Known Exploited Vulnerabilities (KEV)
ndaal KEV
| ID | Title | Severity | CVSS | EPSS | Source | Updated |
|---|---|---|---|---|---|---|
| cve-2020-3452 | Cisco ASA and FTD Read-Only Path Traversal Vulnerability | HIGH | 7.5 | 99.99% | cvelistv5 | 2021-11-03 |
| cve-2020-27986 | CVE-2020-27986 | HIGH | 7.5 | 15.97% | cvelistv5 | |
| cve-2020-23575 | CVE-2020-23575 | HIGH | N/A | 36.77% | cvelistv5 | |
| cve-2020-21650 | CVE-2020-21650 | HIGH | N/A | 3.23% | cvelistv5 | |
| cve-2020-20300 | CVE-2020-20300 | HIGH | N/A | 8.75% | cvelistv5 | |
| cve-2020-19625 | CVE-2020-19625 | HIGH | N/A | 13.14% | cvelistv5 | |
| cve-2020-17519 | Apache Flink Improper Access Control Vulnerability | HIGH | N/A | 97.81% | cvelistv5 | 2024-05-23 |
| cve-2020-17506 | CVE-2020-17506 | HIGH | N/A | 93.97% | cvelistv5 | |
| cve-2020-17496 | vBulletin PHP Module Remote Code Execution Vulnerability | CRITICAL | 9.8 | 87.74% | cvelistv5 | 2021-11-03 |
| cve-2020-16139 | CVE-2020-16139 | HIGH | N/A | 79.77% | cvelistv5 | |
| cve-2020-15920 | CVE-2020-15920 | HIGH | N/A | 98.24% | cvelistv5 | |
| cve-2020-15568 | CVE-2020-15568 | HIGH | N/A | 28.98% | cvelistv5 | |
| cve-2020-15505 | Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability | CRITICAL | 9.8 | 99.74% | cvelistv5 | 2021-11-03 |
| cve-2020-14864 | Oracle Business Intelligence Enterprise Edition Path Transversal | HIGH | 7.5 | 97.23% | cvelistv5 | 2022-01-18 |
| cve-2020-12124 | CVE-2020-12124 | HIGH | N/A | 74.65% | cvelistv5 | |
| cve-2020-11738 | WordPress Snap Creek Duplicator Plugin File Download Vulnerability | HIGH | 7.5 | 97.82% | cvelistv5 | 2021-11-03 |
| cve-2020-10546 | CVE-2020-10546 | HIGH | N/A | 87.33% | cvelistv5 | |
| cve-2020-10199 | Sonatype Nexus Repository Remote Code Execution Vulnerability | HIGH | 8.8 | 99.06% | cvelistv5 | 2021-11-03 |
| cve-2020-10173 | CVE-2020-10173 | HIGH | N/A | 77.13% | cvelistv5 | |
| cve-2020-10148 | SolarWinds Orion Authentication Bypass Vulnerability | CRITICAL | 9.8 | 91.98% | cvelistv5 | 2021-11-03 |
| cve-2019-9874 | Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability | CRITICAL | 9.8 | 83.74% | cvelistv5 | 2025-03-26 |
| cve-2019-9762 | A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication. | CRITICAL | 9.8 | 6.04% | cvelistv5 | 2026-06-17 |
| cve-2019-9670 | Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference | CRITICAL | 9.8 | 99.99% | cvelistv5 | 2022-01-10 |
| cve-2019-8442 | CVE-2019-8442 | HIGH | N/A | 59.83% | cvelistv5 | |
| cve-2019-7254 | CVE-2019-7254 | HIGH | N/A | 82.29% | cvelistv5 | |
| cve-2019-7238 | Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability | CRITICAL | 9.8 | 77.15% | cvelistv5 | 2021-12-10 |
| cve-2019-7192 | QNAP Photo Station Improper Access Control Vulnerability | CRITICAL | N/A | 88.10% | cvelistv5 | 2022-06-08 |
| cve-2019-5434 | An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0. | CRITICAL | 9.8 | 57.02% | cvelistv5 | 2026-06-17 |
| cve-2019-5129 | CVE-2019-5129 | CRITICAL | 10.0 | 38.53% | cvelistv5 | |
| cve-2019-5128 | CVE-2019-5128 | CRITICAL | 10.0 | 30.17% | cvelistv5 |