Known Exploited Vulnerabilities (KEV)
ndaal KEV
| ID | Title | Severity | CVSS | EPSS | Source | Updated |
|---|---|---|---|---|---|---|
| cve-2017-17106 | Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request. This vulnerability exists because of a lack of authentication checks in requests to CGI pages. | CRITICAL | 9.8 | 15.26% | cvelistv5 | 2026-06-17 |
| cve-2014-9727 | CVE-2014-9727 | HIGH | N/A | 71.67% | cvelistv5 | |
| cve-2013-1599 | CVE-2013-1599 | HIGH | N/A | 40.35% | cvelistv5 | |
| cve-2023-27076 | CVE-2023-27076 | CRITICAL | 9.8 | 22.93% | cvelistv5 | |
| cve-2023-26360 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | HIGH | 8.6 | 97.34% | cvelistv5 | 2023-03-15 |
| cve-2023-0297 | CVE-2023-0297 | CRITICAL | 9.8 | 95.91% | cvelistv5 | |
| cve-2021-46442 | In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization. | CRITICAL | 9.8 | 56.06% | cvelistv5 | 2026-06-17 |
| cve-2021-43798 | Grafana Path Traversal Vulnerability | HIGH | N/A | 88.50% | cvelistv5 | 2025-10-09 |
| cve-2020-6308 | CVE-2020-6308 | MEDIUM | 5.3 | 61.74% | cvelistv5 | |
| cve-2020-15916 | CVE-2020-15916 | HIGH | N/A | 3.43% | cvelistv5 | |
| cve-2020-13483 | CVE-2020-13483 | HIGH | N/A | 4.51% | cvelistv5 | |
| cve-2019-17621 | D-Link DIR-859 Router Command Execution Vulnerability | CRITICAL | 9.8 | 89.62% | cvelistv5 | 2023-06-29 |
| cve-2019-12988 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6). | CRITICAL | 9.8 | 42.55% | cvelistv5 | 2026-06-17 |
| cve-2019-11043 | PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability | CRITICAL | N/A | 99.78% | cvelistv5 | 2022-03-25 |
| cve-2018-0125 | Cisco VPN Routers Remote Code Execution Vulnerability | CRITICAL | 9.8 | 55.19% | cvelistv5 | 2022-03-25 |
| cve-2013-5948 | CVE-2013-5948 | HIGH | N/A | 9.52% | cvelistv5 | |
| cve-2023-32315 | Ignite Realtime Openfire Path Traversal Vulnerability | HIGH | 8.6 | 100.00% | cvelistv5 | 2023-08-24 |
| cve-2023-25717 | Multiple Ruckus Wireless Products CSRF and RCE Vulnerability | CRITICAL | 9.8 | 98.07% | cvelistv5 | 2023-05-12 |
| cve-2023-24489 | Citrix Content Collaboration ShareFile Improper Access Control Vulnerability | CRITICAL | 9.8 | 97.34% | cvelistv5 | 2023-08-16 |
| cve-2022-42953 | CVE-2022-42953 | HIGH | 7.5 | 4.83% | cvelistv5 | |
| cve-2022-3982 | Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload | CRITICAL | 9.8 | 4.54% | cvelistv5 | 2026-06-17 |
| cve-2022-25075 | CVE-2022-25075 | HIGH | N/A | 56.25% | cvelistv5 | |
| cve-2022-1950 | Youzify < 1.2.0 - Unauthenticated SQLi | CRITICAL | 9.8 | 5.51% | cvelistv5 | 2026-06-17 |
| cve-2022-0482 | CVE-2022-0482 | CRITICAL | 9.1 | 43.75% | cvelistv5 | |
| cve-2020-24219 | CVE-2020-24219 | HIGH | N/A | 23.64% | cvelistv5 | |
| cve-2019-19356 | Netis WF2419 Devices Remote Code Execution Vulnerability | HIGH | 7.5 | 28.17% | cvelistv5 | 2021-11-03 |
| cve-2018-17283 | Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter. | HIGH | 7.5 | 66.35% | cvelistv5 | 2026-06-17 |
| cve-2017-7876 | CVE-2017-7876 | CRITICAL | 10.0 | 3.34% | cvelistv5 | |
| cve-2014-6271 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | HIGH | N/A | 100.00% | cvelistv5 | 2022-01-28 |
| cve-2023-6553 | CVE-2023-6553 | CRITICAL | 9.8 | 97.85% | cvelistv5 |