Confirmed attacker activity
Vulnerabilities with confirmed exploitation evidence, ranked by the Cornish Geek Signal.
Updated 20 Aug 2026 · 06:03 UTC
1671 matching vulnerabilities
DrayTek
Multiple Vigor Routers, Vigor2960 Firmware, Vigor300b Firmware +1 more
Known exploitation is confirmed by CISA KEV. DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed…
Liferay
Liferay Portal
Known exploitation is confirmed by CISA KEV. Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
Canonical, Debian +2 more
Debian Linux, Fedora, OpenSMTPD +1 more
Known exploitation is confirmed by CISA KEV. smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell…
SAP
NetWeaver, Netweaver Application Server Java
Known exploitation is confirmed by CISA KEV. SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform…
SAP
Solution Manager
Known exploitation is confirmed by CISA KEV. SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution…
Oracle
Access Manager, Coherence, Commerce Platform +7 more
Known exploitation is confirmed by CISA KEV. Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access…
D-Link, Dlink
DNS-320 Device, Dns-320 Firmware
Known exploitation is confirmed by CISA KEV. D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.
Sophos
SG UTM, Unified Threat Management
Known exploitation is confirmed by CISA KEV. A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
Filemanagerpro, WordPress
File Manager, File Manager Plugin
Known exploitation is confirmed by CISA KEV. The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php…
Apache, Blackberry +5 more
Agile Engineering Data Management, Agile Plm, Communications Element Manager +18 more
Known exploitation is confirmed by CISA KEV. When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP…
Debian, Fedoraproject +2 more
Debian Linux, Fedora, Leap +1 more
Known exploitation is confirmed by CISA KEV. An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
Ivanti, Mobileiron
Core, Enterprise Connector, MobileIron Multiple Products +2 more
Known exploitation is confirmed by CISA KEV. A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor…
Oracle
WebLogic Server
Known exploitation is confirmed by CISA KEV. Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with…
Oracle
WebLogic Server
Known exploitation is confirmed by CISA KEV. Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with…
Apache
Airflow, Airflow's Experimental API
Known exploitation is confirmed by CISA KEV. The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default…
Canonical, Debian +3 more
Application Remote Collector, Debian Linux, Leap +2 more
Known exploitation is confirmed by CISA KEV. An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some…
Zoho, Zohocorp
ManageEngine, Manageengine Desktop Central
Known exploitation is confirmed by CISA KEV. Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
Microsoft
.NET Framework
Known exploitation is confirmed by CISA KEV. A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
Synacor
Zimbra Collaboration Suite, Zimbra Collaboration Suite (ZCS)
Known exploitation is confirmed by CISA KEV. mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
Elastic, Redhat
Kibana, Openshift Container Platform
Known exploitation is confirmed by CISA KEV. Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to…
Nice, Nortekcontrol
Linear eMerge E3-Series, Linear Emerge Elite Firmware, Linear Emerge Essential Firmware
Known exploitation is confirmed by CISA KEV. Linear eMerge E3-Series devices allow Command Injections.
Barco, Blackbox +6 more
Am-100 Firmware, Am-101 Firmware, Hd Wireless Presentation System Firmware +10 more
Known exploitation is confirmed by CISA KEV. The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP…
D-Link, Dlink
Dap-1533 Firmware, Dhp-1565 Firmware, Dir-615 Firmware +8 more
Known exploitation is confirmed by CISA KEV. Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface…
vBulletin
vBulletin
Known exploitation is confirmed by CISA KEV. vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
Nazgul, Nostromo
nhttpd, Nostromo Nhttpd
Known exploitation is confirmed by CISA KEV. Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
