CVEs used in ransomware attacks, newest first
Filter
The CVEs CISA's Known Exploited Vulnerabilities catalog marks as used in ransomware campaigns, newest first, with CVSS, EPSS and fixes for each. Narrow it: in CISA KEV · critical. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, New CVEs today, This week, Patch Tuesday
- 9.8CVE-2026-59310KEVEPSS 62%
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
- 5.3CVE-2026-20316KEVEPSS 35%
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within t…
- 9.8CVE-2026-63077KEVExploitEPSS 95%
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
- 7.2CVE-2026-15410KEVEPSS 12%
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated …
- 10.0CVE-2026-15409KEVExploitEPSS 6.8%
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
- 9.3CVE-2026-12569KEVEPSS 46%
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS v…
- 9.8CVE-2026-35273KEVExploitEPSS 97%
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticate…
- 9.3CVE-2026-50751KEVExploitEPSS 85%
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a…
- 9.3CVE-2026-48027KEVEPSS 1.8%
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Market…
- 8.8CVE-2026-45659KEVEPSS 80%
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- 7.8CVE-2026-0257KEVExploitEPSS 96%
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW…
- 9.6CVE-2026-45321KEVEPSS 3.3%
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher bi…
- 9.3CVE-2026-41940KEVExploitEPSS 99%
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
- 7.8CVE-2026-33825KEVEPSS 6.9%
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- 10.0CVE-2026-20131KEVEPSS 44%
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vuln…
- 9.9CVE-2026-1731KEVExploitEPSS 94%
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attack…
- 9.3CVE-2026-24423KEVExploitEPSS 88%
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the ma…
- 9.3CVE-2026-23760KEVExploitEPSS 96%
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a res…
- 10.0CVE-2025-52691KEVExploitEPSS 86%
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
- 9.3CVE-2025-14733KEVEPSS 29%
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN…
- 10.0CVE-2025-55182KEVExploitEPSS 99.7%
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-…
- 7.8CVE-2025-60710KEVEPSS 4.6%
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
- 7.5CVE-2025-61884KEVExploitEPSS 96%
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network ac…
- 9.8CVE-2025-61882KEVExploitEPSS 99.7%
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated a…
- 9.8CVE-2025-26399KEVExploitEPSS 91%
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is…
- 9.8CVE-2025-10035KEVExploitEPSS 99.8%
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
- 8.4CVE-2025-8088KEVEPSS 94%
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov,…
- 9.8CVE-2025-53770KEVExploitEPSS >99.9%
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing a…
- 6.5CVE-2025-49706KEVExploitEPSS 99.8%
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- 8.8CVE-2025-49704KEVExploitEPSS >99.9%
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- 9.3CVE-2025-5777KEVExploitEPSS >99.9%
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
- 9.1CVE-2025-42999KEVEPSS 13%
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability…
- 9.8CVE-2025-31324KEVExploitEPSS 99.4%
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significa…
- 7.8CVE-2025-29824KEVEPSS 19%
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- 9.8CVE-2025-3248KEVExploitEPSS >99.9%
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
- 9.8CVE-2025-31161KEVExploitEPSS >99.9%
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port a…
- 9.8CVE-2025-22457KEVExploitEPSS >99.9%
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code e…
- 7.0CVE-2025-26633KEVExploitEPSS 30%
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
- 8.2CVE-2025-22225KEVEPSS 1.0%
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
- 8.1CVE-2025-24472KEVEPSS 7.2%
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior kno…
- 9.8CVE-2025-23006KEVEPSS 27%
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote u…
- 7.2CVE-2024-57728KEVExploitEPSS 64%
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in t…
- 7.5CVE-2024-57727KEVExploitEPSS 97%
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. Thes…
- 9.9CVE-2024-57726KEVExploitEPSS 66%
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
- 9.8CVE-2024-55591KEVExploitEPSS 94%
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-…
- 9.8CVE-2024-53704KEVExploitEPSS 95%
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
- 9.0CVE-2025-0282KEVExploitEPSS >99.9%
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve r…
- 9.8CVE-2024-55956KEVExploitEPSS 94%
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autor…
- 2.7CVE-2024-55550KEVExploitEPSS 38%
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to a…
- 9.8CVE-2024-11667KEVEPSS 3.0%
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.…