CVE-20XX-?
agent?

Being exploited right now.

CVEs that CISA lists as exploited in real attacks, newest additions first.

9 CVEs · updated 2026-11-06 21:11 UTC

Reset all
  1. CVE-2021-44228

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

    Drop everything exploited Code execution Device Siemens 6bk1602-0aa12-0tp0 Firmware

    10.0 CRITICAL 100% exploit odds Fix listed
  2. CVE-2014-8361

    The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

    Drop everything exploited Code execution Device Dlink dir-905l Firmware

    9.8 CRITICAL 100% exploit odds Fix listed
  3. CVE-2026-110936

    A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

    exploited Code execution Device Siemens Software Center

    8.4 HIGH 1.0% exploit odds Fix listed
  4. CVE-2018-4063

    An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.

    exploited Code execution Device Sierrawireless Aleos

    8.8 HIGH 27% exploit odds No fix listed
  5. CVE-2022-27518

    Unauthenticated remote arbitrary code execution

    exploited Code execution Device Citrix Application Delivery Controller Firmware

    9.8 CRITICAL 7% exploit odds Fix listed
  6. CVE-2024-41710

    A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.

    exploited Code execution Device Mitel 6970 Firmware

    7.2 HIGH 42% exploit odds Fix listed
  7. CVE-2026-6973

    An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.

    exploited Code execution Device Ivanti Endpoint Manager Mobile

    7.2 HIGH 34% exploit odds Fix listed
  8. CVE-2023-41061

    A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

    exploited Code execution Device Apple Ipados

    7.8 HIGH 4% exploit odds Fix listed
  9. CVE-2022-22265

    An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.

    exploited Code execution Device Google Android

    5.0 MEDIUM 0.4% exploit odds Fix listed

These CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using them in real attacks. Each entry shows severity, exploit odds, fix status and a timeline.