Confirmed attacker activity
Vulnerabilities with confirmed exploitation evidence, ranked by the Cornish Geek Signal.
Updated 20 Aug 2026 · 11:25 UTC
1671 matching vulnerabilities
WatchGuard
Firebox, Fireware
Known exploitation is confirmed by CISA KEV. An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and…
Mitel
MiVoice Connect
Known exploitation is confirmed by CISA KEV. The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
Qlik
Qlik Sense, Sense
Known exploitation is confirmed by CISA KEV. A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and…
Amazon, Arista +8 more
Amazon Linux, Basesystem Module, Caas Platform +41 more
Known exploitation is confirmed by CISA KEV. In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is…
Joomlack
Page Builder, Page Builder Ck
Known exploitation is confirmed by CISA KEV. Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows…
SonicWall
SMA1000 Appliances, Sma6210 Firmware, Sma7210 Firmware +1 more
Known exploitation is confirmed by CISA KEV. Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as…
BerriAI, Litellm
LiteLLM
Known exploitation is confirmed by CISA KEV. LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks…
Langflow
Langflow
Known exploitation is confirmed by CISA KEV. Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token…
iCagenda, Joomlic
iCagenda
Known exploitation is confirmed by CISA KEV. A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
D-Link, Dlink
DIR-820L, Dir-820l Firmware
Known exploitation is confirmed by CISA KEV. D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.
Citrix
NetScaler, Netscaler Application Delivery Controller, Netscaler Gateway
Known exploitation is confirmed by CISA KEV. Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
Fortinet, Siemens
Fortianalyzer, FortiManager, Fortinac-f +5 more
Known exploitation is confirmed by CISA KEV. An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0…
Ivanti
Endpoint Manager Mobile, Endpoint Manager Mobile (EPMM)
Known exploitation is confirmed by CISA KEV. A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Ivanti
Endpoint Manager Mobile, Endpoint Manager Mobile (EPMM)
Known exploitation is confirmed by CISA KEV. A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
3ds, Dassault Systèmes
DELMIA Apriso
Known exploitation is confirmed by CISA KEV. A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
Ivanti
Endpoint Manager Mobile, Endpoint Manager Mobile (EPMM)
Known exploitation is confirmed by CISA KEV. An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
Smartbedded
Meteobridge, Meteobridge Firmware, Meteobridge Vm
Known exploitation is confirmed by CISA KEV. The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface…
SolarWinds
Web Help Desk
Known exploitation is confirmed by CISA KEV. SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the…
Gladinet
Triofox
Known exploitation is confirmed by CISA KEV. Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
Yiiframework
Yii
Known exploitation is confirmed by CISA KEV. Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
NAKIVO
Backup & Replication Director, Backup and Replication
Known exploitation is confirmed by CISA KEV. NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).
Apache
OFBiz
Known exploitation is confirmed by CISA KEV. Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
SolarWinds
Serv-U
Known exploitation is confirmed by CISA KEV. SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
SolarWinds
Web Help Desk
Known exploitation is confirmed by CISA KEV. SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While…
SolarWinds
Web Help Desk
Known exploitation is confirmed by CISA KEV. The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
