Confirmed attacker activity
Vulnerabilities with confirmed exploitation evidence, ranked by the Cornish Geek Signal.
Updated 20 Aug 2026 · 02:18 UTC
1671 matching vulnerabilities
Kaseya
Virtual System/Server Administrator (VSA), Vsa Agent, Vsa Server
Known exploitation is confirmed by CISA KEV. Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can…
ConnectWise, Kaseya
Manageditsync, Virtual System/Server Administrator (VSA)
Known exploitation is confirmed by CISA KEV. ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this…
Oracle
WebLogic Server
Known exploitation is confirmed by CISA KEV. Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with…
SonicWall
Email Security, Email Security Appliance 3300 Firmware, Email Security Appliance 4300 Firmware +9 more
Known exploitation is confirmed by CISA KEV. A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
VMware
Cloud Foundation, ESXi
Known exploitation is confirmed by CISA KEV. OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port…
SonicWall
Sma 100 Firmware, SMA100
Known exploitation is confirmed by CISA KEV. Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.
Dtsearch, RARLAB
Dtsearch, WinRAR
Known exploitation is confirmed by CISA KEV. A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered…
Microsoft
Windows, Windows 10 1809, Windows 10 21h2 +7 more
Known exploitation is confirmed by CISA KEV. Internet Shortcut Files Security Feature Bypass Vulnerability
Microsoft
Windows, Windows 10 1507, Windows 10 1607 +14 more
Known exploitation is confirmed by CISA KEV. A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code…
Apache, Netapp +1 more
7-mode Transition Tool, Enterprise Linux Desktop, Enterprise Linux Eus +19 more
Known exploitation is confirmed by CISA KEV. When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP…
Qlik
Qlik Sense, Sense
Known exploitation is confirmed by CISA KEV. An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier,…
RARLAB
WinRAR
Known exploitation is confirmed by CISA KEV. RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include…
Check Point, Checkpoint
Gaia Embedded, Gaia Os, Security Gateway
Known exploitation is confirmed by CISA KEV. A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN…
SmarterTools
SmarterMail
Known exploitation is confirmed by CISA KEV. SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves…
Cyberpanel, CyberPersons
CyberPanel
Known exploitation is confirmed by CISA KEV. upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request)…
Fortinet
FortiOS, Fortiproxy
Known exploitation is confirmed by CISA KEV. A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through…
Ivanti
Connect Secure, Policy Secure, and Neurons +1 more
Known exploitation is confirmed by CISA KEV. A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain…
Ivanti
Connect Secure, Connect Secure and Policy Secure, Policy Secure
Known exploitation is confirmed by CISA KEV. An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
Citrix
NetScaler ADC and NetScaler Gateway, Netscaler Application Delivery Controller, Netscaler Gateway
Known exploitation is confirmed by CISA KEV. Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Fortinet
FortiOS, FortiOS and FortiProxy SSL-VPN, Fortiproxy
Known exploitation is confirmed by CISA KEV. A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9…
Nextgen, NextGen Healthcare
Mirth Connect
Known exploitation is confirmed by CISA KEV. NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
Progress
WS_FTP Server
Known exploitation is confirmed by CISA KEV. In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP…
Microsoft
Exchange Server
Known exploitation is confirmed by CISA KEV. Microsoft Exchange Server Remote Code Execution Vulnerability
QNAP
Photo Station
Known exploitation is confirmed by CISA KEV. An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already…
QNAP
Hybrid Backup Sync, Network Attached Storage (NAS)
Known exploitation is confirmed by CISA KEV. An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This…
