Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 419new in the last 7 days
- 8added as actively exploited
- 37critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2019-19006 Exploited |
Not yet scored | Sangoma FreePBX Operating systems & software |
Sangoma FreePBX Improper Authentication Vulnerability | 3 Feb 2026 |
| CVE-2025-40551 Exploited |
Not yet scored | SolarWinds Web Help Desk Operating systems & software |
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | 3 Feb 2026 |
| CVE-2026-1281 Exploited |
Not yet scored | Ivanti Endpoint Manager Mobile (EPMM) Network & security devices |
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | 29 Jan 2026 |
| CVE-2026-24858 Exploited |
Not yet scored | Fortinet Multiple Products Identity & access |
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability | 27 Jan 2026 |
| CVE-2018-14634 Exploited |
Not yet scored | Linux Kernel Operating systems & software |
Linux Kernel Integer Overflow Vulnerability | 26 Jan 2026 |
| CVE-2025-52691 Exploited |
Not yet scored | SmarterTools SmarterMail Operating systems & software |
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability | 26 Jan 2026 |
| CVE-2026-23760 Exploited |
Not yet scored | SmarterTools SmarterMail Applications & supply chain |
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability | 26 Jan 2026 |
| CVE-2026-24061 Exploited |
Not yet scored | GNU InetUtils Operating systems & software |
GNU InetUtils Argument Injection Vulnerability | 26 Jan 2026 |
| CVE-2026-21509 Exploited |
Not yet scored | Microsoft Office Operating systems & software |
Microsoft Office Security Feature Bypass Vulnerability | 26 Jan 2026 |
| CVE-2024-37079 Exploited |
Not yet scored | Broadcom VMware vCenter Server Operating systems & software |
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability | 23 Jan 2026 |
| CVE-2025-31125 Exploited |
Not yet scored | Vite Vitejs Operating systems & software |
Vite Vitejs Improper Access Control Vulnerability | 22 Jan 2026 |
| CVE-2025-54313 Exploited |
Not yet scored | Prettier eslint-config-prettier Applications & supply chain |
Prettier eslint-config-prettier Embedded Malicious Code Vulnerability | 22 Jan 2026 |
| CVE-2025-68645 Exploited |
Not yet scored | Synacor Zimbra Collaboration Suite (ZCS) Applications & supply chain |
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | 22 Jan 2026 |
| CVE-2025-34026 Exploited |
Not yet scored | Versa Concerto Operating systems & software |
Versa Concerto Improper Authentication Vulnerability | 22 Jan 2026 |
| CVE-2026-20045 Exploited |
Not yet scored | Cisco Unified Communications Manager Network & security devices |
Cisco Unified Communications Products Code Injection Vulnerability | 21 Jan 2026 |
| CVE-2026-20805 Exploited |
Not yet scored | Microsoft Windows Operating systems & software |
Microsoft Windows Information Disclosure Vulnerability | 13 Jan 2026 |
| CVE-2025-8110 Exploited |
Not yet scored | Gogs Gogs Applications & supply chain |
Gogs Path Traversal Vulnerability | 12 Jan 2026 |
| CVE-2009-0556 Exploited |
Not yet scored | Microsoft Office Operating systems & software |
Microsoft Office PowerPoint Code Injection Vulnerability | 7 Jan 2026 |
| CVE-2025-37164 Exploited |
Not yet scored | Hewlett Packard Enterprise (HPE) OneView Operating systems & software |
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability | 7 Jan 2026 |
| CVE-2025-14847 Exploited |
Not yet scored | MongoDB MongoDB and MongoDB Server Operating systems & software |
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability | 29 Dec 2025 |
| CVE-2023-52163 Exploited |
Not yet scored | Digiever DS-2105 Pro Operating systems & software |
Digiever DS-2105 Pro Missing Authorization Vulnerability | 22 Dec 2025 |
| CVE-2025-14733 Exploited |
Not yet scored | WatchGuard Firebox Network & security devices |
WatchGuard Firebox Out of Bounds Write Vulnerability | 19 Dec 2025 |
| CVE-2025-20393 Exploited |
Not yet scored | Cisco Multiple Products Network & security devices |
Cisco Multiple Products Improper Input Validation Vulnerability | 17 Dec 2025 |
| CVE-2025-59374 Exploited |
Not yet scored | ASUS Live Update Applications & supply chain |
ASUS Live Update Embedded Malicious Code Vulnerability | 17 Dec 2025 |
| CVE-2025-40602 Exploited |
Not yet scored | SonicWall SMA1000 appliance Network & security devices |
SonicWall SMA1000 Missing Authorization Vulnerability | 17 Dec 2025 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.