| CVE-2026-22719 Known exploited | High 8.1 | VMware Aria Operations command injection vulnerability Assigned by vmware | Feb 25, 2026 |
| CVE-2026-20122 Known exploited | Medium 5.4 | Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability Assigned by cisco | Feb 25, 2026 |
| CVE-2026-20127 Known exploited | Critical 10.0 | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability Assigned by cisco | Feb 25, 2026 |
| CVE-2026-20128 Known exploited | High 7.5 | Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability Assigned by cisco | Feb 25, 2026 |
| CVE-2026-20133 Known exploited | Medium 6.5 | A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. Assigned by cisco | Feb 25, 2026 |
| CVE-2026-22769 Known exploited | Critical 10.0 | Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. Assigned by dell | Feb 17, 2026 |
| CVE-2026-2441 Known exploited | High 8.8 | Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Assigned by Chrome | Feb 13, 2026 |
| CVE-2026-25108 Known exploited | High 8.7 | FileZen contains an OS command injection vulnerability. Assigned by jpcert | Feb 13, 2026 |
| CVE-2026-20700 Known exploited | High 7.8 | A memory corruption issue was addressed with improved state management. Assigned by apple | Feb 11, 2026 |
| CVE-2026-21525 Known exploited | Medium 6.2 | Windows Remote Access Connection Manager Denial of Service Vulnerability Assigned by microsoft | Feb 10, 2026 |
| CVE-2026-21514 Known exploited | High 7.8 | Microsoft Word Security Feature Bypass Vulnerability Assigned by microsoft | Feb 10, 2026 |
| CVE-2026-21510 Known exploited | High 8.8 | Windows Shell Security Feature Bypass Vulnerability Assigned by microsoft | Feb 10, 2026 |
| CVE-2026-21513 Known exploited | High 8.8 | MSHTML Framework Security Feature Bypass Vulnerability Assigned by microsoft | Feb 10, 2026 |
| CVE-2026-21533 Known exploited | High 7.8 | Windows Remote Desktop Services Elevation of Privilege Vulnerability Assigned by microsoft | Feb 10, 2026 |
| CVE-2026-21519 Known exploited | High 7.8 | Desktop Window Manager Elevation of Privilege Vulnerability Assigned by microsoft | Feb 10, 2026 |
| CVE-2025-68686 Known exploited | Medium 5.3 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, For… Assigned by fortinet | Feb 10, 2026 |
| CVE-2026-1603 Known exploited | High 8.6 | An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data. Assigned by ivanti | Feb 10, 2026 |
| CVE-2026-1731 Known exploited | Critical 9.9 | Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) Assigned by BT | Feb 6, 2026 |
| CVE-2026-21643 Known exploited | Critical 9.1 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized co… Assigned by fortinet | Feb 6, 2026 |
| CVE-2025-15556 Known exploited | High 7.7 | Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification Assigned by VulnCheck | Feb 3, 2026 |
| CVE-2026-1340 Known exploited | Critical 9.8 | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. Assigned by ivanti | Jan 29, 2026 |
| CVE-2026-1281 Known exploited | Critical 9.8 | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. Assigned by ivanti | Jan 29, 2026 |
| CVE-2025-40551 Known exploited | Critical 9.8 | SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability Assigned by SolarWinds | Jan 28, 2026 |
| CVE-2025-40536 Known exploited | High 8.1 | SolarWinds Web Help Desk Security Control Bypass Vulnerability Assigned by SolarWinds | Jan 28, 2026 |
| CVE-2026-24858 Known exploited | Critical 9.4 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0… Assigned by fortinet | Jan 27, 2026 |
| CVE-2026-21509 Known exploited | High 7.8 | Microsoft Office Security Feature Bypass Vulnerability Assigned by microsoft | Jan 26, 2026 |
| CVE-2026-24423 Known exploited | Critical 9.3 | SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API Assigned by VulnCheck | Jan 23, 2026 |
| CVE-2026-0770 Known exploited | Critical 9.8 | Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability Assigned by zdi | Jan 23, 2026 |
| CVE-2026-23760 Known exploited | Critical 9.3 | SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API Assigned by VulnCheck | Jan 22, 2026 |
| CVE-2026-20045 Known exploited | High 8.2 | Cisco Unified Communications Products Remote Code Execution Vulnerability Assigned by cisco | Jan 21, 2026 |
| CVE-2026-24061 Known exploited | Critical 9.8 | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. Assigned by mitre | Jan 21, 2026 |
| CVE-2026-21962 Known exploited | Critical 10.0 | Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Pro… Assigned by oracle | Jan 20, 2026 |
| CVE-2026-20963 Known exploited | Critical 9.8 | Microsoft SharePoint Remote Code Execution Vulnerability Assigned by microsoft | Jan 13, 2026 |
| CVE-2026-20805 Known exploited | Medium 5.5 | Desktop Window Manager Information Disclosure Vulnerability Assigned by microsoft | Jan 13, 2026 |
| CVE-2025-25249 Known exploited | High 7.4 | A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions,… Assigned by fortinet | Jan 13, 2026 |
| CVE-2025-66376 Known exploited | High 7.2 | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message. Assigned by mitre | Jan 5, 2026 |
| CVE-2025-52691 Known exploited | Critical 10.0 | Upload Arbitrary Files Assigned by CSA | Dec 29, 2025 |
| CVE-2025-68645 Known exploited | High 8.8 | A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFil… Assigned by mitre | Dec 22, 2025 |
| CVE-2025-68613 Known exploited | Critical 10.0 | n8n Vulnerable to Remote Code Execution via Expression Injection Assigned by GitHub_M | Dec 19, 2025 |
| CVE-2025-14847 Known exploited | High 7.5 | Zlib compressed protocol header length confusion may allow memory read Assigned by mongodb | Dec 19, 2025 |
| CVE-2025-14733 Known exploited | Critical 9.3 | WatchGuard Firebox iked Out of Bounds Write Vulnerability Assigned by WatchGuard | Dec 19, 2025 |
| CVE-2025-40602 Known exploited | Medium 6.6 | A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC). Assigned by sonicwall | Dec 18, 2025 |
| CVE-2025-68461 Known exploited | High 7.2 | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. Assigned by mitre | Dec 18, 2025 |
| CVE-2025-43529 Known exploited | High 8.8 | A use-after-free issue was addressed with improved memory management. Assigned by apple | Dec 17, 2025 |
| CVE-2025-20393 Known exploited | Critical 10.0 | Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability Assigned by cisco | Dec 17, 2025 |
| CVE-2025-59374 Known exploited | Critical 9.3 | "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. Assigned by ASUS | Dec 17, 2025 |
| CVE-2025-37164 Known exploited | Critical 10.0 | A remote code execution issue exists in HPE OneView. Assigned by hpe | Dec 16, 2025 |
| CVE-2025-14611 Known exploited | High 7.1 | Gladinet CentreStack and TrioFox Hard Coded AES Keys Assigned by Huntress | Dec 12, 2025 |
| CVE-2025-43510 Known exploited | High 7.8 | A memory corruption issue was addressed with improved lock state checking. Assigned by apple | Dec 12, 2025 |
| CVE-2025-43520 Known exploited | Medium 5.5 | A memory corruption issue was addressed with improved memory handling. Assigned by apple | Dec 12, 2025 |
