Threats & CVE Intelligence
Search the locally synchronized CISA known-exploited vulnerabilities catalog, or enter a CVE ID or keyword to search the broader NIST National Vulnerability Database. NVD searches are retrieved on demand and may be rate limited.
Last successful sync: 2026-11-06 21:02:26 UTC · Source catalog updated: 2026-11-06T19:44:45.1797Z · 1769 records in latest import.
CISA Known Exploited Vulnerabilities · 1769 matches
Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft — SQL Server
Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
CVE-2015-5287 · KEV 2026-08-26Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
Red Hat — Automatic Bug Reporting Tool
Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(…
CVE-2015-3246 · KEV 2026-08-26Red Hat Libuser Race Condition Vulnerability
Red Hat — Libuser
Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.
CVE-2026-60004 · KEV 2026-08-25Gitea Code Injection Vulnerability
Gitea — Gitea
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
CVE-2026-21962 · KEV 2026-08-24Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Oracle — HTTP Server and Oracle Weblogic Server Proxy Plug-in
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critic…
CVE-2026-73570 · KEV 2026-08-21Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Synacor — Zimbra Collaboration Suite (ZCS)
Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the…
CVE-2026-72530 · KEV 2026-08-20TrueConf Server Code Injection Vulnerability
TrueConf — Server
TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary …
CVE-2026-72529 · KEV 2026-08-20TrueConf Server Missing Authentication for Critical Function Vulnerability
TrueConf — Server
TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.
CVE-2026-64849 · KEV 2026-08-19MLflow Server-Side Request Forgery Vulnerability
MLflow — MLflow
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
CVE-2026-65400 · KEV 2026-08-18Apple macOS Improper Authentication Vulnerability
Apple — macOS
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
CVE-2026-59310 · KEV 2026-08-18Broadcom VMware vCenter Path Traversal Vulnerability
Broadcom — VMware vCenter
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
Ransomware use reportedCVE-2026-55040 · KEV 2026-08-18Microsoft SharePoint Weak Authentication Vulnerability
Microsoft — SharePoint
Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-33824 · KEV 2026-08-18Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
Microsoft — Internet Key Exchange (IKE) Service Extensions
Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.
CVE-2025-62593 · KEV 2026-08-17Ray-Project Ray Code Injection Vulnerability
Ray-Project — Ray
Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.
CVE-2026-72898 · KEV 2026-08-11Metabase SQL Injection Vulnerability
Metabase — Metabase
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacke…
CVE-2026-68820 · KEV 2026-08-11Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
Microsoft — Windows Ancillary Function Driver for WinSock
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
CVE-2026-20349 · KEV 2026-08-11Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
Cisco — Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, result…
CVE-2026-8037 · KEV 2026-08-07Progress LoadMaster Command Injection Vulnerability
Progress — LoadMaster
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
CVE-2026-63077 · KEV 2026-08-05JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrains — TeamCity
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
Ransomware use reportedCVE-2026-9198 · KEV 2026-08-04IBM Langflow Code Injection Vulnerability
IBM — Langflow
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
CVE-2026-34486 · KEV 2026-08-04Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Apache — Tomcat
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
CVE-2026-18556 · KEV 2026-08-04N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able — N-central
N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.
CVE-2026-18577 · KEV 2026-08-03N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able — N-central
N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.
CVE-2026-20316 · KEV 2026-07-29Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Cisco — Secure Firewall Management Center (FMC)
Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low…
Ransomware use reportedCVE-2026-16812 · KEV 2026-07-27Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
Arista — VeloCloud Orchestrator
Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidenti…
CVE-2025-68686 · KEV 2026-07-27Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Fortinet — FortiOS
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in so…
CVE-2026-50522 · KEV 2026-07-22Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft — SharePoint
Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.
CVE-2026-16232 · KEV 2026-07-22Check Point SmartConsole Improper Authentication Vulnerability
Check Point — SmartConsole
Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
CVE-2026-63030 · KEV 2026-07-21WordPress Core Interpretation Conflict Vulnerability
WordPress — Core
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
CVE-2026-60137 · KEV 2026-07-21WordPress Core SQL Injection Vulnerability
WordPress — Core
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution o…
Source: CISA KEV catalog and NIST NVD. “Known” ransomware use is a CISA catalog label, not a real-time incident alert. Always review vendor advisories for patches.