Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 419new in the last 7 days
- 8added as actively exploited
- 37critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-48172 Exploited |
Not yet scored | LiteSpeed cPanel Plugin Applications & supply chain |
LiteSpeed cPanel Plugin Privilege Escalation Vulnerability | 26 May 2026 |
| CVE-2026-9082 Exploited |
Not yet scored | Drupal Core Applications & supply chain |
Drupal Core SQL Injection Vulnerability | 22 May 2026 |
| CVE-2025-34291 Exploited |
Not yet scored | Langflow Langflow Operating systems & software |
Langflow Origin Validation Error Vulnerability | 21 May 2026 |
| CVE-2026-34926 Exploited |
Not yet scored | Trend Micro Apex One Operating systems & software |
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability | 21 May 2026 |
| CVE-2026-41091 Exploited |
Not yet scored | Microsoft Defender Operating systems & software |
Microsoft Defender Link Following Vulnerability | 20 May 2026 |
| CVE-2026-45498 Exploited |
Not yet scored | Microsoft Defender Operating systems & software |
Microsoft Defender Denial of Service Vulnerability | 20 May 2026 |
| CVE-2008-4250 Exploited |
Not yet scored | Microsoft Windows Operating systems & software |
Microsoft Windows Buffer Overflow Vulnerability | 20 May 2026 |
| CVE-2009-1537 Exploited |
Not yet scored | Microsoft DirectX Operating systems & software |
Microsoft DirectX NULL Byte Overwrite Vulnerability | 20 May 2026 |
| CVE-2009-3459 Exploited |
Not yet scored | Adobe Acrobat and Reader Operating systems & software |
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | 20 May 2026 |
| CVE-2010-0249 Exploited |
Not yet scored | Microsoft Internet Explorer Operating systems & software |
Microsoft Internet Explorer Use-After-Free Vulnerability | 20 May 2026 |
| CVE-2010-0806 Exploited |
Not yet scored | Microsoft Internet Explorer Operating systems & software |
Microsoft Internet Explorer Use-After-Free Vulnerability | 20 May 2026 |
| CVE-2026-42897 Exploited |
Not yet scored | Microsoft Microsoft Operating systems & software |
Microsoft Exchange Server Cross-Site Scripting Vulnerability | 15 May 2026 |
| CVE-2026-20182 Exploited |
Not yet scored | Cisco Catalyst SD-WAN Network & security devices |
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability | 14 May 2026 |
| CVE-2026-42208 Exploited |
Not yet scored | BerriAI LiteLLM Applications & supply chain |
BerriAI LiteLLM SQL Injection Vulnerability | 8 May 2026 |
| CVE-2026-6973 Exploited |
Not yet scored | Ivanti Endpoint Manager Mobile (EPMM) Network & security devices |
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability | 7 May 2026 |
| CVE-2026-0300 Exploited |
Not yet scored | Palo Alto Networks PAN-OS Network & security devices |
Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability | 6 May 2026 |
| CVE-2026-31431 Exploited |
Not yet scored | Linux Kernel Operating systems & software |
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability | 1 May 2026 |
| CVE-2026-41940 Exploited |
Not yet scored | WebPros cPanel & WHM and WP2 (WordPress Squared) Applications & supply chain |
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability | 30 Apr 2026 |
| CVE-2024-1708 Exploited |
Not yet scored | ConnectWise ScreenConnect Operating systems & software |
ConnectWise ScreenConnect Path Traversal Vulnerability | 28 Apr 2026 |
| CVE-2026-32202 Exploited |
Not yet scored | Microsoft Windows Operating systems & software |
Microsoft Windows Protection Mechanism Failure Vulnerability | 28 Apr 2026 |
| CVE-2025-29635 Exploited |
Not yet scored | D-Link DIR-823X Operating systems & software |
D-Link DIR-823X Command Injection Vulnerability | 24 Apr 2026 |
| CVE-2024-7399 Exploited |
Not yet scored | Samsung MagicINFO 9 Server Operating systems & software |
Samsung MagicINFO 9 Server Path Traversal Vulnerability | 24 Apr 2026 |
| CVE-2024-57728 Exploited |
Not yet scored | SimpleHelp SimpleHelp Operating systems & software |
SimpleHelp Path Traversal Vulnerability | 24 Apr 2026 |
| CVE-2024-57726 Exploited |
Not yet scored | SimpleHelp SimpleHelp Applications & supply chain |
SimpleHelp Missing Authorization Vulnerability | 24 Apr 2026 |
| CVE-2026-39987 Exploited |
Not yet scored | Marimo Marimo Operating systems & software |
Marimo Remote Code Execution Vulnerability | 23 Apr 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.