Confirmed attacker activity
Vulnerabilities with confirmed exploitation evidence, ranked by the Cornish Geek Signal.
Updated 20 Aug 2026 · 16:12 UTC
1671 matching vulnerabilities
Ivanti
Endpoint Manager, Endpoint Manager (EPM)
Known exploitation is confirmed by CISA KEV. An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
3ds, Dassault Systèmes
DELMIA Apriso
Known exploitation is confirmed by CISA KEV. An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.
3ds, Dassault Systèmes
DELMIA Apriso
Known exploitation is confirmed by CISA KEV. A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.
Fortinet, Siemens
FortiOS, Fortiproxy, Fortiswitchmanager +2 more
Known exploitation is confirmed by CISA KEV. A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through…
Geoserver, OSGeo
GeoServer
Known exploitation is confirmed by CISA KEV. GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified.…
SysAid
Sysaid, SysAid On-Prem
Known exploitation is confirmed by CISA KEV. SysAid On-Prem versions
D-Link, Dlink
DIR-823X, Dir-823x Firmware
Known exploitation is confirmed by CISA KEV. A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function,…
Cisco
Identity Services Engine, Identity Services Engine Passive Identity Connector
Known exploitation is confirmed by CISA KEV. A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does…
Edimax
Ic-7100 Firmware, IC-7100 IP Camera
Known exploitation is confirmed by CISA KEV. Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device
Ivanti
Cloud Services Appliance
Known exploitation is confirmed by CISA KEV. An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level…
AMI, Netapp
H300s Firmware, H410c Firmware, H410s Firmware +8 more
Known exploitation is confirmed by CISA KEV. AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of…
Microsoft
Windows, Windows 10 1507, Windows 10 1607 +12 more
Known exploitation is confirmed by CISA KEV. Windows MSHTML Platform Spoofing Vulnerability
Fortinet
FortiOS, Fortipam, Fortiproxy +2 more
Known exploitation is confirmed by CISA KEV. A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions…
Canonical, Debian +5 more
Bootstrap Os, Codeready Linux Builder, Codeready Linux Builder Eus +37 more
Known exploitation is confirmed by CISA KEV. A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment…
QNAP
Qvr Firmware, VioStor NVR
Known exploitation is confirmed by CISA KEV. An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a…
MinIO
MinIO
Known exploitation is confirmed by CISA KEV. Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All…
Cisco
Cisco IOS XE Web UI, Ios Xe
Known exploitation is confirmed by CISA KEV. A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient…
Microsoft
Defender, Windows 10 1607, Windows 10 1809 +8 more
Known exploitation is confirmed by CISA KEV. Windows SmartScreen Security Feature Bypass Vulnerability
Oracle
ADF Faces, Application Development Framework
Known exploitation is confirmed by CISA KEV. Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with…
Grafana, Grafana Labs
Grafana
Known exploitation is confirmed by CISA KEV. Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path…
D-Link, Dlink
DIR-605 Router, Dir-605l Firmware
Known exploitation is confirmed by CISA KEV. An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
Delta Electronics, Deltaww
Dopsoft, DOPSoft 2
Known exploitation is confirmed by CISA KEV. Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this…
Brocade, Linux +1 more
Aff 500f Firmware, Aff A250 Firmware, Aff A400 Firmware +19 more
Known exploitation is confirmed by CISA KEV. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
Adminer, Debian
Adminer, Debian Linux
Known exploitation is confirmed by CISA KEV. Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all…
Ivanti
Connect Secure, Policy Secure, Pulse Connect Secure
Known exploitation is confirmed by CISA KEV. A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
