Known Exploited Vulnerabilities (KEV)
ndaal KEV
| ID | Title | Severity | CVSS | EPSS | Source | Updated |
|---|---|---|---|---|---|---|
| cve-2026-3836 | SUSE CVE CVE-2026-3836 | UNKNOWN | N/A | N/A | cvelistv5 | 2026-03-11 |
| cve-2026-34910 | Ubiquiti UniFi OS Improper Input Validation Vulnerability | CRITICAL | 10.0 | 87.47% | cvelistv5 | 2026-06-23 |
| cve-2026-29059 | CVE-2026-29059 | MEDIUM | 6.9 | 2.94% | cvelistv5 | |
| cve-2026-28496 | CVE-2026-28496 | CRITICAL | 9.4 | 1.91% | cvelistv5 | |
| cve-2026-28409 | CVE-2026-28409 | CRITICAL | 10.0 | 3.31% | cvelistv5 | |
| cve-2026-2699 | CVE-2026-2699 | CRITICAL | 9.8 | 59.51% | cvelistv5 | |
| cve-2026-2652 | mlflow: mlflow: Authentication bypass allows unauthorized job management and data injection | HIGH | 8.6 | 20.78% | cvelistv5 | 2026-07-08 |
| cve-2026-20253 | Splunk Enterprise Missing Authentication for Critical Function Vulnerability | CRITICAL | 9.8 | 96.94% | cvelistv5 | 2026-06-18 |
| cve-2026-1547 | Totolink A7000R cstecgi.cgi setUnloadUserData command injection | MEDIUM | 6.3 | 2.88% | cvelistv5 | 2026-06-17 |
| cve-2026-1207 | Django: Django: SQL Injection via RasterField band index parameter | HIGH | 8.3 | 13.25% | cvelistv5 | 2026-07-15 |
| cve-2025-60702 | CVE-2025-60702 | MEDIUM | 6.5 | 2.54% | cvelistv5 | |
| cve-2025-60698 | CVE-2025-60698 | HIGH | 7.3 | 3.93% | cvelistv5 | |
| cve-2025-10164 | CVE-2025-10164 | HIGH | 7.5 | 0.40% | cvelistv5 | |
| cve-2024-12912 | CVE-2024-12912 | HIGH | 7.2 | 1.24% | cvelistv5 | |
| cve-2024-0250 | CVE-2024-0250 | MEDIUM | 6.1 | 1.25% | cvelistv5 | |
| cve-2023-39470 | CVE-2023-39470 | HIGH | 7.2 | 1.76% | cvelistv5 | |
| cve-2023-39361 | SUSE CVE CVE-2023-39361 | CRITICAL | 9.8 | 88.79% | cvelistv5 | 2026-08-26 |
| cve-2023-3722 | CVE-2023-3722 | HIGH | 8.6 | 3.86% | cvelistv5 | |
| cve-2022-50992 | CVE-2022-50992 | HIGH | 8.7 | 0.70% | cvelistv5 | |
| cve-2021-27691 | CVE-2021-27691 | HIGH | N/A | 25.18% | cvelistv5 | |
| cve-2021-2109 | CVE-2021-2109 | HIGH | 7.2 | 70.45% | cvelistv5 | |
| cve-2019-12725 | Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. | CRITICAL | 9.8 | 89.85% | cvelistv5 | 2026-06-17 |
| cve-2019-10655 | CVE-2019-10655 | HIGH | N/A | 15.47% | cvelistv5 | |
| cve-2018-14013 | Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients. | MEDIUM | 6.1 | 7.44% | cvelistv5 | 2026-06-17 |
| cve-2026-21509 | Microsoft Office Security Feature Bypass Vulnerability | HIGH | N/A | 72.55% | cvelistv5 | 2026-01-26 |
| cve-2025-53770 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | CRITICAL | 9.8 | 100.00% | cvelistv5 | 2025-07-20 |
| cve-2023-28771 | Zyxel Multiple Firewalls OS Command Injection Vulnerability | CRITICAL | 9.8 | 99.28% | cvelistv5 | 2023-05-31 |
| cve-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | HIGH | N/A | 98.68% | cvelistv5 | 2026-04-08 |
| cve-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | HIGH | N/A | 98.58% | cvelistv5 | 2026-01-29 |
| cve-2025-53770 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | CRITICAL | 9.8 | 100.00% | cvelistv5 | 2025-07-20 |