Security Digest · page 3 of 8
Known exploited vulnerabilities (page 3)
Every CVE CISA has added to its Known Exploited Vulnerabilities catalog since October 1, 2023 (748), newest first. If you run the product, these come first. Browse by vendor.
| Added | CVE | Product and flaw | CISA due |
|---|---|---|---|
| 2026-03-27 | CVE-2025-53521 | F5 BIG-IP F5 BIG-IP Stack-Based Buffer Overflow Vulnerability | 2026-03-30 |
| 2026-03-26 | CVE-2026-33634 | Aquasecurity Trivy Aquasecurity Trivy Embedded Malicious Code Vulnerability | 2026-04-09 |
| 2026-03-25 | CVE-2026-33017 | Langflow Langflow Langflow Code Injection Vulnerability | 2026-04-08 |
| 2026-03-20 | CVE-2025-54068 | Laravel Livewire Laravel Livewire Code Injection Vulnerability | 2026-04-03 |
| 2026-03-20 | CVE-2025-43520 | Apple Multiple Products Apple Multiple Products Classic Buffer Overflow Vulnerability | 2026-04-03 |
| 2026-03-20 | CVE-2025-43510 | Apple Multiple Products Apple Multiple Products Improper Locking Vulnerability | 2026-04-03 |
| 2026-03-20 | CVE-2025-32432 | Craft CMS Craft CMS Craft CMS Code Injection Vulnerability | 2026-04-03 |
| 2026-03-20 | CVE-2025-31277 | Apple Multiple Products Apple Multiple Products Buffer Overflow Vulnerability | 2026-04-03 |
| 2026-03-19 | CVE-2026-20131 | Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability Ransomware | 2026-03-22 |
| 2026-03-18 | CVE-2026-20963 | Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | 2026-03-21 |
| 2026-03-18 | CVE-2025-66376 | Synacor Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability | 2026-04-01 |
| 2026-03-16 | CVE-2025-47813 | Wing FTP Server Wing FTP Server Wing FTP Server Information Disclosure Vulnerability | 2026-03-30 |
| 2026-03-13 | CVE-2026-3910 | Google Chromium V8 Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability | 2026-03-27 |
| 2026-03-13 | CVE-2026-3909 | Google Skia Google Skia Out-of-Bounds Write Vulnerability | 2026-03-27 |
| 2026-03-11 | CVE-2025-68613 | n8n n8n n8n Improper Control of Dynamically-Managed Code Resources Vulnerability | 2026-03-25 |
| 2026-03-09 | CVE-2026-1603 | Ivanti Endpoint Manager (EPM) Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability | 2026-03-23 |
| 2026-03-09 | CVE-2025-26399 | SolarWinds Web Help Desk SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability Ransomware | 2026-03-12 |
| 2026-03-09 | CVE-2021-22054 | Omnissa Workspace One UEM Omnissa Workspace ONE Server-Side Request Forgery | 2026-03-23 |
| 2026-03-05 | CVE-2023-43000 | Apple Multiple Products Apple Multiple products Use-After-Free Vulnerability | 2026-03-26 |
| 2026-03-05 | CVE-2023-41974 | Apple iOS and iPadOS Apple iOS and iPadOS Use-After-Free Vulnerability | 2026-03-26 |
| 2026-03-05 | CVE-2021-30952 | Apple Multiple Products Apple Multiple Products Integer Overflow or Wraparound Vulnerability | 2026-03-26 |
| 2026-03-05 | CVE-2021-22681 | Rockwell Multiple Products Rockwell Multiple Products Insufficient Protected Credentials Vulnerability | 2026-03-26 |
| 2026-03-05 | CVE-2017-7921 | Hikvision Multiple Products Hikvision Multiple Products Improper Authentication Vulnerability | 2026-03-26 |
| 2026-03-03 | CVE-2026-22719 | Broadcom VMware Aria Operations Broadcom VMware Aria Operations Command Injection Vulnerability | 2026-03-24 |
| 2026-03-03 | CVE-2026-21385 | Qualcomm Multiple Chipsets Qualcomm Multiple Chipsets Memory Corruption Vulnerability | 2026-03-24 |
| 2026-02-25 | CVE-2026-20127 | Cisco Catalyst SD-WAN Controller and Manager Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability | 2026-02-27 |
| 2026-02-25 | CVE-2022-20775 | Cisco SD-WAN Cisco SD-WAN Path Traversal Vulnerability | 2026-02-27 |
| 2026-02-24 | CVE-2026-25108 | Soliton Systems K.K FileZen Soliton Systems K.K FileZen OS Command Injection Vulnerability | 2026-03-17 |
| 2026-02-20 | CVE-2025-68461 | Roundcube Webmail RoundCube Webmail Cross-site Scripting Vulnerability | 2026-03-13 |
| 2026-02-20 | CVE-2025-49113 | Roundcube Webmail RoundCube Webmail Deserialization of Untrusted Data Vulnerability | 2026-03-13 |
| 2026-02-18 | CVE-2026-22769 | Dell RecoverPoint for Virtual Machines (RP4VMs) Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability | 2026-02-21 |
| 2026-02-18 | CVE-2021-22175 | GitLab GitLab GitLab Server-Side Request Forgery (SSRF) Vulnerability | 2026-03-11 |
| 2026-02-17 | CVE-2026-2441 | Google Chromium Google Chromium CSS Use-After-Free Vulnerability | 2026-03-10 |
| 2026-02-17 | CVE-2024-7694 | TeamT5 ThreatSonar Anti-Ransomware TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability | 2026-03-10 |
| 2026-02-17 | CVE-2020-7796 | Synacor Zimbra Collaboration Suite Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability | 2026-03-10 |
| 2026-02-17 | CVE-2008-0015 | Microsoft Windows Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability | 2026-03-10 |
| 2026-02-13 | CVE-2026-1731 | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability Ransomware | 2026-02-16 |
| 2026-02-12 | CVE-2026-20700 | Apple Multiple Products Apple Multiple Buffer Overflow Vulnerability | 2026-03-05 |
| 2026-02-12 | CVE-2025-40536 | SolarWinds Web Help Desk SolarWinds Web Help Desk Security Control Bypass Vulnerability | 2026-02-15 |
| 2026-02-12 | CVE-2025-15556 | Notepad++ Notepad++ Notepad++ Download of Code Without Integrity Check Vulnerability | 2026-03-05 |
| 2026-02-12 | CVE-2024-43468 | Microsoft Configuration Manager Microsoft Configuration Manager SQL Injection Vulnerability | 2026-03-05 |
| 2026-02-10 | CVE-2026-21533 | Microsoft Windows Microsoft Windows Improper Privilege Management Vulnerability | 2026-03-03 |
| 2026-02-10 | CVE-2026-21525 | Microsoft Windows Microsoft Windows NULL Pointer Dereference Vulnerability | 2026-03-03 |
| 2026-02-10 | CVE-2026-21519 | Microsoft Windows Microsoft Windows Type Confusion Vulnerability | 2026-03-03 |
| 2026-02-10 | CVE-2026-21514 | Microsoft Office Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability | 2026-03-03 |
| 2026-02-10 | CVE-2026-21513 | Microsoft Windows Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability | 2026-03-03 |
| 2026-02-10 | CVE-2026-21510 | Microsoft Windows Microsoft Windows Shell Protection Mechanism Failure Vulnerability | 2026-03-03 |
| 2026-02-05 | CVE-2026-24423 | SmarterTools SmarterMail SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability Ransomware | 2026-02-26 |
| 2026-02-05 | CVE-2025-11953 | React Native Community CLI React Native Community CLI OS Command Injection Vulnerability | 2026-02-26 |
| 2026-02-03 | CVE-2025-64328 | Sangoma FreePBX Sangoma FreePBX OS Command Injection Vulnerability | 2026-02-24 |
| 2026-02-03 | CVE-2025-40551 | SolarWinds Web Help Desk SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | 2026-02-06 |
| 2026-02-03 | CVE-2021-39935 | GitLab Community and Enterprise Editions GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability | 2026-02-24 |
| 2026-02-03 | CVE-2019-19006 | Sangoma FreePBX Sangoma FreePBX Improper Authentication Vulnerability | 2026-02-24 |
| 2026-01-29 | CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | 2026-02-01 |
| 2026-01-27 | CVE-2026-24858 | Fortinet Multiple Products Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-01-30 |
| 2026-01-26 | CVE-2026-24061 | GNU InetUtils GNU InetUtils Argument Injection Vulnerability | 2026-02-16 |
| 2026-01-26 | CVE-2026-23760 | SmarterTools SmarterMail SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability Ransomware | 2026-02-16 |
| 2026-01-26 | CVE-2026-21509 | Microsoft Office Microsoft Office Security Feature Bypass Vulnerability | 2026-02-16 |
| 2026-01-26 | CVE-2025-52691 | SmarterTools SmarterMail SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability Ransomware | 2026-02-16 |
| 2026-01-26 | CVE-2018-14634 | Linux Kernel Linux Kernel Integer Overflow Vulnerability | 2026-02-16 |
| 2026-01-23 | CVE-2024-37079 | Broadcom VMware vCenter Server Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability | 2026-02-13 |
| 2026-01-22 | CVE-2025-68645 | Synacor Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | 2026-02-12 |
| 2026-01-22 | CVE-2025-54313 | Prettier eslint-config-prettier Prettier eslint-config-prettier Embedded Malicious Code Vulnerability | 2026-02-12 |
| 2026-01-22 | CVE-2025-34026 | Versa Concerto Versa Concerto Improper Authentication Vulnerability | 2026-02-12 |
| 2026-01-22 | CVE-2025-31125 | Vite Vitejs Vite Vitejs Improper Access Control Vulnerability | 2026-02-12 |
| 2026-01-21 | CVE-2026-20045 | Cisco Unified Communications Manager Cisco Unified Communications Products Code Injection Vulnerability | 2026-02-11 |
| 2026-01-13 | CVE-2026-20805 | Microsoft Windows Microsoft Windows Information Disclosure Vulnerability | 2026-02-03 |
| 2026-01-12 | CVE-2025-8110 | Gogs Gogs Gogs Path Traversal Vulnerability | 2026-02-02 |
| 2026-01-07 | CVE-2025-37164 | Hewlett Packard Enterprise (HPE) OneView Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability | 2026-01-28 |
| 2026-01-07 | CVE-2009-0556 | Microsoft Office Microsoft Office PowerPoint Code Injection Vulnerability | 2026-01-28 |
| 2025-12-29 | CVE-2025-14847 | MongoDB MongoDB and MongoDB Server MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability | 2026-01-19 |
| 2025-12-22 | CVE-2023-52163 | Digiever DS-2105 Pro Digiever DS-2105 Pro Missing Authorization Vulnerability | 2026-01-12 |
| 2025-12-19 | CVE-2025-14733 | WatchGuard Firebox WatchGuard Firebox Out of Bounds Write Vulnerability Ransomware | 2025-12-26 |
| 2025-12-17 | CVE-2025-59374 | ASUS Live Update ASUS Live Update Embedded Malicious Code Vulnerability | 2026-01-07 |
| 2025-12-17 | CVE-2025-40602 | SonicWall SMA1000 appliance SonicWall SMA1000 Missing Authorization Vulnerability | 2025-12-24 |
| 2025-12-17 | CVE-2025-20393 | Cisco Multiple Products Cisco Multiple Products Improper Input Validation Vulnerability | 2025-12-24 |
| 2025-12-16 | CVE-2025-59718 | Fortinet Multiple Products Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability | 2025-12-23 |
| 2025-12-15 | CVE-2025-43529 | Apple Multiple Products Apple Multiple Products Use-After-Free WebKit Vulnerability | 2026-01-05 |
| 2025-12-15 | CVE-2025-14611 | Gladinet CentreStack and Triofox Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability | 2026-01-05 |
| 2025-12-12 | CVE-2025-14174 | Google Chromium Google Chromium Out of Bounds Memory Access Vulnerability | 2026-01-02 |
| 2025-12-12 | CVE-2018-4063 | Sierra Wireless AirLink ALEOS Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability | 2026-01-02 |
| 2025-12-11 | CVE-2025-58360 | OSGeo GeoServer OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability | 2026-01-01 |
| 2025-12-09 | CVE-2025-62221 | Microsoft Windows Microsoft Windows Use After Free Vulnerability | 2025-12-30 |
| 2025-12-09 | CVE-2025-6218 | RARLAB WinRAR RARLAB WinRAR Path Traversal Vulnerability | 2025-12-30 |
| 2025-12-08 | CVE-2025-66644 | Array Networks ArrayOS AG Array Networks ArrayOS AG OS Command Injection Vulnerability | 2025-12-29 |
| 2025-12-08 | CVE-2022-37055 | D-Link Routers D-Link Routers Buffer Overflow Vulnerability | 2025-12-29 |
| 2025-12-05 | CVE-2025-55182 | Meta React Server Components Meta React Server Components Remote Code Execution Vulnerability Ransomware | 2025-12-12 |
| 2025-12-03 | CVE-2021-26828 | OpenPLC ScadaBR OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability | 2025-12-24 |
| 2025-12-02 | CVE-2025-48633 | Android Framework Android Framework Information Disclosure Vulnerability | 2025-12-23 |
| 2025-12-02 | CVE-2025-48572 | Android Framework Android Framework Privilege Escalation Vulnerability | 2025-12-23 |
| 2025-11-28 | CVE-2021-26829 | OpenPLC ScadaBR OpenPLC ScadaBR Cross-site Scripting Vulnerability | 2025-12-19 |
| 2025-11-21 | CVE-2025-61757 | Oracle Fusion Middleware Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability | 2025-12-12 |
| 2025-11-19 | CVE-2025-13223 | Google Chromium V8 Google Chromium V8 Type Confusion Vulnerability | 2025-12-10 |
| 2025-11-18 | CVE-2025-58034 | Fortinet FortiWeb Fortinet FortiWeb OS Command Injection Vulnerability | 2025-11-25 |
| 2025-11-14 | CVE-2025-64446 | Fortinet FortiWeb Fortinet FortiWeb Path Traversal Vulnerability | 2025-11-21 |
| 2025-11-12 | CVE-2025-9242 | WatchGuard Firebox WatchGuard Firebox Out-of-Bounds Write Vulnerability | 2025-12-03 |
| 2025-11-12 | CVE-2025-62215 | Microsoft Windows Microsoft Windows Race Condition Vulnerability | 2025-12-03 |
| 2025-11-12 | CVE-2025-12480 | Gladinet Triofox Gladinet Triofox Improper Access Control Vulnerability | 2025-12-03 |
| 2025-11-10 | CVE-2025-21042 | Samsung Mobile Devices Samsung Mobile Devices Out-of-Bounds Write Vulnerability | 2025-12-01 |
| 2025-11-04 | CVE-2025-48703 | CWP Control Web Panel CWP Control Web Panel OS Command Injection Vulnerability | 2025-11-25 |