Confirmed attacker activity
Vulnerabilities with confirmed exploitation evidence, ranked by the Cornish Geek Signal.
Updated 20 Aug 2026 · 08:13 UTC
1671 matching vulnerabilities
Ubiquiti, Ui
Enterprise Fortress Gateway Firmware, Enterprise Network Video Recorder Core Firmware, Enterprise Network Video Recorder Firmware +29 more
Known exploitation is confirmed by CISA KEV. A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
Ubiquiti, Ui
Enterprise Fortress Gateway Firmware, Enterprise Network Video Recorder Core Firmware, Enterprise Network Video Recorder Firmware +29 more
Known exploitation is confirmed by CISA KEV. A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
Drupal
Core, Drupal
Known exploitation is confirmed by CISA KEV. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before…
WordPress
Core, Wordpress
Known exploitation is confirmed by CISA KEV. WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker…
Fortinet
FortiSandbox
Known exploitation is confirmed by CISA KEV. A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via
ProjectSend
ProjectSend
Known exploitation is confirmed by CISA KEV. ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's…
Progress
Kemp LoadMaster, LoadMaster
Known exploitation is confirmed by CISA KEV. Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
JoomShaper, Ollyo
SP Page Builder
Known exploitation is confirmed by CISA KEV. A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
Sangoma
FreePBX
Known exploitation is confirmed by CISA KEV. FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database…
Cisco
Catalyst SD-WAN Controller and Manager, Catalyst SD-WAN Manager, Sd-wan Vbond Orchestrator +1 more
Known exploitation is confirmed by CISA KEV. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an…
Cisco
Catalyst SD-WAN, Catalyst SD-WAN Manager, Sd-wan Vbond Orchestrator +1 more
Known exploitation is confirmed by CISA KEV. May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a…
Coreweave, Marimo
Marimo
Known exploitation is confirmed by CISA KEV. marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY…
Langflow
Langflow
Known exploitation is confirmed by CISA KEV. Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data…
Fortinet
FortiClient EMS, Forticlientems
Known exploitation is confirmed by CISA KEV. An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted…
n8n
n8n
Known exploitation is confirmed by CISA KEV. n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation…
Fortinet
FortiWeb
Known exploitation is confirmed by CISA KEV. A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to…
Oracle
Fusion Middleware, Identity Manager
Known exploitation is confirmed by CISA KEV. Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via…
CrushFTP
CrushFTP
Known exploitation is confirmed by CISA KEV. CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited…
Adobe
Experience Manager (AEM) Forms, Experience Manager Forms
Known exploitation is confirmed by CISA KEV. Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute…
Adobe
Commerce, Commerce and Magento, Commerce B2b +1 more
Known exploitation is confirmed by CISA KEV. Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality,…
Laravel
Livewire
Known exploitation is confirmed by CISA KEV. Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from…
Debian, Roundcube
Debian Linux, Webmail
Known exploitation is confirmed by CISA KEV. Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
Control-webpanel, CWP
Control Web Panel, Webpanel
Known exploitation is confirmed by CISA KEV. CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username…
Hewlett Packard Enterprise (HPE), Hpe
OneView
Known exploitation is confirmed by CISA KEV. A remote code execution issue exists in HPE OneView.
Commvault
Command Center, Commvault
Known exploitation is confirmed by CISA KEV. The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that…
