Known Exploited Vulnerabilities (KEV)
ndaal KEV
| ID | Title | Severity | CVSS | EPSS | Source | Updated |
|---|---|---|---|---|---|---|
| cve-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | HIGH | N/A | 98.68% | cvelistv5 | 2026-04-08 |
| cve-2026-8054 | CVE-2026-8054 | CRITICAL | 10.0 | 1.58% | cvelistv5 | |
| cve-2026-8037 | Progress LoadMaster Command Injection Vulnerability | CRITICAL | 9.6 | 99.57% | cvelistv5 | 2026-08-07 |
| cve-2026-78141 | A vulnerability has been found in Tenda CH22 1.0.0.1 | LOW | 2.1 | 1.07% | cvelistv5 | 2026-08-27 |
| cve-2026-76904 | GeoTools is an open source Java library that provides tools for geospatial data | CRITICAL | 9.8 | 1.79% | cvelistv5 | 2026-09-09 |
| cve-2026-73570 | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | HIGH | 8.9 | 32.38% | cvelistv5 | 2026-08-21 |
| cve-2026-72898 | Metabase SQL Injection Vulnerability | CRITICAL | 10.0 | 94.22% | cvelistv5 | 2026-08-11 |
| cve-2026-54066 | SUSE CVE CVE-2026-54066 | UNKNOWN | N/A | 2.39% | cvelistv5 | 2026-07-30 |
| cve-2026-5153 | CVE-2026-5153 | MEDIUM | 6.5 | 3.30% | cvelistv5 | |
| cve-2026-50522 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | CRITICAL | 9.8 | 85.40% | cvelistv5 | 2026-07-22 |
| cve-2026-48313 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted ... | CRITICAL | 9.3 | 2.95% | cvelistv5 | 2026-08-28 |
| cve-2026-48282 | Adobe ColdFusion Path Traversal Vulnerability | CRITICAL | 10.0 | 42.39% | cvelistv5 | 2026-07-07 |
| cve-2026-4631 | cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection | CRITICAL | 9.8 | 15.48% | cvelistv5 | 2026-08-04 |
| cve-2026-45298 | SUSE CVE CVE-2026-45298 | UNKNOWN | N/A | 1.49% | cvelistv5 | 2026-07-30 |
| cve-2026-42271 | BerriAI LiteLLM Command Injection Vulnerability | HIGH | N/A | 83.59% | cvelistv5 | 2026-06-08 |
| cve-2026-3836 | SUSE CVE CVE-2026-3836 | UNKNOWN | N/A | N/A | cvelistv5 | 2026-03-11 |
| cve-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | CRITICAL | 9.8 | 95.47% | cvelistv5 | 2026-06-12 |
| cve-2026-34910 | Ubiquiti UniFi OS Improper Input Validation Vulnerability | CRITICAL | 10.0 | 87.47% | cvelistv5 | 2026-06-23 |
| cve-2026-29059 | CVE-2026-29059 | MEDIUM | 6.9 | 2.94% | cvelistv5 | |
| cve-2026-28496 | CVE-2026-28496 | CRITICAL | 9.4 | 1.91% | cvelistv5 | |
| cve-2026-28409 | CVE-2026-28409 | CRITICAL | 10.0 | 3.31% | cvelistv5 | |
| cve-2026-2699 | CVE-2026-2699 | CRITICAL | 9.8 | 59.51% | cvelistv5 | |
| cve-2026-2652 | mlflow: mlflow: Authentication bypass allows unauthorized job management and data injection | HIGH | 8.6 | 20.78% | cvelistv5 | 2026-07-08 |
| cve-2026-20253 | Splunk Enterprise Missing Authentication for Critical Function Vulnerability | CRITICAL | 9.8 | 96.94% | cvelistv5 | 2026-06-18 |
| cve-2026-1547 | Totolink A7000R cstecgi.cgi setUnloadUserData command injection | MEDIUM | 6.3 | 2.88% | cvelistv5 | 2026-06-17 |
| cve-2026-1207 | Django: Django: SQL Injection via RasterField band index parameter | HIGH | 8.3 | 13.25% | cvelistv5 | 2026-07-15 |
| cve-2025-60702 | CVE-2025-60702 | MEDIUM | 6.5 | 2.54% | cvelistv5 | |
| cve-2025-60698 | CVE-2025-60698 | HIGH | 7.3 | 3.93% | cvelistv5 | |
| cve-2025-4008 | Smartbedded Meteobridge Command Injection Vulnerability | HIGH | 8.7 | 93.67% | cvelistv5 | 2025-10-02 |
| cve-2025-10164 | CVE-2025-10164 | HIGH | 7.5 | 0.40% | cvelistv5 |