Confirmed attacker activity
Vulnerabilities with confirmed exploitation evidence, ranked by the Cornish Geek Signal.
Updated 20 Aug 2026 · 14:25 UTC
1671 matching vulnerabilities
Fedoraproject, Grafana +1 more
Fedora, Grafana
Known exploitation is confirmed by CISA KEV. Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key,…
Citrix
ShareFile, Sharefile Storagezones Controller
Known exploitation is confirmed by CISA KEV. Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.
Omnissa, Vmware
Workspace One UEM, Workspace One Uem Console
Known exploitation is confirmed by CISA KEV. VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious…
Apache, Npm package +1 more
Cordova, System Information Library for Node.JS, Systeminformation
Known exploitation is confirmed by CISA KEV. The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a…
Adobe
Acrobat, Acrobat and Reader, Acrobat Dc +2 more
Known exploitation is confirmed by CISA KEV. Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve…
Ivanti
Connect Secure, Pulse Connect Secure
Known exploitation is confirmed by CISA KEV. A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
Debian, Fedoraproject +2 more
Chrome, Chromium V8, Debian Linux +4 more
Known exploitation is confirmed by CISA KEV. Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Unraid
Unraid
Known exploitation is confirmed by CISA KEV. Unraid 6.8.0 allows authentication bypass.
Vmware, VMware Tanzu
Spring Cloud Config, Spring Cloud Configuration (Config) Server
Known exploitation is confirmed by CISA KEV. Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or…
Ibm
Data Risk Manager
Known exploitation is confirmed by CISA KEV. IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request,…
D-Link, Dlink
DCS-2530L and DCS-2670L Devices, Dcs-2530l Firmware, Dcs-2670l Firmware +7 more
Known exploitation is confirmed by CISA KEV. An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.
Microsoft
.net Core, .net Framework, .NET Framework +6 more
Known exploitation is confirmed by CISA KEV. A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server,…
Apache
Flink
Known exploitation is confirmed by CISA KEV. A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface…
Oracle
Weblogic Server
Known exploitation is confirmed by CISA KEV. Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker…
Oracle
Business Intelligence, Intelligence Enterprise Edition
Known exploitation is confirmed by CISA KEV. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with…
Awesomemotive, Wordpress
Duplicator, Snap Creek Duplicator Plugin
Known exploitation is confirmed by CISA KEV. The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.
Golang, Microsoft
Go, Windows, Windows 10 1507 +11 more
Known exploitation is confirmed by CISA KEV. A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable,…
Sonatype
Nexus Repository Manager
Known exploitation is confirmed by CISA KEV. Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
Drupal
Core, Drupal
Known exploitation is confirmed by CISA KEV. Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases.…
Debian, Fedoraproject +4 more
Cloudforms, Debian Linux, Fedora +4 more
Known exploitation is confirmed by CISA KEV. There is a File Content Disclosure vulnerability in Action View
Tvt
NVMS-1000, Nvms-1000 Firmware
Known exploitation is confirmed by CISA KEV. TVT NVMS-1000 devices allow GET /.. Directory Traversal
Cisco
Rv320 Firmware, Rv325 Firmware, Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers
Known exploitation is confirmed by CISA KEV. A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device…
Apache, Oracle
Primavera Unifier, Solr
Known exploitation is confirmed by CISA KEV. Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or…
Jenkins, Redhat
Openshift Container Platform, Script Security, Script Security Plugin
Known exploitation is confirmed by CISA KEV. A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Schneider-electric
U.motion Builder
Known exploitation is confirmed by CISA KEV. A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
