Known exploited vulnerabilities attackers are sending now
CVEs on CISA's Known Exploited Vulnerabilities list that attackers sent to our interactive sensors in the last 7 days. Those sensors let the exploit land and record what follows, so a session counts only when its payload proved the exploit. Entries CISA added in the last 30 days come first.
| CVE | Vulnerability | On KEV since | Attempts | Sources | Sessions | Watch | |
|---|---|---|---|---|---|---|---|
| CVE-2026-96656 | Plex Media Server TranscoderH264Options dump-yuv arbitrary file writePlex2Shell stage 4 | 20 Oct 2026new | 265 | 7 | 120 | 265 attempts from 7 sources, on KEV since 20 Oct 2026, new | Watch |
| CVE-2026-96655 | Plex Media Server transcoder path parameter SSRFPlex2Shell stage 4 | 20 Oct 2026new | 211 | 7 | 94 | 211 attempts from 7 sources, on KEV since 20 Oct 2026, new | Watch |
| CVE-2026-96654 | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | 20 Oct 2026new | 82 | 9 | 50 | 82 attempts from 9 sources, on KEV since 20 Oct 2026, new | Watch |
| CVE-2026-96652 | Plex Media Server /player/timeline protocol SSRFPlex2Shell stage 1 | 20 Oct 2026new | 104 | 10 | 27 | 104 attempts from 10 sources, on KEV since 20 Oct 2026, new | Watch |
| CVE-2026-119977 | WordPress core staged update installer under wp-content/upgrade | 3 Nov 2026new | 11 | 3 | 3 | 11 attempts from 3 sources, on KEV since 3 Nov 2026, new | Watch |
| CVE-2026-87902 | WordPress core pagename template path traversal | 25 Sept 2026 | 733 | 3 | 0 | 733 attempts from 3 sources, on KEV since 25 Sept 2026 | Watch |
| CVE-2017-9841 | PHPUnit - Remote Code Execution | 15 Feb 2022 | 329 | 16 | 28 | 329 attempts from 16 sources, on KEV since 15 Feb 2022 | Watch |
| CVE-2024-3272 | D-Link Network Attached Storage - Backdoor Account | 11 Apr 2024 | 189 | 9 | 188 | 189 attempts from 9 sources, on KEV since 11 Apr 2024 | Watch |
| CVE-2024-3273 | D-Link Network Attached Storage - Command Injection and Backdoor Account | 11 Apr 2024 | 188 | 8 | 188 | 188 attempts from 8 sources, on KEV since 11 Apr 2024 | Watch |
| CVE-2010-1428 | Red Hat JBoss - Web/JMX Console Access | 25 May 2022 | 78 | 4 | 0 | 78 attempts from 4 sources, on KEV since 25 May 2022 | Watch |
| CVE-2019-11043 | PHP-FPM Path Info Buffer Underflow - Remote Code Execution | 25 Mar 2022 | 72 | 4 | 0 | 72 attempts from 4 sources, on KEV since 25 Mar 2022 | Watch |
| CVE-2026-41940 | cPanel & WHM - Authentication Bypass via Session-File CRLF Injection | 30 Apr 2026 | 54 | 6 | 0 | 54 attempts from 6 sources, on KEV since 30 Apr 2026 | Watch |
| CVE-2018-13379 | Fortinet FortiOS SSL VPN path traversal | 3 Nov 2021 | 41 | 15 | 8 | 41 attempts from 15 sources, on KEV since 3 Nov 2021 | Watch |
| CVE-2026-1340 | Ivanti EPMM < 12.8.0.0 - Remote Code Execution | 8 Apr 2026 | 37 | 5 | 0 | 37 attempts from 5 sources, on KEV since 8 Apr 2026 | Watch |
| CVE-2026-1281 | Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection | 29 Jan 2026 | 36 | 4 | 0 | 36 attempts from 4 sources, on KEV since 29 Jan 2026 | Watch |
| CVE-2025-31324 | SAP NetWeaver Visual Composer Metadata Uploader - Deserialization | 29 Apr 2025 | 21 | 20 | 0 | 21 attempts from 20 sources, on KEV since 29 Apr 2025 | Watch |
| CVE-2019-9082 | ThinkPHP invokefunction remote code execution | 3 Nov 2021 | 11 | 6 | 0 | 11 attempts from 6 sources, on KEV since 3 Nov 2021 | Watch |
| CVE-2021-36260 | Hikvision IP camera/NVR - Remote Command Execution | 10 Jan 2022 | 11 | 1 | 0 | 11 attempts from 1 sources, on KEV since 10 Jan 2022 | Watch |
| CVE-2025-0282 | Ivanti Connect Secure - Stack-based Buffer Overflow | 8 Jan 2025 | 10 | 5 | 0 | 10 attempts from 5 sources, on KEV since 8 Jan 2025 | Watch |
| CVE-2022-40684 | Fortinet - Authentication Bypass | 11 Oct 2022 | 9 | 5 | 7 | 9 attempts from 5 sources, on KEV since 11 Oct 2022 | Watch |
| CVE-2019-9621 | Zimbra Collaboration Suite - SSRF | 7 Jul 2025 | 8 | 8 | 0 | 8 attempts from 8 sources, on KEV since 7 Jul 2025 | Watch |
| CVE-2023-1389 | TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection | 1 May 2023 | 8 | 2 | 0 | 8 attempts from 2 sources, on KEV since 1 May 2023 | Watch |
| CVE-2021-41773 | Apache 2.4.49 - Path Traversal and Remote Code Execution | 3 Nov 2021 | 7 | 7 | 0 | 7 attempts from 7 sources, on KEV since 3 Nov 2021 | Watch |
| CVE-2021-43798 | Grafana v8.x - Arbitrary File Read | 9 Oct 2025 | 7 | 7 | 0 | 7 attempts from 7 sources, on KEV since 9 Oct 2025 | Watch |
| CVE-2021-42013 | Apache CGI Path Traversal / Self-Rep Payload | 3 Nov 2021 | 6 | 6 | 0 | 6 attempts from 6 sources, on KEV since 3 Nov 2021 | Watch |
| CVE-2021-26855 | Microsoft Exchange Server SSRF Vulnerability | 3 Nov 2021 | 5 | 5 | 0 | 5 attempts from 5 sources, on KEV since 3 Nov 2021 | Watch |
| CVE-2024-4577 | PHP CGI - Argument Injection | 12 Jun 2024 | 5 | 1 | 0 | 5 attempts from 1 sources, on KEV since 12 Jun 2024 | Watch |
| CVE-2018-10562 | Dasan GPON Devices - Remote Code Execution | 31 Mar 2022 | 4 | 4 | 0 | 4 attempts from 4 sources, on KEV since 31 Mar 2022 | Watch |
| CVE-2016-6277 | Netgear R7000 and related routers cgi-bin path command injection | 7 Mar 2022 | 3 | 3 | 0 | 3 attempts from 3 sources, on KEV since 7 Mar 2022 | Watch |
| CVE-2022-26134 | Confluence - Remote Code Execution | 2 Jun 2022 | 2 | 1 | 0 | 2 attempts from 1 sources, on KEV since 2 Jun 2022 | Watch |
| CVE-2025-24893 | XWiki Platform - Remote Code Execution | 30 Oct 2025 | 2 | 1 | 0 | 2 attempts from 1 sources, on KEV since 30 Oct 2025 | Watch |
| CVE-2026-58644 | Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE | 16 Jul 2026 | 2 | 1 | 0 | 2 attempts from 1 sources, on KEV since 16 Jul 2026 | Watch |
| CVE-2020-3452 | Cisco Adaptive Security Appliance (ASA)/Firepower Threat Defense (FTD) - Local File Inclusion | 3 Nov 2021 | 1 | 1 | 0 | 1 attempts from 1 sources, on KEV since 3 Nov 2021 | Watch |
| CVE-2021-3129 | Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution | 18 Sept 2023 | 1 | 1 | 0 | 1 attempts from 1 sources, on KEV since 18 Sept 2023 | Watch |
| CVE-2023-20198 | Cisco IOS XE Web UI - Command Injection | 16 Oct 2023 | 1 | 1 | 0 | 1 attempts from 1 sources, on KEV since 16 Oct 2023 | Watch |
| CVE-2023-40044 | WS_FTP Server - Insecure Deserialization | 5 Oct 2023 | 1 | 1 | 0 | 1 attempts from 1 sources, on KEV since 5 Oct 2023 | Watch |
| CVE-2024-0012 | PAN-OS Management Web Interface - Authentication Bypass | 18 Nov 2024 | 1 | 1 | 0 | 1 attempts from 1 sources, on KEV since 18 Nov 2024 | Watch |
| CVE-2025-64446 | FortiWeb - Authentication Bypass | 14 Nov 2025 | 1 | 1 | 0 | 1 attempts from 1 sources, on KEV since 14 Nov 2025 | Watch |
Attempts count requests to the interactive sensors that match the CVE; sources count distinct addresses. Watching a CVE saves it as a query with an email digest: daily on the free plan, hourly on Solo. The full list of CVEs probed on every sensor, KEV or not, is on the CVE page, and the dataset page explains how the counts are made.