Confirmed attacker activity
Vulnerabilities with confirmed exploitation evidence, ranked by the Cornish Geek Signal.
Updated 20 Aug 2026 · 08:54 UTC
1671 matching vulnerabilities
Gladinet
CentreStack
Known exploitation is confirmed by CISA KEV. Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who…
Kentico
Xperience, Xperience CMS
Known exploitation is confirmed by CISA KEV. An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative…
Wazuh
Wazuh, Wazuh Server
Known exploitation is confirmed by CISA KEV. Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code…
React Native Community
CLI, React Native Community Cli
Known exploitation is confirmed by CISA KEV. The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This…
Palo Alto Networks, Paloaltonetworks
PAN-OS
Known exploitation is confirmed by CISA KEV. An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management…
Palo Alto Networks, Paloaltonetworks
Expedition
Known exploitation is confirmed by CISA KEV. An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers…
Ivanti
Cloud Services Appliance (CSA), Endpoint Manager Cloud Services Appliance
Known exploitation is confirmed by CISA KEV. Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
Samsung
MagicINFO 9 Server
Known exploitation is confirmed by CISA KEV. Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
Palo Alto Networks, Paloaltonetworks
Expedition
Known exploitation is confirmed by CISA KEV. Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding…
ServiceNow
Servicenow, Utah, Vancouver +1 more
Known exploitation is confirmed by CISA KEV. ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within…
Simple-help, SimpleHelp
SimpleHelp
Known exploitation is confirmed by CISA KEV. SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the…
Craft CMS, Craftcms
Craft CMS
Known exploitation is confirmed by CISA KEV. Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled.…
ServiceNow
Servicenow, Utah, Vancouver +1 more
Known exploitation is confirmed by CISA KEV. ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context…
Fortinet
FortiManager, Fortimanager Cloud
Known exploitation is confirmed by CISA KEV. A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud…
Apache, Netapp +1 more
HTTP Server, Ontap 9, Sma 200 Firmware +4 more
Known exploitation is confirmed by CISA KEV. Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are…
Ivanti
Endpoint Manager, Endpoint Manager (EPM)
Known exploitation is confirmed by CISA KEV. An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
Cisco
Smart License Utility, Smart Licensing Utility
Known exploitation is confirmed by CISA KEV. A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an…
BeyondTrust
Privileged Remote Access, Privileged Remote Access (PRA) and Remote Support (RS), Remote Support
Known exploitation is confirmed by CISA KEV. A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
GitLab
GitLab, GitLab CE/EE
Known exploitation is confirmed by CISA KEV. An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6,…
Digiever
DS-2105 Pro, Ds-2105 Pro+ Firmware
Known exploitation is confirmed by CISA KEV. Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Bandisoft, Bentley +7 more
Active Iq Unified Manager, Chrome, Chromium WebP +10 more
Known exploitation is confirmed by CISA KEV. Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium…
Juniper
Junos, Junos OS
Known exploitation is confirmed by CISA KEV. A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request…
Barracuda, Barracuda Networks
Email Security Gateway (ESG) Appliance, Email Security Gateway 300 Firmware, Email Security Gateway 400 Firmware +3 more
Known exploitation is confirmed by CISA KEV. A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing…
Microsoft
Sharepoint Enterprise Server, SharePoint Server
Known exploitation is confirmed by CISA KEV. Microsoft SharePoint Server Remote Code Execution Vulnerability
Citrix
Content Collaboration, Sharefile Storage Zones Controller
Known exploitation is confirmed by CISA KEV. A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
