Vulnerabilities CISA has confirmed as actively exploited. Prioritize these for remediation.
Vulnerabilities newly added to CISA KEV in the last 7 days.
| CVE ID | Title | Severity | Added |
|---|---|---|---|
| Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | CRITICAL | 2026. 07. 16. | |
| A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests | CRITICAL |
| CVE ID | Title | Severity | References | Ransom | |||||
|---|---|---|---|---|---|---|---|---|---|
| Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provide | CRITICAL |
| 2026. 07. 16. |
| CVE-2026-39808 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here> | CRITICAL | 2026. 07. 16. |
| CVE-2026-46817 | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C | CRITICAL | 2026. 07. 15. |
| CVE-2023-4346 | KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX instal | HIGH | 2026. 07. 15. |
100 |
88.0% |
KEV KISA |
| 2014. 04. 27. |
| 2022. 01. 28. |
| — |
| CVE-2021-20038 | — | — | — | 87.50 | 99.9% | KEV | — | 2022. 01. 28. | ⚠️ |
| CVE-2020-0787 | — | — | — | 87.50 | 42.5% | KEV KISA | — | 2022. 01. 28. | ⚠️ |
| CVE-2020-5722 | — | — | — | 82.50 | 83.9% | KEV | — | 2022. 01. 28. | — |
| CVE-2018-8453 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. | HIGH | 7.8v3.1 | 100 | 69.8% | KEV | 2018. 10. 10. | 2022. 01. 21. | ⚠️ |
| CVE-2012-0391 | The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter. | CRITICAL | 9.8v3.1 | 100 | 75.1% | KEV | 2012. 01. 08. | 2022. 01. 21. | — |
| CVE-2006-1547 | ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils. | HIGH | 7.5v3.1 | 100 | 54.6% | KEV | 2006. 03. 30. | 2022. 01. 21. | — |
| CVE-2021-35247 | — | — | — | 82.50 | 3.4% | KEV | — | 2022. 01. 21. | — |
| CVE-2021-32648 | octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. | HIGH | 8.2v3.1 | 100 | 90.4% | KEV | 2021. 08. 26. | 2022. 01. 18. | — |
| CVE-2021-21315 | Command Injection Vulnerability | HIGH | 7.8v3.1 | 100 | 90.2% | KEV | 2021. 02. 16. | 2022. 01. 18. | — |
| CVE-2021-25298 | Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. | HIGH | 8.8v3.1 | 100 | 75.0% | KEV | 2021. 02. 15. | 2022. 01. 18. | — |
| CVE-2021-25297 | Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. | HIGH | 8.8v3.1 | 100 | 56.4% | KEV | 2021. 02. 15. | 2022. 01. 18. | — |
| CVE-2021-25296 | Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. | HIGH | 8.8v3.1 | 100 | 71.5% | KEV | 2021. 02. 15. | 2022. 01. 18. | — |
| CVE-2020-13671 | Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74. | HIGH | 8.8v3.1 | 100 | 4.3% | KEV | 2020. 11. 20. | 2022. 01. 18. | — |
| CVE-2020-13927 | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.den | CRITICAL | 9.8v3.1 | 100 | 99.7% | KEV | 2020. 11. 10. | 2022. 01. 18. | — |
| CVE-2020-14864 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Busines | HIGH | 7.5v3.1 | 100 | 97.2% | KEV | 2020. 10. 21. | 2022. 01. 18. | — |
| CVE-2020-11978 | An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable. | HIGH | 8.8v3.1 | 100 | 99.1% | KEV | 2020. 07. 17. | 2022. 01. 18. | — |
| CVE-2021-22991 | — | — | — | 82.50 | 61.1% | KEV | — | 2022. 01. 18. | — |
| CVE-2021-33766 | — | — | — | 82.50 | 97.5% | KEV | — | 2022. 01. 18. | — |
| CVE-2021-21975 | — | — | — | 87.50 | 78.3% | KEV | — | 2022. 01. 18. | ⚠️ |