incomplete CVE-2026-29183 Fix18 March 2026
CVE-2026-286971 report
criticalAuthenticated Remote Code Execution via SSTI in Craft CMS4 March 2026
CVE-2026-28351 report
criticalHTTP Request Smuggling in Pingora via Transfer-Encoding Misparsing6 March 2026
CVE-2026-28331 report
criticalHTTP Request Smuggling via Premature Upgrade in Pingora6 March 2026
CVE-2026-282681 report
criticalPassword Reset Token Reuse Vulnerability in Vikunja28 February 2026
CVE-2026-279691 report
criticalArbitrary File Write via Backup Manifest in Vitess28 February 2026
CVE-2026-279661 report
criticalLangflow CSV Agent Misconfiguration Enables RCE28 February 2026
CVE-2026-278221 report
criticalRustFS Console Stored XSS Vulnerability Leading to Administrative Account Takeover26 February 2026
CVE-2026-278041 report
criticalParse Server JWT Algorithm Misconfiguration Vulnerability26 February 2026
CVE-2026-277721 report
criticalCritical Vulnerabilities in EV Energy Charging Stations Enable Unauthorized Control27 February 2026
CVE-2026-277391 report
criticalAngular SSRF Vulnerability: Unvalidated Headers Leading to Base Origin Manipulation26 February 2026
CVE-2026-275931 report
criticalStatamic Password Reset Link Injection Vulnerability Analysis25 February 2026
CVE-2026-275841 report
criticalMissing Authentication in ActualBudget Server Endpoints25 February 2026
CVE-2026-275741 report
criticalNode.js VM Sandbox Escape in OneUptime Leading to RCE25 February 2026
CVE-2026-269801 report
criticalGhost CMS SQL injection weaponised in coordinated ClickFix distribution campaign25 May 2026
CVE-2026-262901 report
criticalCritical Vulnerabilities in EV Energy Charging Stations Enable Unauthorized Control27 February 2026
CVE-2026-261981 report
criticalORMar Vulnerability: Critical SQL Injection via Aggregate Functions24 February 2026
CVE-2026-260491 report
criticalCritical Vulnerabilities in Jinan USR IOT Technology's USR-W61021 February 2026
CVE-2026-260481 report
criticalCritical Vulnerabilities in Jinan USR IOT Technology's USR-W61021 February 2026
CVE-2026-258511 report
criticalCritical Vulnerabilities in Chargemap Expose EV Charging Infrastructure27 February 2026
CVE-2026-257741 report
criticalCritical Vulnerabilities in EV Energy Charging Stations Enable Unauthorized Control27 February 2026
CVE-2026-257211 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-257151 report
criticalCritical Vulnerabilities in Jinan USR IOT Technology's USR-W61021 February 2026
CVE-2026-257111 report
criticalCritical Vulnerabilities in Chargemap Expose EV Charging Infrastructure27 February 2026
CVE-2026-251961 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-251951 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-251111 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-251091 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-251081 report
criticalCISA Adds Authenticated Command Injection Vulnerability to Known Exploits Catalog25 February 2026
CVE-2026-251051 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-250851 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-250371 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-248581 report
criticalCritical Fortinet Vulnerabilities Cascade to Siemens Industrial ICS Devices13 March 2026
CVE-2026-247901 report
criticalCritical Vulnerability in Welker OdorEyes System Allows Unauthorized Control22 February 2026
CVE-2026-246951 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-246891 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-246631 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-245171 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-244551 report
criticalCritical Vulnerabilities in Jinan USR IOT Technology's USR-W61021 February 2026
CVE-2026-244521 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-244451 report
criticalCritical Vulnerabilities in EV Energy Charging Stations Enable Unauthorized Control27 February 2026
CVE-2026-24171 report
criticalUnauthenticated Root RCE in Pharos Mosaic Show Controller Exposes Critical Stage Infrastructure25 March 2026
CVE-2026-238911 report
criticalDecidim Stored XSS in User Name Field - Passive Code Execution Vector14 April 2026
CVE-2026-237341 report
highXWiki Platform Path Traversal in Resource Endpoints – Configuration File Disclosure27 May 2026
CVE-2026-237021 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-231111 report
criticalPublic exploit for Linux kernel use-after-free escalates unprivileged users to root across distributions9 June 2026
CVE-2026-228851 report
criticalCritical Vulnerabilities in EnOcean SmartServer IoT Enable Remote Code Execution22 February 2026
CVE-2026-228771 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-226101 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2026-225991 report
criticalStrapi Content-Type Builder SQL Injection via Unsanitized Raw Database Queries14 May 2026
CVE-2026-225531 report
criticalCritical Vulnerabilities in InSAT MasterSCADA BUK-TS Enable Remote Code Execution25 February 2026
CVE-2026-219921 report
criticalOracle Identity Manager Zero-Day RCE Triggers Emergency Patching - Unauthenticated Attack Surface Critical21 March 2026
CVE-2026-217181 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-214101 report
criticalCritical Vulnerabilities in InSAT MasterSCADA BUK-TS Enable Remote Code Execution25 February 2026
CVE-2026-213891 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-209631 report
highCISA Catalog Updates Highlight Dual Enterprise Threats: Zimbra XSS and SharePoint Deserialization19 March 2026
CVE-2026-209101 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-209021 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-207971 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-207921 report
criticalCritical Vulnerabilities in Chargemap Expose EV Charging Infrastructure27 February 2026
CVE-2026-207911 report
criticalCritical Vulnerabilities in Chargemap Expose EV Charging Infrastructure27 February 2026
CVE-2026-207641 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-207611 report
criticalCritical Vulnerabilities in EnOcean SmartServer IoT Enable Remote Code Execution22 February 2026
CVE-2026-207421 report
criticalCritical Vulnerabilities in Copeland XWEB Devices Enable Remote Code Execution27 February 2026
CVE-2026-206431 report
highApple Introduces Background Security Improvements model to patch WebKit vulnerability without full OS update18 March 2026
CVE-2026-202451 report
criticalCisco SD-WAN zero-day exploitation pattern suggests systematic targeting or quality regression5 June 2026
CVE-2026-202231 report
criticalCisco Secure Workload REST API Authentication Bypass Exposed Unauthenticated Data Access22 May 2026
CVE-2026-201311 report
criticalCISA Emergency Patch Directive for Critical Cisco FMC RCE – Federal Mandate Signals Active Exploitation Risk21 March 2026
CVE-2026-201271 report
criticalCritical Vulnerability in Cisco SD-WAN Systems Under Active Exploitation26 February 2026
CVE-2026-17631 report
criticalGE Vernova Enervista UR Setup Critical Vulnerabilities Enable Remote Code Execution22 February 2026
CVE-2026-17621 report
criticalGE Vernova Enervista UR Setup Critical Vulnerabilities Enable Remote Code Execution22 February 2026
CVE-2026-16701 report
criticalHoneywell CCTV Products Vulnerability Allows Account Takeover22 February 2026
CVE-2026-15791 report
criticalPX4 Autopilot Remote Code Execution: Unauthenticated MAVLink Command Injection1 April 2026
CVE-2026-13611 report
criticalDelta Electronics ASDA-Soft Stack-Based Buffer Overflow Vulnerability (CVE-2026-1361)22 February 2026
CVE-2026-12411 report
criticalCritical Vulnerabilities in Pelco Sarix Pro 3 Series IP Cameras27 February 2026
CVE-2026-116451 report
highChrome's Fifth Zero-Day in 2026 Signals Elevated Attack Surface or Coordinated Disclosure Pattern9 June 2026
CVE-2026-03041 report
criticalMicrosoft February 2026 Patch Tuesday Fixes Four Actively Exploited Flaws10 February 2026
CVE-2026-03031 report
criticalMicrosoft February 2026 Patch Tuesday Fixes Four Actively Exploited Flaws10 February 2026
CVE-2026-03021 report
criticalMicrosoft February 2026 Patch Tuesday Fixes Four Actively Exploited Flaws10 February 2026
CVE-2026-03011 report
criticalMicrosoft February 2026 Patch Tuesday Fixes Four Actively Exploited Flaws10 February 2026
CVE-2026-02571 report
highActive exploitation of Palo Alto GlobalProtect auth bypass signals VPN perimeter as primary attack vector31 May 2026
CVE-2026-02151 report
criticalCritical Cisco NX-OS Vulnerability Enables Remote Command Injection3 February 2026
CVE-2026-02081 report
criticalMicrosoft January 2026 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities13 January 2026
CVE-2026-02071 report
criticalMicrosoft January 2026 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities13 January 2026
CVE-2026-02061 report
criticalMicrosoft January 2026 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities13 January 2026
CVE-2026-02051 report
criticalMicrosoft January 2026 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities13 January 2026
CVE-2026-02041 report
criticalMicrosoft January 2026 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities13 January 2026
CVE-2026-02031 report
criticalMicrosoft January 2026 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities13 January 2026
CVE-2026-02021 report
criticalMicrosoft January 2026 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities13 January 2026
CVE-2026-02011 report
criticalMicrosoft January 2026 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities13 January 2026
CVE-2026-01901 report
highCritical PostgreSQL Vulnerability Enables Authenticated RCE Through SQL Functions6 February 2026
CVE-2026-01801 report
criticalJuniper Networks Patches Critical RCE in Junos OS Affecting Enterprise Routers27 January 2026
CVE-2026-01501 report
criticalCritical Vulnerability in SonicWall SonicOS Allows Unauthenticated Access9 January 2026
CVE-2026-01011 report
criticalFortinet FortiGate Firewalls Compromised via New Authentication Bypass Zero-Day6 January 2026
CVE-2025-96701 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-92321 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-92301 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-77831 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-706141 report
highMulti-tenant SMS data exposure via parameter tampering in OpenCode messaging platform27 March 2026
CVE-2025-69651 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-692771 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-686131 report
highn8n Code Injection Vulnerability Exploited in Wild - Low-Code Automation Platform Targeted11 March 2026
CVE-2025-684611 report
criticalCISA Adds Two Critical Webmail Vulnerabilities to Known Exploited Catalog21 February 2026
CVE-2025-681211 report
criticalHTTP/3 TLS ClientAuth Bypass Vulnerability in Traefik22 February 2026
CVE-2025-664121 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-663761 report
highCISA Catalog Updates Highlight Dual Enterprise Threats: Zimbra XSS and SharePoint Deserialization19 March 2026
CVE-2025-660351 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-660311 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-660301 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-647561 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-647181 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-641571 report
criticalCritical Fortinet Vulnerabilities Cascade to Siemens Industrial ICS Devices13 March 2026
CVE-2025-625221 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-624391 report
criticalCritical Fortinet Vulnerabilities Cascade to Siemens Industrial ICS Devices13 March 2026
CVE-2025-587541 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-587521 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-587511 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-551821 report
criticalAutomated credential harvesting via React2Shell exploitation in Next.js applications represents shift toward industrialised supply-chain attacks6 April 2026
CVE-2025-550181 report
criticalCritical Fortinet Vulnerabilities Cascade to Siemens Industrial ICS Devices13 March 2026
CVE-2025-549571 report
highPixel 10 0-click exploit chain demonstrates persistent Android attack surface despite mitigations14 May 2026
CVE-2025-535211 report
criticalF5 BIG-IP RCE Added to KEV Catalog as Active Exploitation Confirmed28 March 2026
CVE-2025-498441 report
criticalCritical Privilege Escalation in Schneider Electric Plant iT/Brewmaxx Enables RCE Across Industrial Operations25 March 2026
CVE-2025-493011 report
criticalLog4Shell Successor: Critical RCE in Apache Commons Text Exploitation Surges28 December 2025
CVE-2025-491132 reports
criticalCritical Remote Code Execution Flaws in Roundcube Webmail21 February 2026criticalCISA Adds Two Critical Webmail Vulnerabilities to Known Exploited Catalog21 February 2026
CVE-2025-485951 report
highAndroid Framework Privilege Escalation Under Active Exploitation Signals Shift in Attack Surface3 June 2026
CVE-2025-482021 report
criticalMicrosoft December 2025 Patch Tuesday Fixes Critical LDAP and Windows Kernel Flaws9 December 2025
CVE-2025-482011 report
criticalMicrosoft December 2025 Patch Tuesday Fixes Critical LDAP and Windows Kernel Flaws9 December 2025
CVE-2025-480231 report
criticalYokogawa CENTUM VP Vulnerabilities with Critical Impact27 February 2026
CVE-2025-480221 report
criticalYokogawa CENTUM VP Vulnerabilities with Critical Impact27 February 2026
CVE-2025-480211 report
criticalYokogawa CENTUM VP Vulnerabilities with Critical Impact27 February 2026
CVE-2025-480201 report
criticalYokogawa CENTUM VP Vulnerabilities with Critical Impact27 February 2026
CVE-2025-480191 report
criticalYokogawa CENTUM VP Vulnerabilities with Critical Impact27 February 2026
CVE-2025-478131 report
mediumWing FTP Information Disclosure Added to KEV Catalog - Active Exploitation Ongoing17 March 2026
CVE-2025-478011 report
criticalCritical Ivanti Connect Secure Zero-Day Exploited in Mass Attacks3 December 2025
CVE-2025-468191 report
criticalCritical Privilege Escalation in Schneider Electric Plant iT/Brewmaxx Enables RCE Across Industrial Operations25 March 2026
CVE-2025-468181 report
criticalCritical Privilege Escalation in Schneider Electric Plant iT/Brewmaxx Enables RCE Across Industrial Operations25 March 2026
CVE-2025-468171 report
criticalCritical Privilege Escalation in Schneider Electric Plant iT/Brewmaxx Enables RCE Across Industrial Operations25 March 2026
CVE-2025-46641 report
highGoogle Patches Actively Exploited Chrome Zero-Day in V8 Engine21 May 2025
CVE-2025-453011 report
criticalCritical Apache Struts Vulnerability Enables Remote Code Execution22 November 2025
CVE-2025-451041 report
criticalMicrosoft November 2025 Patch Tuesday Fixes Exchange Server Zero-Day11 November 2025
CVE-2025-451031 report
criticalMicrosoft November 2025 Patch Tuesday Fixes Exchange Server Zero-Day11 November 2025
CVE-2025-451021 report
criticalMicrosoft November 2025 Patch Tuesday Fixes Exchange Server Zero-Day11 November 2025
CVE-2025-451011 report
criticalMicrosoft November 2025 Patch Tuesday Fixes Exchange Server Zero-Day11 November 2025
CVE-2025-445011 report
criticalCritical Citrix NetScaler ADC Vulnerability Exploited for Credential Harvesting4 November 2025
CVE-2025-44281 report
criticalIvanti EPMM Vulnerabilities Chained for Unauthenticated Remote Code Execution15 May 2025
CVE-2025-44271 report
criticalIvanti EPMM Vulnerabilities Chained for Unauthenticated Remote Code Execution15 May 2025
CVE-2025-430121 report
criticalCritical Kubernetes Vulnerability Allows Container Escape via Volume Mount20 October 2025
CVE-2025-423021 report
criticalMicrosoft October 2025 Patch Tuesday Fixes Actively Exploited RDP Vulnerability14 October 2025
CVE-2025-423011 report
criticalMicrosoft October 2025 Patch Tuesday Fixes Actively Exploited RDP Vulnerability14 October 2025
CVE-2025-412211 report
criticalCritical Palo Alto Networks Expedition Vulnerability Enables Config and Credential Theft3 October 2025
CVE-2025-412201 report
criticalCritical Palo Alto Networks Expedition Vulnerability Enables Config and Credential Theft3 October 2025
CVE-2025-409431 report
criticalSiemens SIMATIC S7-1500 Code Injection via Malicious Trace Files - Critical OT Supply Chain Risk13 March 2026
CVE-2025-401151 report
criticalCritical Vulnerability in Veeam Backup and Replication Enables Full System Compromise25 September 2025
CVE-2025-398211 report
criticalCritical GitLab Vulnerability Allows Account Takeover via Password Reset28 August 2025
CVE-2025-391051 report
criticalCisco Warns of Mass Exploitation of IOS XE Web UI Vulnerability15 September 2025
CVE-2025-382011 report
criticalCritical SonicWall SMA Vulnerability Actively Exploited by Ransomware Groups5 August 2025
CVE-2025-378121 report
criticalMicrosoft September 2025 Patch Tuesday Addresses Critical Windows TCP/IP Flaw9 September 2025
CVE-2025-378111 report
criticalMicrosoft September 2025 Patch Tuesday Addresses Critical Windows TCP/IP Flaw9 September 2025
CVE-2025-378101 report
criticalMicrosoft September 2025 Patch Tuesday Addresses Critical Windows TCP/IP Flaw9 September 2025
CVE-2025-360121 report
criticalCritical RCE in Fortinet FortiManager Exploited by Chinese APT Group14 July 2025
CVE-2025-347151 report
criticalMicrosoft August 2025 Patch Tuesday Fixes Six Actively Exploited Vulnerabilities12 August 2025
CVE-2025-347141 report
criticalMicrosoft August 2025 Patch Tuesday Fixes Six Actively Exploited Vulnerabilities12 August 2025
CVE-2025-347131 report
criticalMicrosoft August 2025 Patch Tuesday Fixes Six Actively Exploited Vulnerabilities12 August 2025
CVE-2025-347121 report
criticalMicrosoft August 2025 Patch Tuesday Fixes Six Actively Exploited Vulnerabilities12 August 2025
CVE-2025-347111 report
criticalMicrosoft August 2025 Patch Tuesday Fixes Six Actively Exploited Vulnerabilities12 August 2025
CVE-2025-347101 report
criticalMicrosoft August 2025 Patch Tuesday Fixes Six Actively Exploited Vulnerabilities12 August 2025
CVE-2025-343621 report
criticalMOVEit Transfer Vulnerability Exploited Again by Cl0p Ransomware15 June 2025
CVE-2025-336711 report
criticalMicrosoft July 2025 Patch Tuesday Addresses Critical Hyper-V Escape8 July 2025
CVE-2025-336541 report
criticalMicrosoft July 2025 Patch Tuesday Addresses Critical Hyper-V Escape8 July 2025
CVE-2025-330531 report
highMicrosoft June 2025 Patch Tuesday Fixes Actively Exploited Kernel Vulnerability10 June 2025
CVE-2025-329751 report
criticalMaximum-Severity Quest KACE SMA Exploitation Campaign Signals Internet-Exposed Admin Tools as Prime Targets23 March 2026
CVE-2025-327091 report
criticalMicrosoft May 2025 Patch Tuesday Fixes Five Actively Exploited Zero-Days14 May 2025
CVE-2025-327061 report
criticalMicrosoft May 2025 Patch Tuesday Fixes Five Actively Exploited Zero-Days14 May 2025
CVE-2025-327011 report
criticalMicrosoft May 2025 Patch Tuesday Fixes Five Actively Exploited Zero-Days14 May 2025
CVE-2025-324331 report
criticalErlang/OTP SSH Server Vulnerability Scores Perfect CVSS 10.017 April 2025
CVE-2025-318901 report
criticalCritical OpenSSH Vulnerability Allows Remote Code Execution on Linux Servers3 July 2025
CVE-2025-316501 report
criticalCritical Atlassian Confluence RCE Vulnerability Under Active Exploitation4 June 2025
CVE-2025-313241 report
criticalSAP NetWeaver Zero-Day Exploited to Deploy Webshells on Enterprise Servers24 April 2025
CVE-2025-312021 report
highApple Emergency Patches for WebKit Zero-Days Used in Targeted Spyware Attacks22 July 2025
CVE-2025-312011 report
highApple Emergency Patches for WebKit Zero-Days Used in Targeted Spyware Attacks22 July 2025
CVE-2025-304001 report
criticalMicrosoft May 2025 Patch Tuesday Fixes Five Actively Exploited Zero-Days14 May 2025
CVE-2025-303971 report
criticalMicrosoft May 2025 Patch Tuesday Fixes Five Actively Exploited Zero-Days14 May 2025
CVE-2025-300661 report
highGitHub Actions Supply Chain Attack via tj-actions/changed-files15 March 2025
CVE-2025-299271 report
criticalCritical Next.js Middleware Authorization Bypass Vulnerability22 March 2025
CVE-2025-298242 reports
highMicrosoft June 2025 Patch Tuesday Fixes Actively Exploited Kernel Vulnerability10 June 2025criticalMicrosoft April Patch Tuesday: Windows CLFS Zero-Day Exploited by Ransomware9 April 2025
CVE-2025-287031 report
highCritical Vulnerability in ASUS Router Firmware Enables Remote Takeover28 June 2025
CVE-2025-28251 report
criticalCrushFTP Authentication Bypass Vulnerability Under Active Exploitation28 March 2025
CVE-2025-266331 report
criticalMicrosoft March 2025 Patch Tuesday Addresses Six Actively Exploited Zero-Days12 March 2025
CVE-2025-249931 report
criticalMicrosoft March 2025 Patch Tuesday Addresses Six Actively Exploited Zero-Days12 March 2025
CVE-2025-249911 report
criticalMicrosoft March 2025 Patch Tuesday Addresses Six Actively Exploited Zero-Days12 March 2025
CVE-2025-249851 report
criticalMicrosoft March 2025 Patch Tuesday Addresses Six Actively Exploited Zero-Days12 March 2025
CVE-2025-249841 report
criticalMicrosoft March 2025 Patch Tuesday Addresses Six Actively Exploited Zero-Days12 March 2025
CVE-2025-249831 report
criticalMicrosoft March 2025 Patch Tuesday Addresses Six Actively Exploited Zero-Days12 March 2025
CVE-2025-248131 report
criticalCritical Apache Tomcat RCE Vulnerability Under Active Exploitation18 March 2025
CVE-2025-245141 report
criticalIngressNightmare: Critical Kubernetes Ingress-NGINX Vulnerabilities Expose Clusters25 March 2025
CVE-2025-240851 report
highApple Patches Actively Exploited Zero-Day in CoreMedia Framework27 January 2025
CVE-2025-222301 report
criticalVMware ESXi Vulnerability Enables Hypervisor Escape from Guest VM24 June 2025
CVE-2025-222261 report
criticalBroadcom Patches Three VMware Zero-Days Exploited in Active Attacks5 March 2025
CVE-2025-222251 report
criticalBroadcom Patches Three VMware Zero-Days Exploited in Active Attacks5 March 2025
CVE-2025-222241 report
criticalBroadcom Patches Three VMware Zero-Days Exploited in Active Attacks5 March 2025
CVE-2025-214181 report
criticalMicrosoft February 2025 Patch Tuesday Fixes Actively Exploited Zero-Days12 February 2025
CVE-2025-213911 report
criticalMicrosoft February 2025 Patch Tuesday Fixes Actively Exploited Zero-Days12 February 2025
CVE-2025-213771 report
criticalMicrosoft February 2025 Patch Tuesday Fixes Actively Exploited Zero-Days12 February 2025
CVE-2025-213761 report
criticalMicrosoft February 2025 Patch Tuesday Fixes Actively Exploited Zero-Days12 February 2025
CVE-2025-213351 report
criticalMicrosoft January 2025 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities15 January 2025
CVE-2025-213341 report
criticalMicrosoft January 2025 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities15 January 2025
CVE-2025-213331 report
criticalMicrosoft January 2025 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities15 January 2025
CVE-2025-213071 report
criticalMicrosoft January 2025 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities15 January 2025
CVE-2025-212981 report
criticalMicrosoft January 2025 Patch Tuesday Addresses Eight Zero-Day Vulnerabilities15 January 2025
CVE-2025-201881 report
criticalThreat Actors Exploit Cisco IOS XE Wireless Controllers via Hard-Coded JWT8 May 2025
CVE-2025-201251 report
criticalCisco Patches Critical Privilege Escalation Vulnerabilities in ISE7 February 2025
CVE-2025-201241 report
criticalCisco Patches Critical Privilege Escalation Vulnerabilities in ISE7 February 2025
CVE-2025-19741 report
criticalIngressNightmare: Critical Kubernetes Ingress-NGINX Vulnerabilities Expose Clusters25 March 2025
CVE-2025-19241 report
criticalYokogawa CENTUM VP Vulnerabilities with Critical Impact27 February 2026
CVE-2025-155771 report
criticalValmet DNA Web Tools Arbitrary File Read Vulnerability21 February 2026
CVE-2025-152841 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-128161 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2025-10981 report
criticalIngressNightmare: Critical Kubernetes Ingress-NGINX Vulnerabilities Expose Clusters25 March 2025
CVE-2025-10971 report
criticalIngressNightmare: Critical Kubernetes Ingress-NGINX Vulnerabilities Expose Clusters25 March 2025
CVE-2025-10941 report
criticalPostgreSQL Zero-Day Exploited Alongside BeyondTrust in Targeted Attacks15 February 2025
CVE-2025-02831 report
criticalCISA Issues Emergency Directive for Ivanti Connect Secure Vulnerabilities18 January 2025
CVE-2025-02822 reports
criticalCISA Issues Emergency Directive for Ivanti Connect Secure Vulnerabilities18 January 2025criticalIvanti Connect Secure Zero-Day Actively Exploited in the Wild8 January 2025
CVE-2025-01101 report
criticalPalo Alto PAN-OS Authentication Bypass Exploited in Chained Attacks14 February 2025
CVE-2025-01081 report
criticalPalo Alto PAN-OS Authentication Bypass Exploited in Chained Attacks14 February 2025
CVE-2024-XXXXX1 report
criticalLangChain Core Template Injection Leading to Remote Code Execution29 April 2026
CVE-2024-91401 report
criticalMoxa Industrial Networking Devices Impacted by Critical Vulnerabilities9 January 2025
CVE-2024-91381 report
criticalMoxa Industrial Networking Devices Impacted by Critical Vulnerabilities9 January 2025
CVE-2024-577281 report
highSimpleHelp RMM Vulnerabilities Exploited to Deploy Backdoors on Client Networks31 January 2025
CVE-2024-577271 report
highSimpleHelp RMM Vulnerabilities Exploited to Deploy Backdoors on Client Networks31 January 2025
CVE-2024-577261 report
highSimpleHelp RMM Vulnerabilities Exploited to Deploy Backdoors on Client Networks31 January 2025
CVE-2024-555911 report
criticalFortinet FortiOS Authentication Bypass Under Active Exploitation14 January 2025
CVE-2024-531041 report
highGoogle Android February Update Patches Actively Exploited Kernel Vulnerability8 February 2025
CVE-2024-419961 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2024-408911 report
highZyxel CPE Devices Under Active Attack via Command Injection Flaws4 February 2025
CVE-2024-301721 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2024-301711 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2024-298571 report
criticalSiemens SIDIS Prime Supply Chain Vulnerability Storm - 23 CVEs from Outdated Dependencies13 March 2026
CVE-2024-123561 report
criticalPostgreSQL Zero-Day Exploited Alongside BeyondTrust in Targeted Attacks15 February 2025
CVE-2023-466041 report
critical13-year-old Apache ActiveMQ RCE reaches weaponisation stage after public patch disclosure18 April 2026
CVE-2022-207751 report
criticalCritical Vulnerability in Cisco SD-WAN Systems Under Active Exploitation26 February 2026
CVE-2021-345231 report
highCISA FBI and MS-ISAC Warn of Ghost Ransomware Targeting Critical Infrastructure20 February 2025
CVE-2021-344731 report
highCISA FBI and MS-ISAC Warn of Ghost Ransomware Targeting Critical Infrastructure20 February 2025
CVE-2021-312071 report
highCISA FBI and MS-ISAC Warn of Ghost Ransomware Targeting Critical Infrastructure20 February 2025
CVE-2019-254991 report
criticalAnalysis of CVE-2019-25499: SQL Injection Vulnerability in Simple Job Script8 March 2026
CVE-2018-133791 report
highCISA FBI and MS-ISAC Warn of Ghost Ransomware Targeting Critical Infrastructure20 February 2025