Known Exploited Vulnerabilities (KEV)
ndaal KEV
| ID | Title | Severity | CVSS | EPSS | Source | Updated |
|---|---|---|---|---|---|---|
| cve-2020-28185 | CVE-2020-28185 | HIGH | N/A | 18.25% | cvelistv5 | |
| cve-2020-24914 | CVE-2020-24914 | HIGH | N/A | 4.98% | cvelistv5 | |
| cve-2019-18935 | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | CRITICAL | 9.8 | 99.74% | cvelistv5 | 2021-11-03 |
| cve-2026-23744 | REC in MCPJam inspector due to HTTP Endpoint exposes | CRITICAL | 9.8 | 67.52% | cvelistv5 | 2026-06-17 |
| cve-2026-21891 | ZimaOS has Authentication Bypass via System-Level Username | CRITICAL | 9.4 | 2.35% | cvelistv5 | 2026-06-17 |
| cve-2026-1405 | CVE-2026-1405 | CRITICAL | 9.8 | 3.18% | cvelistv5 | |
| cve-2025-8868 | CVE-2025-8868 | CRITICAL | 9.8 | 24.32% | cvelistv5 | |
| cve-2025-8085 | CVE-2025-8085 | HIGH | 8.6 | 17.37% | cvelistv5 | |
| cve-2025-68645 | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | HIGH | N/A | 48.87% | cvelistv5 | 2026-01-22 |
| cve-2025-67303 | CVE-2025-67303 | HIGH | 7.5 | 1.41% | cvelistv5 | |
| cve-2025-64095 | CVE-2025-64095 | CRITICAL | 10.0 | 44.66% | cvelistv5 | |
| cve-2025-6205 | Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability | HIGH | N/A | 73.31% | cvelistv5 | 2025-10-28 |
| cve-2025-61666 | CVE-2025-61666 | HIGH | 8.7 | 1.28% | cvelistv5 | |
| cve-2025-59287 | Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability | HIGH | N/A | 99.98% | cvelistv5 | 2025-10-24 |
| cve-2025-57819 | Sangoma FreePBX Authentication Bypass Vulnerability | CRITICAL | 10.0 | 85.46% | cvelistv5 | 2025-08-29 |
| cve-2025-55346 | Unintended dynamic code execution leads to remote code execution by network attackers | CRITICAL | 9.8 | 20.81% | cvelistv5 | 2026-06-17 |
| cve-2025-55161 | CVE-2025-55161 | HIGH | 8.6 | 2.00% | cvelistv5 | |
| cve-2025-54782 | @nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers | HIGH | 8.8 | 51.32% | cvelistv5 | 2026-06-17 |
| cve-2025-54236 | Adobe Commerce and Magento Improper Input Validation Vulnerability | CRITICAL | 9.1 | 94.53% | cvelistv5 | 2025-10-24 |
| cve-2025-54123 | SUSE CVE CVE-2025-54123 | UNKNOWN | N/A | 10.54% | cvelistv5 | 2025-09-19 |
| cve-2025-5287 | CVE-2025-5287 | HIGH | 7.5 | 2.35% | cvelistv5 | |
| cve-2025-52488 | DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input | HIGH | 8.6 | 35.76% | cvelistv5 | 2026-06-17 |
| cve-2025-5086 | Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability | HIGH | N/A | 96.91% | cvelistv5 | 2025-09-11 |
| cve-2025-49493 | Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. | MEDIUM | 5.8 | 2.38% | cvelistv5 | 2026-06-17 |
| cve-2025-47916 | CVE-2025-47916 | CRITICAL | 10.0 | 83.73% | cvelistv5 | |
| cve-2025-47539 | CVE-2025-47539 | CRITICAL | 9.8 | 27.88% | cvelistv5 | |
| cve-2025-44177 | A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences. | HIGH | 8.2 | 4.34% | cvelistv5 | 2026-06-17 |
| cve-2025-4322 | Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover | CRITICAL | 9.8 | 15.52% | cvelistv5 | 2026-06-17 |
| cve-2025-41646 | CVE-2025-41646 | HIGH | N/A | 51.55% | cvelistv5 | |
| cve-2025-4123 | SUSE CVE CVE-2025-4123 | HIGH | 7.6 | 97.01% | cvelistv5 | 2026-08-25 |