Know the risk.
Hold the cards.

CVE-2021-44228CRITICAL

Log4Shell

A logging library resolves lookups inside the text it is asked to log, so any attacker-controlled string that reaches a log line — a username, a header — makes the server fetch and run remote code.

Upgrade Log4j past 2.15.0, and hunt for outbound callbacks from application servers.

CVE-2019-0708CRITICAL

BlueKeep

The Windows remote desktop service frees a channel object and keeps using it, so an unauthenticated attacker who can open a session runs code on the machine — no credentials, no user action.

initial accessT1210

Apply Microsoft's update on every affected Windows version, and require network-level authentication on remote desktop until you have.

A crafted connection to the telnet port of Cisco's router software (IOS) occupies the virtual terminal lines, and further remote logins are refused. Releases 12.2(15) and earlier are affected, and other access paths go with it.

Real data. A different perspective.

BUILT ON THE FACTS

CISA KEVNIST NVDFIRST EPSS

Traceable sources. Human-reviewed cards.

THE OPEN ARCHIVE

The collection.

976 base cards937 known exploited

/

976 cards in the archive

Search syntax

Combine terms to narrow your hand. Click one to try it.

EPSS uses percentages. All filters must match.

Fresh from the archive

The latest additions & revisions

Move the device to a supported release, and reach management over a dedicated path with the telnet and reverse telnet ports closed to everyone else.

CVE-2010-3904HIGH

Linux kernel

The reliable datagram sockets code in Linux kernels before 2.6.36 takes addresses from user space without validating them, so a local user with crafted send and receive calls reaches root. Exploit code is public.

Update the kernel. Where that is impossible, prevent the datagram sockets module from loading at all — the flaw is unreachable without it.

A crafted site drives Internet Explorer 6 through 8 into using an object after it was freed, and the attacker's code runs. It was found in a watering-hole campaign in December 2012, and a public exploit module followed within weeks.

Retire Internet Explorer. The fix shipped as MS13-008 in 2013 and the browser is long out of support; anything still requiring it belongs on an isolated host.

CVE-2014-0196MEDIUM

Linux kernel

The terminal write path in Linux kernels up to 3.14.3 mismanages driver access in one echo mode, so a race between long reads and writes corrupts memory. A local user gets a crash, or privileges.

Update the kernel to your distribution's fixed build. A system still on a 3.x kernel from that era has collected a great deal more than this one flaw.

Several administrative pages on this D-Link router accept requests without checking where they came from — cross-site request forgery (CSRF). A page the administrator visits can create an account or switch on remote management. Fixed in firmware 2.17b02.

Update the router to firmware 2.17b02 or later, and open its administration interface from a browser session that is not also used for ordinary browsing.

The fingerprints pages in Jenkins before 1.638 show job and build names to users who were never meant to see them, from a direct request. The long-term support line is fixed in 1.625.2.

Upgrade Jenkins to 1.638, or 1.625.2 on the long-term support line. What leaks is the naming of jobs, which is usually a map of the whole build estate.

CVE-2016-0165HIGH

Windows

The Windows kernel-mode driver lets a crafted application raise its own privileges. The affected list runs from Vista through Windows 10 build 1511, and Microsoft fixed three separate flaws in that driver at once.

Install the April 2016 Windows update, or move the machine to a supported build — most of the affected list stopped receiving updates years ago.

CVE-2016-20017CRITICAL

D-Link DSL-2750B

This D-Link home router hands a login page parameter to a shell, so anyone who can reach the device runs commands without credentials. It was exploited in the wild from 2016 through 2022; firmware 1.05 closes it.

Update the router to firmware 1.05 or later, or replace it. This was exploited continuously for six years and needs nothing but network reach.

Hot off the press

The most recently disclosed vulnerabilities

Check Point Management Server

CVE-2026-93616CRITICAL

A path traversal in Check Point management and log servers lets an unauthenticated attacker upload an executable script outside the intended directory and run it, taking over the console that manages the gateway estate.

Patch Security Management, Multi-Domain and Log servers per Check Point sk1000171 now; hunt for unexpected scripts and jobs on the management host.

Arista VeloCloud Orchestrator

CVE-2026-93952CRITICAL

Arista's on-premises VeloCloud Orchestrator (VCO) does not properly validate input, so a remote attacker can reach privileged internal functions and take over the orchestrator host along with the data it manages.

Patch on-prem VeloCloud Orchestrator per Arista's advisory now; hosted tenants are already fixed. Review orchestrator logs for unexpected privileged calls.

CVE-2026-94127CRITICAL

F5 BIG-IP APM

When F5's Access Policy Manager (APM) runs as an OAuth authorization server on a virtual server, crafted traffic overflows a heap buffer and gives an unauthenticated attacker remote code execution on the appliance.

Patch BIG-IP per F5 article K000162605 now. Deployments using APM only as an OAuth client or resource server are unaffected; confirm your profiles first.

Acronis Backup Panel Plugins

CVE-2026-87886HIGH

The Acronis Backup plugins for cPanel, Plesk and DirectAdmin on Linux ship files with insecure permissions. A user with a low-privilege local account can abuse them to escalate privileges on the hosting server. Exploited in the wild.

Update the Acronis Backup plugin on every cPanel, Plesk and DirectAdmin host to the fixed build, and review those hosts for signs of local compromise.

Cisco Identity Services Engine

CVE-2026-76460CRITICAL

initial accessT1190 T1078

A programming interface on Cisco Identity Services Engine does not properly check who is calling it. Anyone who can reach the device over the network can send a crafted request and get in without logging in, skipping the web management interface entirely.

Apply Cisco's advisory mitigations for Identity Services Engine now, restrict the management interface to trusted networks, and review access logs for unexpected requests.

CVE-2026-58704HIGH

Google Pixel

A logic error in the cellular modem of Google Pixel phones lets an attacker within radio range skip a permission check and gain higher privileges on the device, with no user interaction and no prior access. It is being exploited in the wild.

Install the September 2026 Pixel security update per the vendor bulletin on every Pixel device now; treat unpatched phones as exposed to nearby attackers.

Cisco Secure Email Gateway

CVE-2026-76461CRITICAL

Cisco AsyncOS on Secure Email Gateway does not properly validate email content it parses. An attacker can send a crafted email carrying SQL statements through the device to run arbitrary SQL and then commands as root on the appliance, with no login required.

Apply the mitigations in Cisco advisory cisco-sa-esa-inj-2bLVGmhX to every Secure Email Gateway now; it is exploited in the wild, so check exposed appliances for compromise.

CVE-2026-85706CRITICAL

GitLab

initial accessT1190 T1083

A path traversal flaw in GitLab's repository commits endpoint, combined with missing authentication checks, lets an unauthenticated attacker read arbitrary files from the GitLab server. Affects 18.7 and later before 19.1.8, 19.2.6 and 19.3.2.

Upgrade GitLab to 19.1.8, 19.2.6 or 19.3.2 now; restrict internet exposure of the instance until patched and review logs for unauthenticated commits requests.

In the wild

Known exploited. Newest listings first.

Check Point Quantum Gateway

CVE-2026-85102CRITICAL

Check Point gateways accept an untrusted certificate during virtual private network (VPN) negotiation, which lets an unauthenticated remote attacker run code on the gateway itself.

Patch Quantum Security Gateway and Spark per Check Point sk1000117 now; take internet-facing gateways first and check them for signs of compromise.

Check Point Management Server

CVE-2026-93616CRITICAL

Patch Security Management, Multi-Domain and Log servers per Check Point sk1000171 now; hunt for unexpected scripts and jobs on the management host.

Arista VeloCloud Orchestrator

CVE-2026-93952CRITICAL

Patch on-prem VeloCloud Orchestrator per Arista's advisory now; hosted tenants are already fixed. Review orchestrator logs for unexpected privileged calls.

Patch BIG-IP per F5 article K000162605 now. Deployments using APM only as an OAuth client or resource server are unaffected; confirm your profiles first.

CVE-2026-94127CRITICAL

CVE-2026-7273HIGH

Zyxel GS1900 switches

A stack-based buffer overflow in the web management program of Zyxel switches (GS1900-48HPv2) on firmware through 2.90(ABTQ.1)C0 lets an unauthenticated attacker on the local network run operating system commands with one crafted web (HTTP) request.

Apply Zyxel's advisory mitigations for GS1900 series now; restrict LAN access to the switch web management interface to trusted admin hosts and review it for tampering.

The Linux kernel's in-kernel Transport Layer Security (TLS) receive path mishandles a zero-length record held over from an earlier read, so later records are processed with wrong zero-copy assumptions, letting a local user crash the system or read data they should not.

Update to a kernel build that carries the stable in-kernel TLS receive-path fix, starting with hosts that use in-kernel TLS.

A race condition in the Linux kernel's user-space crypto socket interface lets a local user issue overlapping writes to one socket, corrupting its internal state and crashing or destabilizing the host. Exploitation has been observed in the wild.

Update to a distribution kernel carrying the af_alg concurrent-write fix now; prioritize shared and multi-user hosts, since exploitation has been observed in the wild.

CVE-2026-53266HIGH

Linux Kernel

The Linux kernel's bridge firewall address-rewrite target copies a new hardware address into packet memory that may not be writable, including a file page spliced into the packet, so a local user can corrupt kernel memory. Exploitation has been seen in the wild.

Update the kernel to a stable release carrying the ebtables fix now; prioritise hosts with bridge firewall rules where untrusted local users or code run.

The heat is on

Highest exploitation probability

CVE-2014-0160HIGH

Heartbleed

Upgrade OpenSSL to 1.0.1g or later, then replace every certificate and rotate every credential the server held.

credential accessT1190

The third version of the secure sockets protocol pads blocks in a way a network attacker can probe one byte at a time, recovering a session cookie from traffic they can see and influence.

CVE-2014-3566LOW

POODLE

credential accessT1040

Retire the third version of the secure sockets protocol on both ends of every connection, and require its transport-layer successor.

CVE-2014-6271CRITICAL

Shellshock

The Bourne-again shell keeps parsing after a function definition inside an environment variable, so anything that puts attacker text into the environment — a web gateway, a mail filter — hands it command execution.

executionT1190 T1059

Patch the shell on every host, including containers and appliances, then hunt for requests carrying function definitions in headers.

CVE-2015-1635CRITICAL

Windows HTTP.sys

The Windows kernel driver that serves web requests mishandles a crafted range header, letting a remote attacker run code with kernel privileges before any application ever sees the request.

executionT1190 T1059

Apply Microsoft's security update on every affected Windows version, including servers where only the web stack is enabled.

CVE-2017-5638CRITICAL

Apache Struts

Apache Struts builds an error message out of a malformed upload header and evaluates it as an expression, so one crafted header runs commands on the server.

Upgrade Struts to 2.3.32 or 2.5.10.1, and check upload handling on any service that ran unpatched.

CVE-2017-9841CRITICAL

PHPUnit

A test helper shipped inside a widely used testing library runs whatever code arrives in a request body, and it is routinely left reachable inside deployed web roots.

Upgrade to 4.8.28 or 5.6.3, and keep development dependencies out of anything served to the web.

CVE-2018-13379CRITICAL

Fortinet FortiOS

credential accessT1190 T1083

The remote-access portal on Fortinet's firewalls serves files from outside its own directory to unauthenticated callers, and the file attackers reached for held session credentials in plain text.

Upgrade past 6.0.4, 5.6.7 or 5.4.12, then reset every credential the portal held — patching does not undo what was already taken.

CVE-2019-0708CRITICAL

BlueKeep

The Windows remote desktop service frees a channel object and keeps using it, so an unauthenticated attacker who can open a session runs code on the machine — no credentials, no user action.

initial accessT1210

Apply Microsoft's update on every affected Windows version, and require network-level authentication on remote desktop until you have.

The legends

The vulnerabilities that made history

CVE-2021-44228CRITICAL

Log4Shell

Upgrade Log4j past 2.15.0, and hunt for outbound callbacks from application servers.

CVE-2014-0160HIGH

Heartbleed

Upgrade OpenSSL to 1.0.1g or later, then replace every certificate and rotate every credential the server held.

credential accessT1190

CVE-2021-26855CRITICAL

ProxyLogon

Microsoft Exchange accepts a request and forwards it onward on the caller's behalf, letting an unauthenticated attacker act as the server and reach mailboxes — the opening move of the ProxyLogon chain.

Apply Microsoft's Exchange security update, then hunt for web shells and exported mailboxes — this one was mass-exploited before most sites patched.

CVE-2020-1472CRITICAL

Zerologon

A flawed cryptographic step lets an attacker on the network set the domain controller's own account password, taking the entire directory in seconds.

Apply Microsoft's update and then enforce secure channel mode; the patch alone leaves the permissive path open.

CVE-2019-0708CRITICAL

BlueKeep

The Windows remote desktop service frees a channel object and keeps using it, so an unauthenticated attacker who can open a session runs code on the machine — no credentials, no user action.

initial accessT1210

Apply Microsoft's update on every affected Windows version, and require network-level authentication on remote desktop until you have.

CVE-2023-34362CRITICAL

MOVEit Transfer

Progress MOVEit Transfer lets an unauthenticated caller inject SQL through its web interface, which one crew used to empty the file stores of hundreds of organisations at once.

Upgrade MOVEit Transfer to a fixed build, and review what was downloaded during the exposure window.