KEVIntel - Known Exploited Vulnerabilities Catalog

CVE-2026-45659 - Confirmed Exploitation

Wed, 01 Jul 2026 19:00:06 +0000

CVE-2026-45659

Status: Confirmed

Exploited: Yes

Status Updated: 2026-07-01 19:00 UTC

Evidence Sources: 1

First Seen: 2026-07-01

Asserted: 2026-07-01

Scope Notes: KEVIntel entry: Microsoft SharePoint Remote Code Execution Vulnerability | Affected: Microsoft / Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition | CVSS: 8.8 (HIGH) | EPSS: 0.02781 | Used in malware: unknown | Not yet in CISA KEV: False

CVE-2026-8037 - Confirmed Exploitation

Wed, 01 Jul 2026 14:51:57 +0000

CVE-2026-8037

Status: Confirmed

Exploited: Yes

Status Updated: 2026-07-01 14:51 UTC

Evidence Sources: 1

First Seen: 2026-07-01

Asserted: 2026-07-01

Scope Notes: KEVIntel entry: OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF | Affected: Progress Software / LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF | CVSS: 9.6 (CRITICAL) | EPSS: 0.0819 | Used in malware: unknown | Not yet in CISA KEV: True

CVE-2026-52813 - Confirmed Exploitation

Tue, 30 Jun 2026 16:02:32 +0000

CVE-2026-52813

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-30 16:02 UTC

Evidence Sources: 1

First Seen: 2026-06-30

Asserted: 2026-06-30

CVE-2026-46817 - Confirmed Exploitation

Mon, 29 Jun 2026 15:45:00 +0000

CVE-2026-46817

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-29 15:45 UTC

Evidence Sources: 1

First Seen: 2026-06-29

Asserted: 2026-06-29

Scope Notes: KEVIntel entry: Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are... | Affected: Oracle Corporation / Oracle Payments | CVSS: 9.8 (CRITICAL) | EPSS: 0.00418 | Used in malware: unknown | Not yet in CISA KEV: True

CVE-2026-48558 - Confirmed Exploitation

Mon, 29 Jun 2026 14:20:22 +0000

CVE-2026-48558

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-29 14:20 UTC

Evidence Sources: 1

First Seen: 2026-06-29

Asserted: 2026-06-29

CVE-2026-8054 - Confirmed Exploitation

Sat, 27 Jun 2026 14:36:50 +0000

CVE-2026-8054

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-27 14:36 UTC

Evidence Sources: 1

First Seen: 2026-06-27

Asserted: 2026-06-27

CVE-2023-6567 - Confirmed Exploitation

Sat, 27 Jun 2026 14:36:38 +0000

CVE-2023-6567

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-27 14:36 UTC

Evidence Sources: 1

First Seen: 2026-06-27

Asserted: 2026-06-27

Scope Notes: KEVIntel entry: The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including,... | Affected: thimpress / LearnPress – WordPress LMS Plugin | CVSS: 9.8 (CRITICAL) | EPSS: 0.51394 | Used in malware: unknown | Not yet in CISA KEV: True

CVE-2026-12569 - Confirmed Exploitation

Thu, 25 Jun 2026 00:00:00 +0000

CVE-2026-12569

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-25 00:00 UTC

Evidence Sources: 1

First Seen: 2026-06-25

Asserted: 2026-06-25

CVE-2026-20230 - Confirmed Exploitation

Tue, 23 Jun 2026 22:20:36 +0000

CVE-2026-20230

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-23 22:20 UTC

Evidence Sources: 1

First Seen: 2026-06-23

Asserted: 2026-06-23

Scope Notes: KEVIntel entry: A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified... | Affected: Cisco / Cisco Unified Communications Manager | CVSS: 8.6 (HIGH) | EPSS: 0.20442 | Used in malware: unknown | Not yet in CISA KEV: True

CVE-2025-67038 - Confirmed Exploitation

Tue, 23 Jun 2026 00:00:00 +0000

CVE-2025-67038

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-23 00:00 UTC

Evidence Sources: 1

First Seen: 2026-06-23

Asserted: 2026-06-23

Scope Notes: KEVIntel entry: An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication... | Affected: Lantronix / EDS5000 | EPSS: 0.00469 | Used in malware: unknown | Not yet in CISA KEV: False

CVE-2026-4020 - Confirmed Exploitation

Wed, 17 Jun 2026 10:28:34 +0000

CVE-2026-4020

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-17 10:28 UTC

Evidence Sources: 1

First Seen: 2026-06-17

Asserted: 2026-06-17

CVE-2026-48907 - Confirmed Exploitation

Tue, 16 Jun 2026 00:00:00 +0000

CVE-2026-48907

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-16 00:00 UTC

Evidence Sources: 1

First Seen: 2026-06-16

Asserted: 2026-06-16

Scope Notes: KEVIntel entry: Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5 | Affected: joomlacontenteditor.net / Joomla Content Editor (JCE) extension for Joomla | CVSS: 10.0 (CRITICAL) | EPSS: 0.06854 | Used in malware: unknown | Not yet in CISA KEV: False

CVE-2026-39813 - Confirmed Exploitation

Mon, 15 Jun 2026 12:48:52 +0000

CVE-2026-39813

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-15 12:48 UTC

Evidence Sources: 1

First Seen: 2026-06-15

Asserted: 2026-06-15

Scope Notes: KEVIntel entry: A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to... | Affected: Fortinet / FortiSandbox, FortiSandbox Cloud | CVSS: 9.1 (CRITICAL) | EPSS: 0.18703 | Used in malware: unknown | Not yet in CISA KEV: True

CVE-2026-53435 - Confirmed Exploitation

Mon, 15 Jun 2026 09:02:00 +0000

CVE-2026-53435

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-15 09:02 UTC

Evidence Sources: 1

First Seen: 2026-06-15

Asserted: 2026-06-15

Scope Notes: KEVIntel entry: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins... | Affected: Jenkins Project / Jenkins | CVSS: 8.8 (HIGH) | EPSS: 0.00368 | Used in malware: unknown | Not yet in CISA KEV: True

CVE-2026-20253 - Confirmed Exploitation

Mon, 15 Jun 2026 05:15:25 +0000

CVE-2026-20253

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-15 05:15 UTC

Evidence Sources: 1

First Seen: 2026-06-15

Asserted: 2026-06-15

Scope Notes: KEVIntel entry: Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise | Affected: Splunk / Splunk Enterprise | CVSS: 9.8 (CRITICAL) | EPSS: 0.01731 | Used in malware: unknown | Not yet in CISA KEV: False

CVE-2026-20262 - Confirmed Exploitation

Mon, 15 Jun 2026 00:00:00 +0000

CVE-2026-20262

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-15 00:00 UTC

Evidence Sources: 1

First Seen: 2026-06-15

Asserted: 2026-06-15

CVE-2020-24949 - Confirmed Exploitation

Mon, 15 Jun 2026 00:00:00 +0000

CVE-2020-24949

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-15 00:00 UTC

Evidence Sources: 1

First Seen: 2026-06-15

Asserted: 2026-06-15

Scope Notes: KEVIntel entry: Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server... | Affected: PHP-Fusion / PHP-Fusion | CVSS: 8.8 (HIGH) | EPSS: 0.67516 | Used in malware: unknown | Not yet in CISA KEV: True

CVE-2017-15363 - Confirmed Exploitation

Mon, 15 Jun 2026 00:00:00 +0000

CVE-2017-15363

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-15 00:00 UTC

Evidence Sources: 1

First Seen: 2026-06-15

Asserted: 2026-06-15

Scope Notes: KEVIntel entry: Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension... | Affected: Luracast / Restler | CVSS: 7.5 (HIGH) | EPSS: 0.13649 | Used in malware: unknown | Not yet in CISA KEV: True

CVE-2017-9833 - Confirmed Exploitation

Mon, 15 Jun 2026 00:00:00 +0000

CVE-2017-9833

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-15 00:00 UTC

Evidence Sources: 1

First Seen: 2026-06-15

Asserted: 2026-06-15

Scope Notes: KEVIntel entry: /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges.... | Affected: Boa / Boa Web Server | CVSS: 7.5 (HIGH) | EPSS: 0.67725 | Used in malware: unknown | Not yet in CISA KEV: True

CVE-2023-31059 - Confirmed Exploitation

Mon, 15 Jun 2026 00:00:00 +0000

CVE-2023-31059

Status: Confirmed

Exploited: Yes

Status Updated: 2026-06-15 00:00 UTC

Evidence Sources: 1

First Seen: 2026-06-15

Asserted: 2026-06-15

Scope Notes: KEVIntel entry: Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php. | Affected: Repetier / Repetier Server | CVSS: 7.5 (HIGH) | EPSS: 0.05574 | Used in malware: unknown | Not yet in CISA KEV: True