| CVE | Vendor · product | Added to KEV | Due | EPSS | APAC news |
|---|---|---|---|---|---|
| CVE-2010-0249
Microsoft Internet Explorer Use-After-Free Vulnerability |
Microsoft · Internet Explorer | May 20, 2026 | Jun 3, 2026 | 91.9% | — |
| CVE-2020-8657
EyesOfNetwork Use of Hard-Coded Credentials Vulnerability |
EyesOfNetwork · EyesOfNetwork | Nov 3, 2021 | May 3, 2022 | 91.9% | — |
| CVE-2024-11680
ProjectSend Improper Authentication Vulnerability |
ProjectSend · ProjectSend | Dec 3, 2024 | Dec 24, 2024 | 91.8% | — |
| CVE-2021-42321 Ransomware
Microsoft Exchange Server Remote Code Execution Vulnerability |
Microsoft · Exchange | Nov 17, 2021 | Dec 1, 2021 | 91.7% | — |
| CVE-2024-5910
Palo Alto Networks Expedition Missing Authentication Vulnerability |
Palo Alto Networks · Expedition | Nov 7, 2024 | Nov 28, 2024 | 91.7% | — |
| CVE-2026-71362
Adobe Commerce and Magento Incorrect Authorization Vulnerability |
Adobe · Commerce and Magento | Sep 24, 2026 | Sep 27, 2026 | 91.7% | — |
| CVE-2018-11138 Ransomware
Quest KACE System Management Appliance Remote Command Execution Vulnerability |
Quest · KACE System Management Appliance | Mar 25, 2022 | Apr 15, 2022 | 91.6% | — |
| CVE-2022-26258
D-Link DIR-820L Remote Code Execution Vulnerability |
D-Link · DIR-820L | Sep 8, 2022 | Sep 29, 2022 | 91.6% | — |
| CVE-2026-93616
Check Point Multiple Products Path Traversal Vulnerability |
Check Point · Multiple Products | Sep 22, 2026 | Sep 25, 2026 | 91.6% | — |
| CVE-2026-3055
Citrix NetScaler Out-of-Bounds Read Vulnerability |
Citrix · NetScaler | Mar 30, 2026 | Apr 2, 2026 | 91.5% | — |
| CVE-2026-42271
BerriAI LiteLLM Command Injection Vulnerability |
BerriAI · LiteLLM | Jun 8, 2026 | Jun 22, 2026 | 91.4% | — |
| CVE-2012-5076
Oracle Java SE Sandbox Bypass Vulnerability |
Oracle · Java SE | Mar 28, 2022 | Apr 18, 2022 | 91.2% | — |
| CVE-2022-26352 Ransomware
dotCMS Unrestricted Upload of File Vulnerability |
dotCMS · dotCMS | Aug 25, 2022 | Sep 15, 2022 | 91.2% | — |
| CVE-2021-32648
October CMS Improper Authentication |
October CMS · October CMS | Jan 18, 2022 | Feb 1, 2022 | 91.2% | — |
| CVE-2012-0754
Adobe Flash Player Memory Corruption Vulnerability |
Adobe · Flash Player | Jun 8, 2022 | Jun 22, 2022 | 91.2% | — |
| CVE-2021-35211 Ransomware
SolarWinds Serv-U Remote Code Execution Vulnerability |
SolarWinds · Serv-U | Nov 3, 2021 | Nov 17, 2021 | 91.2% | — |
| CVE-2026-20182
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability |
Cisco · Catalyst SD-WAN | May 14, 2026 | May 17, 2026 | 91.1% | — |
| CVE-2025-64446
Fortinet FortiWeb Path Traversal Vulnerability |
Fortinet · FortiWeb | Nov 14, 2025 | Nov 21, 2025 | 91.1% | — |
| CVE-2024-13160
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability |
Ivanti · Endpoint Manager (EPM) | Mar 10, 2025 | Mar 31, 2025 | 91.0% | — |
| CVE-2020-8243
Ivanti Pulse Connect Secure Code Execution Vulnerability |
Ivanti · Pulse Connect Secure | Nov 3, 2021 | May 3, 2022 | 90.8% | — |
| CVE-2017-12149 Ransomware
Red Hat JBoss Application Server Remote Code Execution Vulnerability |
Red Hat · JBoss Application Server | Dec 10, 2021 | Jun 10, 2022 | 90.7% | — |
| CVE-2021-21315
System Information Library for Node.JS Command Injection |
Npm package · System Information Library for Node.JS | Jan 18, 2022 | Feb 1, 2022 | 90.7% | — |
| CVE-2019-17621
D-Link DIR-859 Router Command Execution Vulnerability |
D-Link · DIR-859 Router | Jun 29, 2023 | Jul 20, 2023 | 90.6% | — |
| CVE-2017-3066
Adobe ColdFusion Deserialization Vulnerability |
Adobe · ColdFusion | Feb 24, 2025 | Mar 17, 2025 | 90.6% | — |
| CVE-2025-26399 Ransomware
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability |
SolarWinds · Web Help Desk | Mar 9, 2026 | Mar 12, 2026 | 90.6% | — |
| CVE-2025-6218
RARLAB WinRAR Path Traversal Vulnerability |
RARLAB · WinRAR | Dec 9, 2025 | Dec 30, 2025 | 90.5% | — |
| CVE-2020-3952
VMware vCenter Server Information Disclosure Vulnerability |
VMware · vCenter Server | Nov 3, 2021 | May 3, 2022 | 90.4% | — |
| CVE-2024-40711 Ransomware
Veeam Backup and Replication Deserialization Vulnerability |
Veeam · Backup & Replication | Oct 17, 2024 | Nov 7, 2024 | 90.4% | — |
| CVE-2023-40044 Ransomware
Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability |
Progress · WS_FTP Server | Oct 5, 2023 | Oct 26, 2023 | 90.4% | — |
| CVE-2016-8735
Apache Tomcat Remote Code Execution Vulnerability |
Apache · Tomcat | May 12, 2023 | Jun 2, 2023 | 90.3% | — |
| CVE-2021-20123
Draytek VigorConnect Path Traversal Vulnerability |
DrayTek · VigorConnect | Sep 3, 2024 | Sep 24, 2024 | 90.3% | — |
| CVE-2023-41763
Microsoft Skype for Business Privilege Escalation Vulnerability |
Microsoft · Skype for Business | Oct 10, 2023 | Oct 31, 2023 | 90.3% | — |
| CVE-2018-4878 Ransomware
Adobe Flash Player Use-After-Free Vulnerability |
Adobe · Flash Player | Nov 3, 2021 | May 3, 2022 | 90.3% | — |
| CVE-2025-37164
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability |
Hewlett Packard Enterprise (HPE) · OneView | Jan 7, 2026 | Jan 28, 2026 | 90.2% | — |
| CVE-2020-29583
Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability |
Zyxel · Multiple Products | Nov 3, 2021 | May 3, 2022 | 90.2% | — |
| CVE-2013-0431 Ransomware
Oracle JRE Sandbox Bypass Vulnerability |
Oracle · Java Runtime Environment (JRE) | May 25, 2022 | Jun 15, 2022 | 90.1% | — |
| CVE-2009-3960 Ransomware
Adobe BlazeDS Information Disclosure Vulnerability |
Adobe · BlazeDS | Mar 7, 2022 | Sep 7, 2022 | 90.1% | — |
| CVE-2026-34910
Ubiquiti UniFi OS Improper Input Validation Vulnerability |
Ubiquiti · UniFi OS | Jun 23, 2026 | Jun 26, 2026 | 90.0% | — |
| CVE-2017-8464
Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability |
Microsoft · Windows | Feb 10, 2022 | Aug 10, 2022 | 90.0% | — |
| CVE-2023-36844
Juniper Junos OS EX Series PHP External Variable Modification Vulnerability |
Juniper · Junos OS | Nov 13, 2023 | Nov 17, 2023 | 90.0% | — |
| CVE-2017-8570
Microsoft Office Remote Code Execution Vulnerability |
Microsoft · Office | Feb 25, 2022 | Aug 25, 2022 | 89.9% | — |
| CVE-2017-0146 Ransomware
Microsoft Windows SMB Remote Code Execution Vulnerability |
Microsoft · Windows | Mar 25, 2022 | Apr 15, 2022 | 89.9% | — |
| CVE-2017-0145 Ransomware
Microsoft SMBv1 Remote Code Execution Vulnerability |
Microsoft · SMBv1 | Feb 10, 2022 | Aug 10, 2022 | 89.8% | — |
| CVE-2024-13161
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability |
Ivanti · Endpoint Manager (EPM) | Mar 10, 2025 | Mar 31, 2025 | 89.8% | — |
| CVE-2020-17463
Fuel CMS SQL Injection Vulnerability |
Fuel CMS · Fuel CMS | Dec 10, 2021 | Jun 10, 2022 | 89.7% | — |
| CVE-2010-2568
Microsoft Windows Remote Code Execution Vulnerability |
Microsoft · Windows | Sep 15, 2022 | Oct 6, 2022 | 89.6% | — |
| CVE-2018-15982 Ransomware
Adobe Flash Player Use-After-Free Vulnerability |
Adobe · Flash Player | Feb 15, 2022 | Aug 15, 2022 | 89.6% | — |
| CVE-2026-42208
BerriAI LiteLLM SQL Injection Vulnerability |
BerriAI · LiteLLM | May 8, 2026 | May 11, 2026 | 89.4% | — |
| CVE-2010-3333
Microsoft Office Stack-based Buffer Overflow Vulnerability |
Microsoft · Office | Mar 3, 2022 | Mar 24, 2022 | 89.4% | — |
| CVE-2026-9082
Drupal Core SQL Injection Vulnerability |
Drupal · Core | May 22, 2026 | May 27, 2026 | 89.4% | — |
← Prev
10 / 10
Sources: CISA KEV and FIRST EPSS, refreshed daily. EPSS estimates the probability that a CVE is exploited in the next 30 days. CVEs named in the news but absent from KEV are listed under "In Asia-Pacific news" as well.