Skip to main content
cve.nowby Sazabi
Back

The cve.now Index

The worst CVEs published or escalated in the window, scored 0 to 100 on exploitation, exposure, reach, severity and patch status. How the score works. The packages board ranks open source packages by their worst CVE, and the charts show what drives the scores.

Severity
    Technology
      Ecosystem
        1. 1100Fortinet FortiSwitchManager · Fortinet FortiOS +1CVE-2025-59718Affects FortiOS, FortiProxy and FortiSwitchManager devices with FortiCloud SSO login enabled, which is off in default settings. The advisory says to upgrade to 7.6.4 or above.KEVEPSSNo patch listed yetEPSS crossed 10%
        2. 2100ivanti SentryCVE-2026-10520Ivanti Sentry is affected by this vulnerability, which allows a remote attacker without logging in to run commands on the system with root-level privileges. Successful exploitation would give the attacker full control o…KEVEPSSNo patch listed yetEPSS crossed 10%
        3. 3100Ivanti Endpoint Manager MobileCVE-2026-1281Ivanti Endpoint Manager Mobile, a tool used to manage mobile devices across an organization, is affected by this flaw. An attacker could exploit it without logging in to run their own commands on the affected server, po…KEVEPSSNo patch listed yetEPSS crossed 10%
        4. 4100Fortinet FortiOS · Fortinet FortiProxyCVE-2024-21762The vulnerability affects Fortinet FortiOS and FortiProxy, network security products used to protect and manage enterprise networks. An attacker could exploit it by sending specially crafted requests to run unauthorized…KEVEPSSNo patch listed yetEPSS crossed 10%
        5. 5100Ivanti Connect SecureCVE-2026-104935The ICS software is affected in releases prior to the fixed version. A remote attacker without any login credentials could bypass authentication by spoofing and run arbitrary commands on the system.KEVEPSSNo patch listed yetEPSS crossed 10%
        6. 698Ivanti ICS · Ivanti IPSCVE-2023-46805The vulnerability affects the web component of Ivanti Connect Secure (formerly Ivanti ICS) and Ivanti Policy Secure products. An attacker located remotely could exploit this flaw to bypass authentication checks and gain…KEVEPSSNo patch listed yetEPSS crossed 10%
        7. 797PMicrosoft SQL ServerCVE-2020-0618Microsoft SQL Server Reporting Services is affected by this vulnerability. An attacker who exploits it could run arbitrary code remotely on the affected server.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        8. 897Cisco IOS XE SoftwareCVE-2023-20198Affects Cisco IOS XE Software when the web UI is enabled through the ip http server or ip http secure-server commands. Cisco has released free software updates that address the vulnerabilities.KEVEPSSNo patch listed yetEPSS crossed 10%
        9. 997Ivanti Endpoint Manager MobileCVE-2023-35078Affects Ivanti Endpoint Manager Mobile supported versions 11.4 releases 11.10, 11.9 and 11.8, and older versions are also at risk. CVSS rates it critical (10). A patch is available for supported versions.KEVEPSSNo patch listed yetEPSS crossed 10%
        10. 1097PIvanti EPMMCVE-2023-35082Ivanti Endpoint Manager Mobile (EPMM) is affected by this vulnerability. An attacker could exploit the authentication bypass to access restricted functionality and resources in the application without logging in properl…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        11. 1197PIvanti Endpoint ManagerCVE-2024-13159Ivanti Endpoint Manager (EPM) is affected by this vulnerability. A remote attacker who has not logged in can exploit a flaw in how the software handles file paths to access and leak sensitive information.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        12. 1297PIvanti Endpoint ManagerCVE-2024-13160Ivanti Endpoint Manager (EPM) is affected by this vulnerability. An unauthenticated remote attacker could exploit a path traversal flaw to access and leak sensitive information from the system.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        13. 1397PIvanti Endpoint ManagerCVE-2024-13161Ivanti Endpoint Manager (EPM) is affected. A remote attacker who does not need to log in can exploit a path traversal flaw to read sensitive information from the system.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        14. 1497Fortinet FortiSwitchManager · Fortinet FortiOS +2CVE-2024-23113Affects FortiOS 7.0.0 to 7.0.13, 7.2.0 to 7.2.6 and 7.4.0 to 7.4.2, plus other Fortinet products. Fortinet's advisory says to upgrade FortiOS 7.4 to 7.4.3 or above.KEVEPSSNo patch listed yetEPSS crossed 10%
        15. 1597Fortinet FortiOS · Fortinet FortiProxyCVE-2024-55591Affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. No vendor severity is given, and the FortiOS fix is 7.0.17 or above.KEVEPSSNo patch listed yetEPSS crossed 10%
        16. 1697PIvanti vTMCVE-2024-7593Ivanti Virtual Traffic Manager (vTM) is affected, in all releases except two specific fixed builds. A remote attacker without any login credentials could bypass authentication and gain access to the administrative panel.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        17. 1797Ivanti Connect Secure · Ivanti Policy Secure +1CVE-2025-0282Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways are affected by a stack-based buffer overflow that lets a remote attacker without logging in run arbitrary code on the device. Successful…KEVExploit publicEPSSNo patch listed yetEPSS crossed 10%
        18. 1897PIvanti Endpoint Manager MobileCVE-2026-1340Ivanti Endpoint Manager Mobile, a tool used to manage mobile devices across an organization, is affected by this flaw. An attacker could exploit it without logging in to run their own commands on the affected server, po…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        19. 1996PGoogle Chrome prior to 54.0.2840.90 for Linux, and 54.0.284…CVE-2016-5198The V8 JavaScript engine in Google Chrome on Linux, Android, Windows, and Mac is affected. A remote attacker could exploit this by tricking a user into visiting a specially crafted web page, allowing them to read and wr…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        20. 2096Fortinet FortiOS-6K7K · Fortinet FortiProxy +1CVE-2023-27997Affects the SSL-VPN component of FortiOS 7.2.0-7.2.4, 7.0.0-7.0.11, 6.4.0-6.4.12, 6.2.0-6.2.13 and 6.0.0-6.0.16, and of FortiProxy. Fixed by upgrading FortiOS to 7.2.5 or above.KEVEPSSNo patch listed yetEPSS crossed 10%
        21. 2196PApache Software Foundation Apache HTTP ServerCVE-2024-38475Apache HTTP Server (the mod_rewrite module, in releases up to and including the 2.4.59 line) is affected. An attacker could use crafted URLs to reach files on the server that are not meant to be accessed directly, poten…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        22. 2296PIvanti CSACVE-2024-8963Ivanti Cloud Services Appliance (CSA) versions before 4.6 Patch 519 are affected. A remote attacker who has not logged in could exploit a path traversal flaw to reach functionality that should be restricted.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        23. 2396PIvanti Connect Secure · Ivanti Policy Secure +1CVE-2025-22457Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti ZTA Gateways are affected by a stack-based buffer overflow flaw. An unauthenticated remote attacker could exploit it to run arbitrary code on the affected system.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        24. 2496PIvanti Endpoint ManagerCVE-2026-1603Ivanti Endpoint Manager, a systems management product used by IT teams to oversee and maintain computers, is affected. A remote attacker who does not need to log in could bypass authentication and retrieve certain store…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        25. 2596Fortinet FortiWeb · Fortinet FortiNAC-F +4CVE-2026-24858Only devices with FortiCloud SSO authentication enabled are exposed, in FortiAnalyzer 7.6.0 through 7.6.5 and several other listed Fortinet products. No fixed version is listed in the checked facts.KEVEPSSNo patch listed yetEPSS crossed 10%
        26. 2695GitLabCVE-2026-97229GitLab CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected. The fix is in 19.2.8, 19.3.5, and 19.4.2.KEVMetasploitEPSSFixed in 19.2.8, 19.3.5, 19.4.2Added to KEV
        27. 2795Citrix NetScaler ADC · Citrix NetScaler GatewayCVE-2026-88771The vulnerability affects Citrix NetScaler ADC and NetScaler Gateway, which are network appliances used for application delivery and secure remote access. An unauthenticated attacker could exploit improper input validat…KEVEPSSFixed in 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPPEPSS crossed 10%
        28. 2895PVMware NSX SD-WAN by VeloCloudCVE-2018-6961VMware NSX SD-WAN Edge by VeloCloud is affected, specifically its local web UI component, which is disabled by default. Successful exploitation of a command injection flaw in this component could allow an attacker to ex…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        29. 2995Apache Software Foundation Apache HTTP ServerCVE-2021-41773Apache HTTP Server 2.4.49 can map URLs to files outside its configured directories. The risk of code execution applies when CGI scripts are enabled on aliased paths. The 2.4.50 fix was found insufficient.KEVEPSSNo patch listed yetEPSS crossed 10%
        30. 3095PIvanti ICS · Ivanti IPSCVE-2024-21893The vulnerability affects Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA, specifically their SAML component. An unauthenticated attacker could exploit it to access certain restricted resources.KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        31. 3195Meta react-server-dom-webpack · Meta react-server-dom-tu… +4CVE-2025-55182Affects react-server-dom-webpack, -parcel, and -turbopack at 19.0.0, 19.1.0, 19.1.1, and 19.2.0 in apps using a supporting framework or bundler. Fixed in 19.0.1, 19.1.2, and 19.2.1.KEVExploit publicEPSSFixed in 19.0.1, 19.1.2, 19.2.1EPSS crossed 10%
        32. 3295Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1CVE-2026-0300Only PA-Series and VM-Series firewalls using the User-ID Authentication Portal with response pages on untrusted-facing interfaces are affected. Fixed in PAN-OS 12.1.7 and later fixed releases.KEVEPSSFixed in 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6EPSS crossed 10%
        33. 3395WordPressCVE-2026-63030WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected. CVSS scores it 9.8 (critical). Fixed in 6.9.5 and 7.0.2.KEVEPSSFixed in 6.9.5, 7.0.2EPSS crossed 10%
        34. 3494PMicrosoft Exchange ServerCVE-2018-8581This vulnerability affects Microsoft Exchange Server, Microsoft's email and collaboration server software. An attacker who can already run code or access the system could exploit it to gain higher privileges than they a…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        35. 3594Microsoft Exchange Server 2013 Cumulative Update · Micro… +1CVE-2021-26858Microsoft Exchange Server, the email and collaboration server software used by organizations, is affected by this vulnerability. An attacker who exploits it could potentially run malicious code on the affected server, w…KEVEPSSFixed in 15.00.1395.012, 15.00.1473.006, 15.00.1497.012, 15.01.1531.012EPSS crossed 10%
        36. 3694Microsoft Exchange Server 2013 Cumulative Update · Micro… +2CVE-2021-27065Microsoft Exchange Server, the email and collaboration server software used by organizations, is affected by this vulnerability. An attacker who exploits it could potentially run malicious code on the affected server, w…KEVExploit publicEPSSFixed in 15.00.1395.012, 15.00.1473.006, 15.00.1497.012, 15.00.0847.064EPSS crossed 10%
        37. 3792Google Brotli · node +6CVE-2026-111497Affects Node.js 22.x, 24.x and 26.x applications that decompress attacker-supplied Brotli data with node:zlib. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1.KEVExploit publicEPSSFixed in 1.0.10, 1.1.1, 1.2.1, 22.23.4Added to KEV
        38. 3892PHP Group PHPCVE-2026-109618Affects PHP before 8.2.35, 8.3.36, 8.4.27 and 8.5.12, including the Apache mod_php SAPI. The fix is in the matching fixed release for each branch.KEVExploit publicEPSSNucleiFixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12Added to KEV
        39. 3992PHP Group PHPCVE-2026-109619Affects PHP builds older than 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on their branches, where session upload progress is enabled by default. Fixed in those releases.KEVEPSSFixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12Added to KEV
        40. 4092Citrix NetScaler ADC · Citrix NetScaler GatewayCVE-2026-88772Citrix NetScaler ADC and NetScaler Gateway are affected by a memory overflow flaw that could allow an attacker to run arbitrary code on the device or crash it, causing a denial of service.KEVEPSSFixed in 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS and NDcPPEPSS crossed 10%
        41. 4192Cisco IOS · IntelliShield Universal ProductCVE-2017-6736Affects Cisco IOS and IOS XE devices running a vulnerable release with SNMP enabled and the affected MIBs or OIDs not excluded. No fixed release is listed; a workaround is given.KEVEPSSNo patch listed yetEPSS crossed 10%
        42. 4292Cisco IOSCVE-2017-6737Affects Cisco IOS devices that run SNMP with one of the listed MIBs configured and not excluded. CVSS rates it High (8.8), and Cisco has released software updates, though fixed versions are not listed in the checked fac…KEVEPSSNo patch listed yetEPSS crossed 10%
        43. 4392Cisco IOSCVE-2017-6738Affects Cisco IOS and IOS XE Software releases on devices with SNMP enabled and one of the affected MIBs not excluded. Cisco has released software updates that address these vulnerabilities.KEVEPSSNo patch listed yetEPSS crossed 10%
        44. 4492Cisco IOS · IntelliShield Universal ProductCVE-2017-6740Affects Cisco IOS devices with SNMP enabled and the affected MIBs not excluded. Cisco has released free software updates that address the vulnerabilities.KEVEPSSNo patch listed yetEPSS crossed 10%
        45. 4592Cisco IOS XE Software · IntelliShield Universal ProductCVE-2017-6742Affects Cisco IOS and IOS XE devices running SNMP where the affected MIBs or OIDs are not excluded. Cisco has released software updates that fix it; the fixed releases are not listed in the checked facts.KEVEPSSNo patch listed yetEPSS crossed 10%
        46. 4692Cisco IOS · IntelliShield Universal ProductCVE-2017-6743Affects Cisco IOS and IOS XE devices that run SNMP with one of ten listed MIBs configured. Cisco has released free software updates that address it. No vendor rating is given.KEVEPSSNo patch listed yetEPSS crossed 10%
        47. 4792PSpring by Pivotal Spring Framework · org.springframework.da…CVE-2018-1273Spring Data Commons, a Java library used by applications built on the Spring Framework, is affected, particularly applications exposing Spring Data REST endpoints or using projection-based request binding. An unauthenti…KEVEPSSFixed in 1.13.11, 2.0.6ProvisionalEPSS crossed 10%
        48. 4892PMicrosoft SQL Server 2014 Service Pack 2 for 32-bit Systems…CVE-2019-1068Microsoft SQL Server is affected by this vulnerability, which allows a remote attacker to run arbitrary code on a vulnerable system. Successful exploitation could give the attacker control over the affected server and t…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        49. 4992Microsoft Exchange ServerCVE-2020-0688Affects Microsoft Exchange Server 2010 SP3 UP30, 2013, 2016 CU14 and CU15, and 2019 CU3 and CU4, where the flaw sits in the Exchange Control Panel web application. CVSS rates it 8.8 (high).KEVEPSSNo patch listed yetEPSS crossed 10%
        50. 5092Google Chrome · CefSharp.Common +3CVE-2020-15999Affects Google Chrome before 86.0.4240.111 and CefSharp packages before 85.3.130, including CefSharp.Wpf and CefSharp.WinForms. CVSS scores it 9.6 Critical. Fixed in those releases.KEVEPSSFixed in 86.0.4240.111, 85.3.130EPSS crossed 10%

        Past weeks: 2026-W44

        Is one of these in your stack? Scan your lockfile, or let Sazabi watch production for you.