Skip to main content
cve.nowby Sazabi
Back

The cve.now Index

The worst CVEs published or escalated in the window, scored 0 to 100 on exploitation, exposure, reach, severity and patch status. How the score works. The packages board ranks open source packages by their worst CVE, and the charts show what drives the scores.

Severity
    Technology
      Ecosystem
        1. 1100Fortinet FortiSwitchManager · Fortinet FortiOS +1CVE-2025-59718Affects FortiOS, FortiProxy and FortiSwitchManager devices with FortiCloud SSO login enabled, which is off in default settings. The advisory says to upgrade to 7.6.4 or above.KEVEPSSNo patch listed yetEPSS crossed 10%
        2. 2100ivanti SentryCVE-2026-10520Ivanti Sentry is affected by this vulnerability, which allows a remote attacker without logging in to run commands on the system with root-level privileges. Successful exploitation would give the attacker full control o…KEVEPSSNo patch listed yetEPSS crossed 10%
        3. 3100Ivanti Endpoint Manager MobileCVE-2026-1281Ivanti Endpoint Manager Mobile, a tool used to manage mobile devices across an organization, is affected by this flaw. An attacker could exploit it without logging in to run their own commands on the affected server, po…KEVEPSSNo patch listed yetEPSS crossed 10%
        4. 4100Fortinet FortiOS · Fortinet FortiProxyCVE-2024-21762The vulnerability affects Fortinet FortiOS and FortiProxy, network security products used to protect and manage enterprise networks. An attacker could exploit it by sending specially crafted requests to run unauthorized…KEVEPSSNo patch listed yetEPSS crossed 10%
        5. 5100Ivanti Connect SecureCVE-2026-104935The ICS software is affected in releases prior to the fixed version. A remote attacker without any login credentials could bypass authentication by spoofing and run arbitrary commands on the system.KEVEPSSNo patch listed yetEPSS crossed 10%
        6. 698Ivanti ICS · Ivanti IPSCVE-2023-46805The vulnerability affects the web component of Ivanti Connect Secure (formerly Ivanti ICS) and Ivanti Policy Secure products. An attacker located remotely could exploit this flaw to bypass authentication checks and gain…KEVEPSSNo patch listed yetEPSS crossed 10%
        7. 797PMicrosoft SQL ServerCVE-2020-0618Microsoft SQL Server Reporting Services is affected by this vulnerability. An attacker who exploits it could run arbitrary code remotely on the affected server.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        8. 897Cisco IOS XE SoftwareCVE-2023-20198Affects Cisco IOS XE Software when the web UI is enabled through the ip http server or ip http secure-server commands. Cisco has released free software updates that address the vulnerabilities.KEVEPSSNo patch listed yetEPSS crossed 10%
        9. 997Ivanti Endpoint Manager MobileCVE-2023-35078Affects Ivanti Endpoint Manager Mobile supported versions 11.4 releases 11.10, 11.9 and 11.8, and older versions are also at risk. CVSS rates it critical (10). A patch is available for supported versions.KEVEPSSNo patch listed yetEPSS crossed 10%
        10. 1097PIvanti EPMMCVE-2023-35082Ivanti Endpoint Manager Mobile (EPMM) is affected by this vulnerability. An attacker could exploit the authentication bypass to access restricted functionality and resources in the application without logging in properl…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        11. 1197PIvanti Endpoint ManagerCVE-2024-13159Ivanti Endpoint Manager (EPM) is affected by this vulnerability. A remote attacker who has not logged in can exploit a flaw in how the software handles file paths to access and leak sensitive information.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        12. 1297PIvanti Endpoint ManagerCVE-2024-13160Ivanti Endpoint Manager (EPM) is affected by this vulnerability. An unauthenticated remote attacker could exploit a path traversal flaw to access and leak sensitive information from the system.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        13. 1397PIvanti Endpoint ManagerCVE-2024-13161Ivanti Endpoint Manager (EPM) is affected. A remote attacker who does not need to log in can exploit a path traversal flaw to read sensitive information from the system.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        14. 1497Fortinet FortiSwitchManager · Fortinet FortiOS +2CVE-2024-23113Affects FortiOS 7.0.0 to 7.0.13, 7.2.0 to 7.2.6 and 7.4.0 to 7.4.2, plus other Fortinet products. Fortinet's advisory says to upgrade FortiOS 7.4 to 7.4.3 or above.KEVEPSSNo patch listed yetEPSS crossed 10%
        15. 1597Fortinet FortiOS · Fortinet FortiProxyCVE-2024-55591Affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. No vendor severity is given, and the FortiOS fix is 7.0.17 or above.KEVEPSSNo patch listed yetEPSS crossed 10%
        16. 1697PIvanti vTMCVE-2024-7593Ivanti Virtual Traffic Manager (vTM) is affected, in all releases except two specific fixed builds. A remote attacker without any login credentials could bypass authentication and gain access to the administrative panel.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        17. 1797Ivanti Connect Secure · Ivanti Policy Secure +1CVE-2025-0282Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways are affected by a stack-based buffer overflow that lets a remote attacker without logging in run arbitrary code on the device. Successful…KEVExploit publicEPSSNo patch listed yetEPSS crossed 10%
        18. 1897PIvanti Endpoint Manager MobileCVE-2026-1340Ivanti Endpoint Manager Mobile, a tool used to manage mobile devices across an organization, is affected by this flaw. An attacker could exploit it without logging in to run their own commands on the affected server, po…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        19. 1997PCitrix Gateway, Citrix ADCCVE-2022-27518The affected software is not identified in the provided information, so the specific product cannot be named. If exploited, the flaw could allow an attacker to run arbitrary code on a vulnerable system remotely, without…KEVNo patch listed yetProvisionalPublished
        20. 2096PGoogle Chrome prior to 54.0.2840.90 for Linux, and 54.0.284…CVE-2016-5198The V8 JavaScript engine in Google Chrome on Linux, Android, Windows, and Mac is affected. A remote attacker could exploit this by tricking a user into visiting a specially crafted web page, allowing them to read and wr…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        21. 2196Fortinet FortiOS-6K7K · Fortinet FortiProxy +1CVE-2023-27997Affects the SSL-VPN component of FortiOS 7.2.0-7.2.4, 7.0.0-7.0.11, 6.4.0-6.4.12, 6.2.0-6.2.13 and 6.0.0-6.0.16, and of FortiProxy. Fixed by upgrading FortiOS to 7.2.5 or above.KEVEPSSNo patch listed yetEPSS crossed 10%
        22. 2296PApache Software Foundation Apache HTTP ServerCVE-2024-38475Apache HTTP Server (the mod_rewrite module, in releases up to and including the 2.4.59 line) is affected. An attacker could use crafted URLs to reach files on the server that are not meant to be accessed directly, poten…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        23. 2396PIvanti CSACVE-2024-8963Ivanti Cloud Services Appliance (CSA) versions before 4.6 Patch 519 are affected. A remote attacker who has not logged in could exploit a path traversal flaw to reach functionality that should be restricted.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        24. 2496PIvanti Connect Secure · Ivanti Policy Secure +1CVE-2025-22457Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti ZTA Gateways are affected by a stack-based buffer overflow flaw. An unauthenticated remote attacker could exploit it to run arbitrary code on the affected system.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        25. 2596PIvanti Endpoint ManagerCVE-2026-1603Ivanti Endpoint Manager, a systems management product used by IT teams to oversee and maintain computers, is affected. A remote attacker who does not need to log in could bypass authentication and retrieve certain store…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        26. 2696Fortinet FortiWeb · Fortinet FortiNAC-F +4CVE-2026-24858Only devices with FortiCloud SSO authentication enabled are exposed, in FortiAnalyzer 7.6.0 through 7.6.5 and several other listed Fortinet products. No fixed version is listed in the checked facts.KEVEPSSNo patch listed yetEPSS crossed 10%
        27. 2796Cisco IOS XR SoftwareCVE-2020-3566Affects Cisco IOS XR Software on devices with an active interface under multicast routing that receive DVMRP traffic. CVSS rates it high at 8.6. No fix is listed in the checked facts.KEVNo patch listed yetAdded to KEV
        28. 2896Cisco IOS XR SoftwareCVE-2020-3569Cisco IOS XR Software's DVMRP feature is affected, allowing a remote, unauthenticated attacker to crash the IGMP process or exhaust device memory by sending crafted IGMP traffic. Memory exhaustion can destabilize other…KEVNo patch listed yetAdded to KEV
        29. 2995GitLabCVE-2026-97229GitLab CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected. The fix is in 19.2.8, 19.3.5, and 19.4.2.KEVMetasploitEPSSFixed in 19.2.8, 19.3.5, 19.4.2Added to KEV
        30. 3095Citrix NetScaler ADC · Citrix NetScaler GatewayCVE-2026-88771The vulnerability affects Citrix NetScaler ADC and NetScaler Gateway, which are network appliances used for application delivery and secure remote access. An unauthenticated attacker could exploit improper input validat…KEVEPSSFixed in 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPPEPSS crossed 10%
        31. 3195PVMware NSX SD-WAN by VeloCloudCVE-2018-6961VMware NSX SD-WAN Edge by VeloCloud is affected, specifically its local web UI component, which is disabled by default. Successful exploitation of a command injection flaw in this component could allow an attacker to ex…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        32. 3295Apache Software Foundation Apache HTTP ServerCVE-2021-41773Apache HTTP Server 2.4.49 can map URLs to files outside its configured directories. The risk of code execution applies when CGI scripts are enabled on aliased paths. The 2.4.50 fix was found insufficient.KEVEPSSNo patch listed yetEPSS crossed 10%
        33. 3395PIvanti ICS · Ivanti IPSCVE-2024-21893The vulnerability affects Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA, specifically their SAML component. An unauthenticated attacker could exploit it to access certain restricted resources.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        34. 3495Meta react-server-dom-webpack · Meta react-server-dom-tu… +4CVE-2025-55182Affects react-server-dom-webpack, -parcel, and -turbopack at 19.0.0, 19.1.0, 19.1.1, and 19.2.0 in apps using a supporting framework or bundler. Fixed in 19.0.1, 19.1.2, and 19.2.1.KEVExploit publicEPSSFixed in 19.0.1, 19.1.2, 19.2.1EPSS crossed 10%
        35. 3595Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1CVE-2026-0300Only PA-Series and VM-Series firewalls using the User-ID Authentication Portal with response pages on untrusted-facing interfaces are affected. Fixed in PAN-OS 12.1.7 and later fixed releases.KEVEPSSFixed in 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6EPSS crossed 10%
        36. 3695WordPressCVE-2026-63030WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected. CVSS scores it 9.8 (critical). Fixed in 6.9.5 and 7.0.2.KEVEPSSFixed in 6.9.5, 7.0.2EPSS crossed 10%
        37. 3795Fortinet FortiMailCVE-2026-104286Affects FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, 7.2.0 through 7.2.9, and all 7.0 versions. Fixed in 8.0.2 or above.KEVFix availablePublished
        38. 3895Linux · :linux_kernel:CVE-2025-39682Affects the Linux kernel TLS receive code from 6.0 onward, in the 6.0 to 6.16 series. Fixed in stable releases 6.1.149, 6.6.103, 6.12.44 and 6.16.4. No vendor severity rating is given; the CVSS score is 9.8 (critical).KEVFixed in 6.1.149, 6.6.103, 6.12.44, 6.16.4Added to KEV
        39. 3994PMicrosoft Exchange ServerCVE-2018-8581This vulnerability affects Microsoft Exchange Server, Microsoft's email and collaboration server software. An attacker who can already run code or access the system could exploit it to gain higher privileges than they a…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        40. 4094Microsoft Exchange Server 2013 Cumulative Update · Micro… +1CVE-2021-26858Microsoft Exchange Server, the email and collaboration server software used by organizations, is affected by this vulnerability. An attacker who exploits it could potentially run malicious code on the affected server, w…KEVEPSSFixed in 15.00.1395.012, 15.00.1473.006, 15.00.1497.012, 15.01.1531.012EPSS crossed 10%
        41. 4194Microsoft Exchange Server 2013 Cumulative Update · Micro… +2CVE-2021-27065Microsoft Exchange Server, the email and collaboration server software used by organizations, is affected by this vulnerability. An attacker who exploits it could potentially run malicious code on the affected server, w…KEVExploit publicEPSSFixed in 15.00.1395.012, 15.00.1473.006, 15.00.1497.012, 15.00.0847.064EPSS crossed 10%
        42. 4292Google Brotli · node +6CVE-2026-111497Affects Node.js 22.x, 24.x and 26.x applications that decompress attacker-supplied Brotli data with node:zlib. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1.KEVExploit publicEPSSFixed in 1.0.10, 1.1.1, 1.2.1, 22.23.4Added to KEV
        43. 4392PHP Group PHPCVE-2026-109618Affects PHP before 8.2.35, 8.3.36, 8.4.27 and 8.5.12, including the Apache mod_php SAPI. The fix is in the matching fixed release for each branch.KEVExploit publicEPSSNucleiFixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12Added to KEV
        44. 4492PHP Group PHPCVE-2026-109619Affects PHP builds older than 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on their branches, where session upload progress is enabled by default. Fixed in those releases.KEVEPSSFixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12Added to KEV
        45. 4592Citrix NetScaler ADC · Citrix NetScaler GatewayCVE-2026-88772Citrix NetScaler ADC and NetScaler Gateway are affected by a memory overflow flaw that could allow an attacker to run arbitrary code on the device or crash it, causing a denial of service.KEVEPSSFixed in 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPPEPSS crossed 10%
        46. 4692Cisco IOS · IntelliShield Universal ProductCVE-2017-6736Affects Cisco IOS and IOS XE devices running a vulnerable release with SNMP enabled and the affected MIBs or OIDs not excluded. No fixed release is listed; a workaround is given.KEVEPSSNo patch listed yetEPSS crossed 10%
        47. 4792Cisco IOSCVE-2017-6737Affects Cisco IOS devices that run SNMP with one of the listed MIBs configured and not excluded. CVSS rates it High (8.8), and Cisco has released software updates, though fixed versions are not listed in the checked fac…KEVEPSSNo patch listed yetEPSS crossed 10%
        48. 4892Cisco IOSCVE-2017-6738Affects Cisco IOS and IOS XE Software releases on devices with SNMP enabled and one of the affected MIBs not excluded. Cisco has released software updates that address these vulnerabilities.KEVEPSSNo patch listed yetEPSS crossed 10%
        49. 4992Cisco IOS · IntelliShield Universal ProductCVE-2017-6740Affects Cisco IOS devices with SNMP enabled and the affected MIBs not excluded. Cisco has released free software updates that address the vulnerabilities.KEVEPSSNo patch listed yetEPSS crossed 10%
        50. 5092Cisco IOS XE Software · IntelliShield Universal ProductCVE-2017-6742Affects Cisco IOS and IOS XE devices running SNMP where the affected MIBs or OIDs are not excluded. Cisco has released software updates that fix it; the fixed releases are not listed in the checked facts.KEVEPSSNo patch listed yetEPSS crossed 10%

        Past weeks: 2026-W44

        Is one of these in your stack? Scan your lockfile, or let Sazabi watch production for you.