Vulnerabilities CISA has confirmed as actively exploited. Prioritize these for remediation.
Vulnerabilities newly added to CISA KEV in the last 7 days.
| CVE ID | Title | Severity | Added |
|---|---|---|---|
| Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | CRITICAL | 2026. 07. 16. | |
| A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests | CRITICAL |
| CVE ID | Title | Severity | References | Ransom | |||||
|---|---|---|---|---|---|---|---|---|---|
| Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request. | HIGH | 7.5v3.1 |
| 2026. 07. 16. |
| CVE-2026-39808 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here> | CRITICAL | 2026. 07. 16. |
| CVE-2026-46817 | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C | CRITICAL | 2026. 07. 15. |
| CVE-2023-4346 | KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX instal | HIGH | 2026. 07. 15. |
53.7% |
KEV |
| 2014. 05. 07. |
| 2022. 03. 25. |
| — |
| CVE-2013-5223 | Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunit | MEDIUM | 5.4v3.1 | 81 | 33.6% | KEV | 2013. 11. 19. | 2022. 03. 25. | — |
| CVE-2013-4810 | HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874. | CRITICAL | 9.8v3.1 | 100 | 79.0% | KEV | 2013. 09. 16. | 2022. 03. 25. | — |
| CVE-2013-2251 | Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. | CRITICAL | 9.8v3.1 | 100 | 100.0% | KEV | 2013. 07. 20. | 2022. 03. 25. | — |
| CVE-2012-1823 | sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. | CRITICAL | 9.8v3.1 | 100 | 100.0% | KEV | 2012. 05. 11. | 2022. 03. 25. | — |
| CVE-2010-4345 | Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive. | HIGH | 7.8v3.1 | 100 | 17.8% | KEV | 2010. 12. 14. | 2022. 03. 25. | — |
| CVE-2010-4344 | Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging. | CRITICAL | 9.8v3.1 | 100 | 71.9% | KEV | 2010. 12. 14. | 2022. 03. 25. | — |
| CVE-2010-3035 | Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to cause a denial of service (peering reset) via a crafted prefix announcement, as demonstrated in the wild in August 2010 with attribute type code 99, aka Bug ID CSCti62211. | HIGH | 7.5v3.1 | 100 | 5.6% | KEV | 2010. 08. 30. | 2022. 03. 25. | — |
| CVE-2010-2861 | Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/. | CRITICAL | 9.8v3.1 | 100 | 99.7% | KEV | 2010. 08. 11. | 2022. 03. 25. | ⚠️ |
| CVE-2009-2055 | Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009. | MEDIUM | 5.9v3.1 | 88.50 | 3.3% | KEV | 2009. 08. 19. | 2022. 03. 25. | — |
| CVE-2009-1151 | Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. | CRITICAL | 9.8v3.1 | 100 | 95.4% | KEV | 2009. 03. 26. | 2022. 03. 25. | — |
| CVE-2009-0927 | Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different vulnerability than CVE-2009-0658. | HIGH | 8.8v3.1 | 100 | 96.6% | KEV | 2009. 03. 19. | 2022. 03. 25. | — |
| CVE-2005-2773 | HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl. | CRITICAL | 9.8v3.1 | 100 | 74.1% | KEV | 2005. 09. 02. | 2022. 03. 25. | — |
| CVE-2019-10068 | — | — | — | 82.50 | 96.0% | KEV | — | 2022. 03. 25. | — |
| CVE-2021-22941 | — | — | — | 87.50 | 53.6% | KEV | — | 2022. 03. 25. | ⚠️ |
| CVE-2020-25223 | — | — | — | 82.50 | 96.7% | KEV | — | 2022. 03. 25. | — |
| CVE-2018-11138 | — | — | — | 87.50 | 91.9% | KEV | — | 2022. 03. 25. | ⚠️ |
| CVE-2019-2616 | — | — | — | 82.50 | 92.2% | KEV | — | 2022. 03. 25. | — |
| CVE-2020-7247 | — | — | — | 82.50 | 98.9% | KEV KISA | — | 2022. 03. 25. | — |
| CVE-2020-1631 | — | — | — | 82.50 | 4.7% | KEV | — | 2022. 03. 25. | — |