Known Exploited Vulnerabilities (KEV)
ndaal KEV
| ID | Title | Severity | CVSS | EPSS | Source | Updated |
|---|---|---|---|---|---|---|
| cve-2026-42271 | BerriAI LiteLLM Command Injection Vulnerability | HIGH | N/A | N/A | cvelistv5 | 2026-06-08 |
| cve-2026-3836 | SUSE CVE CVE-2026-3836 | UNKNOWN | N/A | N/A | cvelistv5 | 2026-03-11 |
| cve-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | CRITICAL | 9.8 | N/A | cvelistv5 | 2026-06-12 |
| cve-2026-34910 | Ubiquiti UniFi OS Improper Input Validation Vulnerability | CRITICAL | 10.0 | N/A | cvelistv5 | 2026-06-23 |
| cve-2026-28496 | CVE-2026-28496 | CRITICAL | 9.4 | N/A | cvelistv5 | |
| cve-2026-28409 | CVE-2026-28409 | CRITICAL | 10.0 | N/A | cvelistv5 | |
| cve-2026-2699 | CVE-2026-2699 | CRITICAL | 9.8 | N/A | cvelistv5 | |
| cve-2026-2652 | mlflow: mlflow: Authentication bypass allows unauthorized job management and data injection | HIGH | 8.6 | N/A | cvelistv5 | 2026-07-08 |
| cve-2026-22679 | CVE-2026-22679 | CRITICAL | 9.8 | N/A | cvelistv5 | |
| cve-2026-20253 | Splunk Enterprise Missing Authentication for Critical Function Vulnerability | CRITICAL | 9.8 | N/A | cvelistv5 | 2026-06-18 |
| cve-2026-1547 | Totolink A7000R cstecgi.cgi setUnloadUserData command injection | MEDIUM | 6.3 | N/A | cvelistv5 | 2026-06-17 |
| cve-2026-1207 | Django: Django: SQL Injection via RasterField band index parameter | HIGH | 8.3 | N/A | cvelistv5 | 2026-07-15 |
| cve-2025-60702 | CVE-2025-60702 | MEDIUM | 6.5 | N/A | cvelistv5 | |
| cve-2025-10164 | CVE-2025-10164 | HIGH | 7.5 | N/A | cvelistv5 | |
| cve-2024-12912 | CVE-2024-12912 | HIGH | 7.2 | N/A | cvelistv5 | |
| cve-2023-39470 | CVE-2023-39470 | HIGH | 7.2 | N/A | cvelistv5 | |
| cve-2023-39361 | SUSE CVE CVE-2023-39361 | CRITICAL | 9.8 | N/A | cvelistv5 | 2026-08-26 |
| cve-2023-3722 | CVE-2023-3722 | HIGH | 8.6 | N/A | cvelistv5 | |
| cve-2022-50992 | CVE-2022-50992 | HIGH | 8.7 | N/A | cvelistv5 | |
| cve-2022-4995 | Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauth... | CRITICAL | 9.3 | N/A | cvelistv5 | 2026-09-16 |
| cve-2021-27691 | CVE-2021-27691 | HIGH | N/A | N/A | cvelistv5 | |
| cve-2019-25765 | ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote att... | HIGH | 8.7 | N/A | cvelistv5 | 2026-09-10 |
| cve-2019-12725 | Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. | CRITICAL | 9.8 | N/A | cvelistv5 | 2026-06-17 |
| cve-2019-10655 | CVE-2019-10655 | HIGH | N/A | N/A | cvelistv5 | |
| cve-2025-53770 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | CRITICAL | 9.8 | N/A | cvelistv5 | 2025-07-20 |
| cve-2026-21509 | Microsoft Office Security Feature Bypass Vulnerability | HIGH | N/A | N/A | cvelistv5 | 2026-01-26 |
| cve-2023-28771 | Zyxel Multiple Firewalls OS Command Injection Vulnerability | CRITICAL | 9.8 | N/A | cvelistv5 | 2023-05-31 |
| cve-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | HIGH | N/A | N/A | cvelistv5 | 2026-04-08 |
| cve-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | HIGH | N/A | N/A | cvelistv5 | 2026-01-29 |
| cve-2026-86060 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | CRITICAL | 9.2 | N/A | cvelistv5 | 2026-09-10 |