# RCE security incidents · pwn.watch

> Security incidents tagged RCE (vendor, product, platform or attack type).

Page: https://pwn.watch/t/rce · generated 2026-10-22T16:23:59.585Z

## Status (as of 2026-10-22)
- Incidents: 188 (11 live, 4 live and not fully patched, 178 patched)
- Days without a RCE security incident: 0 (4 still unpatched, so the counter stays at 0)
- Newest incident started: 2026-10-21

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/rce.json
- RSS (every update): https://pwn.watch/t/rce/feed.xml
- This file: https://pwn.watch/t/rce/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)](https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce) ([json](https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce.json)): critical, live, patched, started 2026-10-21, CVE-2026-110264
- [Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)](https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml) ([json](https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml.json)): critical, live, unpatched, started 2026-10-21
- [ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)](https://pwn.watch/i/isc-bind-cve-2026-94300) ([json](https://pwn.watch/i/isc-bind-cve-2026-94300.json)): high, live, partial, started 2026-10-21, CVE-2026-94300
- [Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)](https://pwn.watch/i/nodejs-october-2026-security-releases) ([json](https://pwn.watch/i/nodejs-october-2026-security-releases.json)): high, live, patched, started 2026-10-21, CVE-2026-111497, CVE-2026-105482, CVE-2026-105483…
- [EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability](https://pwn.watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931) ([json](https://pwn.watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931.json)): high, live, patched, started 2026-10-20, CVE-2026-106931
- [PHP2Shell: critical unauthenticated RCE in PHP core](https://pwn.watch/i/php2shell-cve-2026-109618-109619) ([json](https://pwn.watch/i/php2shell-cve-2026-109618-109619.json)): critical, live, partial, started 2026-10-17, CVE-2026-109618, CVE-2026-109619
- [Plex2Shell: chained Plex Media Server RCE exploited for miners](https://pwn.watch/i/plex2shell-cve-2026-96652) ([json](https://pwn.watch/i/plex2shell-cve-2026-96652.json)): critical, live, patched, started 2026-10-16, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655…
- [Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)](https://pwn.watch/i/nextjs-october-2026-rce-security-release) ([json](https://pwn.watch/i/nextjs-october-2026-rce-security-release.json)): critical, live, patched, started 2026-10-14, CVE-2026-96889
- [Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability](https://pwn.watch/i/ahsay-ahsaycbs-cve-2026-105134) ([json](https://pwn.watch/i/ahsay-ahsaycbs-cve-2026-105134.json)): high, live, patched, started 2026-10-14, CVE-2026-105134, CVE-2026-105133
- [Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability](https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0322) ([json](https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0322.json)): high, live, patched, started 2026-10-14, CVE-2026-0322
- [Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root](https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935) ([json](https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935.json)): high, live, partial, started 2026-10-01, CVE-2026-104935
- [Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660.json)): high, closed, patched, started 2026-09-25, CVE-2026-65660
- [WordPress Core: WordPress Core Remote File Inclusion Vulnerability](https://pwn.watch/i/wordpress-core-cve-2026-87902) ([json](https://pwn.watch/i/wordpress-core-cve-2026-87902.json)): high, closed, patched, started 2026-09-25, CVE-2026-87902
- [N-able N-central: N-able N-central Static Code Injection Vulnerability](https://pwn.watch/i/n-able-n-central-cve-2026-86218) ([json](https://pwn.watch/i/n-able-n-central-cve-2026-86218.json)): high, closed, patched, started 2026-09-08, CVE-2026-86218
- [Kestra Kestra OSS: Kestra OSS OS Command Injection Vulnerability](https://pwn.watch/i/kestra-kestra-oss-cve-2026-49869) ([json](https://pwn.watch/i/kestra-kestra-oss-cve-2026-49869.json)): high, closed, patched, started 2026-09-02, CVE-2026-49869
- [Sangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerability](https://pwn.watch/i/sangoma-switchvox-cve-2026-9586) ([json](https://pwn.watch/i/sangoma-switchvox-cve-2026-9586.json)): high, closed, patched, started 2026-09-02, CVE-2026-9586
- [Gitea Gitea: Gitea Code Injection Vulnerability](https://pwn.watch/i/gitea-gitea-cve-2026-60004) ([json](https://pwn.watch/i/gitea-gitea-cve-2026-60004.json)): high, closed, patched, started 2026-08-25, CVE-2026-60004
- [Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability](https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2026-73570) ([json](https://pwn.watch/i/synacor-zimbra-collaboration-suite-zcs-cve-2026-73570.json)): high, closed, patched, started 2026-08-21, CVE-2026-73570
- [TrueConf Server: TrueConf Server Code Injection Vulnerability](https://pwn.watch/i/trueconf-server-cve-2026-72530) ([json](https://pwn.watch/i/trueconf-server-cve-2026-72530.json)): high, closed, patched, started 2026-08-20, CVE-2026-72530, CVE-2026-72529
- [Microsoft Internet Key Exchange (IKE) Service Extensions: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability](https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824) ([json](https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824.json)): high, closed, patched, started 2026-08-18, CVE-2026-33824
- [Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability](https://pwn.watch/i/ray-project-ray-cve-2025-62593) ([json](https://pwn.watch/i/ray-project-ray-cve-2025-62593.json)): high, closed, patched, started 2026-08-17, CVE-2025-62593
- [Progress LoadMaster: Progress LoadMaster Command Injection Vulnerability](https://pwn.watch/i/progress-loadmaster-cve-2026-8037) ([json](https://pwn.watch/i/progress-loadmaster-cve-2026-8037.json)): high, closed, patched, started 2026-08-07, CVE-2026-8037
- [JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077) ([json](https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077.json)): high, closed, patched, started 2026-08-05, CVE-2026-63077
- [IBM Langflow: IBM Langflow Code Injection Vulnerability](https://pwn.watch/i/ibm-langflow-cve-2026-9198) ([json](https://pwn.watch/i/ibm-langflow-cve-2026-9198.json)): high, closed, patched, started 2026-08-04, CVE-2026-9198
- [Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability](https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-16812) ([json](https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-16812.json)): high, closed, patched, started 2026-07-27, CVE-2026-16812
- [WordPress Core: WordPress Core SQL Injection Vulnerability](https://pwn.watch/i/wordpress-core-cve-2026-60137) ([json](https://pwn.watch/i/wordpress-core-cve-2026-60137.json)): high, closed, patched, started 2026-07-21, CVE-2026-60137, CVE-2026-63030
- [Fortinet FortiSandbox: Fortinet FortiSandbox OS Command Injection Vulnerability](https://pwn.watch/i/fortinet-fortisandbox-cve-2026-25089) ([json](https://pwn.watch/i/fortinet-fortisandbox-cve-2026-25089.json)): high, closed, patched, started 2026-07-16, CVE-2026-25089, CVE-2026-39808
- [Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability](https://pwn.watch/i/joomlack-page-builder-cve-2026-56290) ([json](https://pwn.watch/i/joomlack-page-builder-cve-2026-56290.json)): high, closed, patched, started 2026-07-07, CVE-2026-56290
- [Ivanti Sentry: Ivanti Sentry OS Command Injection Vulnerability](https://pwn.watch/i/ivanti-sentry-cve-2026-10520) ([json](https://pwn.watch/i/ivanti-sentry-cve-2026-10520.json)): high, closed, patched, started 2026-06-11, CVE-2026-10520
- [BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability](https://pwn.watch/i/berriai-litellm-cve-2026-42271) ([json](https://pwn.watch/i/berriai-litellm-cve-2026-42271.json)): high, closed, patched, started 2026-06-08, CVE-2026-42271, CVE-2026-48710
- [Drupal Core: Drupal Core SQL Injection Vulnerability](https://pwn.watch/i/drupal-core-cve-2026-9082) ([json](https://pwn.watch/i/drupal-core-cve-2026-9082.json)): high, closed, patched, started 2026-05-22, CVE-2026-9082
- [Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973) ([json](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-6973.json)): high, closed, patched, started 2026-05-07, CVE-2026-6973
- [Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability](https://pwn.watch/i/apache-activemq-cve-2026-34197) ([json](https://pwn.watch/i/apache-activemq-cve-2026-34197.json)): high, closed, patched, started 2026-04-16, CVE-2026-34197
- [F5 BIG-IP: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability](https://pwn.watch/i/f5-big-ip-cve-2025-53521) ([json](https://pwn.watch/i/f5-big-ip-cve-2025-53521.json)): high, closed, patched, started 2026-03-27, CVE-2025-53521
- [Langflow Langflow: Langflow Code Injection Vulnerability](https://pwn.watch/i/langflow-langflow-cve-2026-33017) ([json](https://pwn.watch/i/langflow-langflow-cve-2026-33017.json)): high, closed, patched, started 2026-03-25, CVE-2026-33017
- [Broadcom VMware Aria Operations: Broadcom VMware Aria Operations Command Injection Vulnerability](https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719) ([json](https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719.json)): high, closed, patched, started 2026-03-03, CVE-2026-22719
- [Roundcube Webmail: RoundCube Webmail Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/roundcube-webmail-cve-2025-49113) ([json](https://pwn.watch/i/roundcube-webmail-cve-2025-49113.json)): high, closed, patched, started 2026-02-20, CVE-2025-49113, CVE-2025-68461
- [BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln](https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731) ([json](https://pwn.watch/i/beyondtrust-remote-support-rs-and-privileged-remote-access-pra-cve-2026-1731.json)): high, closed, patched, started 2026-02-13, CVE-2026-1731
- [React Native Community CLI: React Native Community CLI OS Command Injection Vulnerability](https://pwn.watch/i/react-native-community-cli-cve-2025-11953) ([json](https://pwn.watch/i/react-native-community-cli-cve-2025-11953.json)): high, closed, patched, started 2026-02-05, CVE-2025-11953
- [Sangoma FreePBX : Sangoma FreePBX OS Command Injection Vulnerability](https://pwn.watch/i/sangoma-freepbx-cve-2025-64328) ([json](https://pwn.watch/i/sangoma-freepbx-cve-2025-64328.json)): high, closed, patched, started 2026-02-03, CVE-2025-64328
- [SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40551) ([json](https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40551.json)): high, closed, patched, started 2026-02-03, CVE-2025-40551
- [Ivanti EPMM code injection CVE-2026-1340 exploited](https://pwn.watch/i/ivanti-epmm-cve-2026-1340) ([json](https://pwn.watch/i/ivanti-epmm-cve-2026-1340.json)): critical, closed, patched, started 2026-01-29, CVE-2026-1340
- [Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281) ([json](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2026-1281.json)): high, closed, patched, started 2026-01-29, CVE-2026-1281
- [SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability](https://pwn.watch/i/smartertools-smartermail-cve-2025-52691) ([json](https://pwn.watch/i/smartertools-smartermail-cve-2025-52691.json)): high, closed, patched, started 2026-01-26, CVE-2025-52691, CVE-2026-23760
- [Cisco Unified Communications Manager: Cisco Unified Communications Products Code Injection Vulnerability](https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045) ([json](https://pwn.watch/i/cisco-unified-communications-manager-cve-2026-20045.json)): high, closed, patched, started 2026-01-21, CVE-2026-20045
- [Digiever DS-2105 Pro: DS-2105 Pro Missing Authorization Vulnerability](https://pwn.watch/i/digiever-ds-2105-pro-cve-2023-52163) ([json](https://pwn.watch/i/digiever-ds-2105-pro-cve-2023-52163.json)): high, closed, patched, started 2025-12-22, CVE-2023-52163
- [Array Networks ArrayOS AG: ArrayOS AG OS Command Injection Vulnerability](https://pwn.watch/i/array-networks-arrayos-ag-cve-2025-66644) ([json](https://pwn.watch/i/array-networks-arrayos-ag-cve-2025-66644.json)): high, closed, patched, started 2025-12-08, CVE-2025-66644
- [React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js](https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182) ([json](https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182.json)): critical, closed, patched, started 2025-12-03, CVE-2025-55182
- [Fortinet FortiWeb: FortiWeb OS Command Injection Vulnerability](https://pwn.watch/i/fortinet-fortiweb-cve-2025-58034) ([json](https://pwn.watch/i/fortinet-fortiweb-cve-2025-58034.json)): medium, closed, patched, started 2025-11-18, CVE-2025-58034
- [CWP Control Web Panel: Control Web Panel OS Command Injection Vulnerability](https://pwn.watch/i/cwp-control-web-panel-cve-2025-48703) ([json](https://pwn.watch/i/cwp-control-web-panel-cve-2025-48703.json)): critical, closed, patched, started 2025-11-04, CVE-2025-48703
- [XWiki Platform: Platform Eval Injection Vulnerability](https://pwn.watch/i/xwiki-platform-cve-2025-24893) ([json](https://pwn.watch/i/xwiki-platform-cve-2025-24893.json)): critical, closed, patched, started 2025-10-30, CVE-2025-24893
- [Dassault Systèmes DELMIA Apriso: 2 exploited vulnerabilities (CVE-2025-6204, CVE-2025-6205)](https://pwn.watch/i/dassault-systemes-delmia-apriso-cve-2025-6204) ([json](https://pwn.watch/i/dassault-systemes-delmia-apriso-cve-2025-6204.json)): critical, closed, patched, started 2025-10-28, CVE-2025-6204, CVE-2025-6205
- [Microsoft Windows: Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-59287) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-59287.json)): critical, closed, patched, started 2025-10-24, CVE-2025-59287
- [SKYSEA Client View: Client View Improper Authentication Vulnerability](https://pwn.watch/i/skysea-client-view-cve-2016-7836) ([json](https://pwn.watch/i/skysea-client-view-cve-2016-7836.json)): critical, closed, patched, started 2025-10-14, CVE-2016-7836
- [Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)](https://pwn.watch/i/microsoft-windows-cve-2011-3402) ([json](https://pwn.watch/i/microsoft-windows-cve-2011-3402.json)): critical, closed, patched, started 2025-10-06, CVE-2011-3402, CVE-2013-3918, CVE-2021-43226
- [Mozilla Multiple Products: Multiple Products Remote Code Execution Vulnerability](https://pwn.watch/i/mozilla-multiple-products-cve-2010-3765) ([json](https://pwn.watch/i/mozilla-multiple-products-cve-2010-3765.json)): critical, closed, patched, started 2025-10-06, CVE-2010-3765
- [Microsoft Internet Explorer: Internet Explorer Uninitialized Memory Corruption Vulnerability](https://pwn.watch/i/microsoft-internet-explorer-cve-2010-3962) ([json](https://pwn.watch/i/microsoft-internet-explorer-cve-2010-3962.json)): high, closed, patched, started 2025-10-06, CVE-2010-3962
- [Jenkins: Remote Code Execution Vulnerability](https://pwn.watch/i/jenkins-cve-2017-1000353) ([json](https://pwn.watch/i/jenkins-cve-2017-1000353.json)): critical, closed, patched, started 2025-10-02, CVE-2017-1000353
- [GNU Bash: Bash OS Command Injection Vulnerability](https://pwn.watch/i/gnu-bash-cve-2014-6278) ([json](https://pwn.watch/i/gnu-bash-cve-2014-6278.json)): high, closed, patched, started 2025-10-02, CVE-2014-6278
- [Smartbedded Meteobridge: Meteobridge Command Injection Vulnerability](https://pwn.watch/i/smartbedded-meteobridge-cve-2025-4008) ([json](https://pwn.watch/i/smartbedded-meteobridge-cve-2025-4008.json)): high, closed, patched, started 2025-10-02, CVE-2025-4008
- [Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035) ([json](https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035.json)): critical, closed, patched, started 2025-09-29, CVE-2025-10035
- [Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)](https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882) ([json](https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882.json)): critical, closed, patched, started 2025-09-29, CVE-2025-61882
- [Cisco IOS and IOS XE: IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability](https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2025-20352) ([json](https://pwn.watch/i/cisco-ios-and-ios-xe-cve-2025-20352.json)): high, closed, patched, started 2025-09-29, CVE-2025-20352
- [Libraesva Email Security Gateway: Email Security Gateway Command Injection Vulnerability](https://pwn.watch/i/libraesva-email-security-gateway-cve-2025-59689) ([json](https://pwn.watch/i/libraesva-email-security-gateway-cve-2025-59689.json)): medium, closed, patched, started 2025-09-29, CVE-2025-59689
- [Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense: 2 exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362)](https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333) ([json](https://pwn.watch/i/cisco-secure-firewall-adaptive-security-appliance-and-s-cve-2025-20333.json)): critical, closed, patched, started 2025-09-25, CVE-2025-20333, CVE-2025-20362
- [Dassault Systèmes DELMIA Apriso: DELMIA Apriso Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/dassault-systemes-delmia-apriso-cve-2025-5086) ([json](https://pwn.watch/i/dassault-systemes-delmia-apriso-cve-2025-5086.json)): critical, closed, patched, started 2025-09-11, CVE-2025-5086
- [Sitecore Multiple Products: Multiple Products Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/sitecore-multiple-products-cve-2025-53690) ([json](https://pwn.watch/i/sitecore-multiple-products-cve-2025-53690.json)): critical, closed, patched, started 2025-09-04, CVE-2025-53690
- [TP-Link Multiple Routers: Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability](https://pwn.watch/i/tp-link-multiple-routers-cve-2025-9377) ([json](https://pwn.watch/i/tp-link-multiple-routers-cve-2025-9377.json)): high, closed, patched, started 2025-09-03, CVE-2025-9377
- [Sangoma FreePBX: FreePBX Authentication Bypass Vulnerability](https://pwn.watch/i/sangoma-freepbx-cve-2025-57819) ([json](https://pwn.watch/i/sangoma-freepbx-cve-2025-57819.json)): critical, closed, patched, started 2025-08-29, CVE-2025-57819
- [Citrix NetScaler: NetScaler Memory Overflow Vulnerability](https://pwn.watch/i/citrix-netscaler-cve-2025-7775) ([json](https://pwn.watch/i/citrix-netscaler-cve-2025-7775.json)): critical, closed, patched, started 2025-08-26, CVE-2025-7775
- [Citrix Session Recording: 2 exploited vulnerabilities (CVE-2024-8068, CVE-2024-8069)](https://pwn.watch/i/citrix-session-recording-cve-2024-8068) ([json](https://pwn.watch/i/citrix-session-recording-cve-2024-8068.json)): medium, closed, patched, started 2025-08-25, CVE-2024-8068, CVE-2024-8069
- [Trend Micro Apex One: Apex One OS Command Injection Vulnerability](https://pwn.watch/i/trend-micro-apex-one-cve-2025-54948) ([json](https://pwn.watch/i/trend-micro-apex-one-cve-2025-54948.json)): critical, closed, patched, started 2025-08-18, CVE-2025-54948
- [N-able N-Central: 2 exploited vulnerabilities (CVE-2025-8875, CVE-2025-8876)](https://pwn.watch/i/n-able-n-central-cve-2025-8875) ([json](https://pwn.watch/i/n-able-n-central-cve-2025-8875.json)): critical, closed, patched, started 2025-08-13, CVE-2025-8875, CVE-2025-8876
- [Microsoft Internet Explorer: Internet Explorer Resource Management Errors Vulnerability](https://pwn.watch/i/microsoft-internet-explorer-cve-2013-3893) ([json](https://pwn.watch/i/microsoft-internet-explorer-cve-2013-3893.json)): high, closed, patched, started 2025-08-12, CVE-2013-3893
- [Microsoft Office: Office Excel Remote Code Execution Vulnerability](https://pwn.watch/i/microsoft-office-cve-2007-0671) ([json](https://pwn.watch/i/microsoft-office-cve-2007-0671.json)): high, closed, patched, started 2025-08-12, CVE-2007-0671
- [D-Link DCS-2530L and DCS-2670L Devices: 2 exploited vulnerabilities (CVE-2020-25078, CVE-2020-25079)](https://pwn.watch/i/d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25078) ([json](https://pwn.watch/i/d-link-dcs-2530l-and-dcs-2670l-devices-cve-2020-25078.json)): high, closed, patched, started 2025-08-05, CVE-2020-25078, CVE-2020-25079
- [Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337)](https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281) ([json](https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281.json)): critical, closed, patched, started 2025-07-28, CVE-2025-20281, CVE-2025-20337
- [ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)](https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770) ([json](https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770.json)): critical, closed, patched, started 2025-07-18, CVE-2025-49704, CVE-2025-49706, CVE-2025-53770
- [PHPMailer: PHPMailer Command Injection Vulnerability](https://pwn.watch/i/phpmailer-cve-2016-10033) ([json](https://pwn.watch/i/phpmailer-cve-2016-10033.json)): critical, closed, patched, started 2025-07-07, CVE-2016-10033
- [TP-Link Multiple Routers: Multiple Routers Command Injection Vulnerability](https://pwn.watch/i/tp-link-multiple-routers-cve-2023-33538) ([json](https://pwn.watch/i/tp-link-multiple-routers-cve-2023-33538.json)): high, closed, patched, started 2025-06-16, CVE-2023-33538
- [Wazuh Server: Server Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/wazuh-server-cve-2025-24016) ([json](https://pwn.watch/i/wazuh-server-cve-2025-24016.json)): critical, closed, patched, started 2025-06-10, CVE-2025-24016
- [Craft CMS: 2 exploited vulnerabilities (CVE-2024-56145, CVE-2025-35939)](https://pwn.watch/i/craft-cms-cve-2024-56145) ([json](https://pwn.watch/i/craft-cms-cve-2024-56145.json)): critical, closed, patched, started 2025-06-02, CVE-2024-56145, CVE-2025-35939
- [ASUS RT-AX55 Routers: RT-AX55 Routers OS Command Injection Vulnerability](https://pwn.watch/i/asus-rt-ax55-routers-cve-2023-39780) ([json](https://pwn.watch/i/asus-rt-ax55-routers-cve-2023-39780.json)): high, closed, patched, started 2025-06-02, CVE-2023-39780
- [ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerability](https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935) ([json](https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935.json)): high, closed, patched, started 2025-06-02, CVE-2025-3935
- [Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427) ([json](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427.json)): high, closed, patched, started 2025-05-19, CVE-2025-4427, CVE-2025-4428
- [DrayTek Vigor Routers: Vigor Routers OS Command Injection Vulnerability](https://pwn.watch/i/draytek-vigor-routers-cve-2024-12987) ([json](https://pwn.watch/i/draytek-vigor-routers-cve-2024-12987.json)): medium, closed, patched, started 2025-05-15, CVE-2024-12987
- [GeoVision Multiple Devices: 2 exploited vulnerabilities (CVE-2024-11120, CVE-2024-6047)](https://pwn.watch/i/geovision-multiple-devices-cve-2024-11120) ([json](https://pwn.watch/i/geovision-multiple-devices-cve-2024-11120.json)): critical, closed, patched, started 2025-05-07, CVE-2024-11120, CVE-2024-6047
- [SonicWall SMA100 Appliances: SMA100 Appliances OS Command Injection Vulnerability](https://pwn.watch/i/sonicwall-sma100-appliances-cve-2023-44221) ([json](https://pwn.watch/i/sonicwall-sma100-appliances-cve-2023-44221.json)): high, closed, patched, started 2025-05-01, CVE-2023-44221
- [Broadcom Brocade Fabric OS: Brocade Fabric OS Code Injection Vulnerability](https://pwn.watch/i/broadcom-brocade-fabric-os-cve-2025-1976) ([json](https://pwn.watch/i/broadcom-brocade-fabric-os-cve-2025-1976.json)): high, closed, patched, started 2025-04-28, CVE-2025-1976
- [SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)](https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324) ([json](https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324.json)): critical, closed, patched, started 2025-04-24, CVE-2025-31324
- [Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)](https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433) ([json](https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433.json)): critical, closed, patched, started 2025-04-16, CVE-2025-32433
- [SonicWall SMA100 Appliances: SMA100 Appliances OS Command Injection Vulnerability](https://pwn.watch/i/sonicwall-sma100-appliances-cve-2021-20035) ([json](https://pwn.watch/i/sonicwall-sma100-appliances-cve-2021-20035.json)): medium, closed, patched, started 2025-04-16, CVE-2021-20035
- [Gladinet CentreStack: CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability](https://pwn.watch/i/gladinet-centrestack-cve-2025-30406) ([json](https://pwn.watch/i/gladinet-centrestack-cve-2025-30406.json)): critical, closed, patched, started 2025-04-08, CVE-2025-30406
- [Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability](https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457) ([json](https://pwn.watch/i/ivanti-connect-secure-policy-secure-and-zta-gateways-cve-2025-22457.json)): critical, closed, patched, started 2025-04-04, CVE-2025-22457
- [IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974)](https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974) ([json](https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974.json)): critical, closed, patched, started 2025-03-24, CVE-2025-1974
- [Edimax IC-7100 IP Camera: IC-7100 IP Camera OS Command Injection Vulnerability](https://pwn.watch/i/edimax-ic-7100-ip-camera-cve-2025-1316) ([json](https://pwn.watch/i/edimax-ic-7100-ip-camera-cve-2025-1316.json)): critical, closed, patched, started 2025-03-19, CVE-2025-1316
- [Progress WhatsUp Gold: WhatsUp Gold Path Traversal Vulnerability](https://pwn.watch/i/progress-whatsup-gold-cve-2024-4885) ([json](https://pwn.watch/i/progress-whatsup-gold-cve-2024-4885.json)): critical, closed, patched, started 2025-03-03, CVE-2024-4885
- [Cisco Small Business RV Series Routers: Small Business RV Series Routers Command Injection Vulnerability](https://pwn.watch/i/cisco-small-business-rv-series-routers-cve-2023-20118) ([json](https://pwn.watch/i/cisco-small-business-rv-series-routers-cve-2023-20118.json)): medium, closed, patched, started 2025-03-03, CVE-2023-20118
- [Craft CMS: Code Injection Vulnerability](https://pwn.watch/i/craft-cms-cve-2025-23209) ([json](https://pwn.watch/i/craft-cms-cve-2025-23209.json)): high, closed, patched, started 2025-02-20, CVE-2025-23209
- [Zyxel DSL CPE Devices: 2 exploited vulnerabilities (CVE-2024-40890, CVE-2024-40891)](https://pwn.watch/i/zyxel-dsl-cpe-devices-cve-2024-40890) ([json](https://pwn.watch/i/zyxel-dsl-cpe-devices-cve-2024-40890.json)): high, closed, unpatched, started 2025-02-11, CVE-2024-40890, CVE-2024-40891
- [Trimble Cityworks: Cityworks Deserialization Vulnerability](https://pwn.watch/i/trimble-cityworks-cve-2025-0994) ([json](https://pwn.watch/i/trimble-cityworks-cve-2025-0994.json)): high, closed, patched, started 2025-02-07, CVE-2025-0994
- [Microsoft Office Outlook: Outlook Improper Input Validation Vulnerability](https://pwn.watch/i/microsoft-office-outlook-cve-2024-21413) ([json](https://pwn.watch/i/microsoft-office-outlook-cve-2024-21413.json)): critical, closed, patched, started 2025-02-06, CVE-2024-21413
- [Sophos XG Firewall: XG Firewall Buffer Overflow Vulnerability](https://pwn.watch/i/sophos-xg-firewall-cve-2020-15069) ([json](https://pwn.watch/i/sophos-xg-firewall-cve-2020-15069.json)): critical, closed, patched, started 2025-02-06, CVE-2020-15069
- [Paessler PRTG Network Monitor: 2 exploited vulnerabilities (CVE-2018-19410, CVE-2018-9276)](https://pwn.watch/i/paessler-prtg-network-monitor-cve-2018-19410) ([json](https://pwn.watch/i/paessler-prtg-network-monitor-cve-2018-19410.json)): critical, closed, patched, started 2025-02-04, CVE-2018-19410, CVE-2018-9276
- [Microsoft .NET Framework: .NET Framework Information Disclosure Vulnerability](https://pwn.watch/i/microsoft-net-framework-cve-2024-29059) ([json](https://pwn.watch/i/microsoft-net-framework-cve-2024-29059.json)): high, closed, patched, started 2025-02-04, CVE-2024-29059
- [Aviatrix Controllers: Controllers OS Command Injection Vulnerability](https://pwn.watch/i/aviatrix-controllers-cve-2024-50603) ([json](https://pwn.watch/i/aviatrix-controllers-cve-2024-50603.json)): critical, closed, patched, started 2025-01-16, CVE-2024-50603
- [BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS): Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability](https://pwn.watch/i/beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686) ([json](https://pwn.watch/i/beyondtrust-privileged-remote-access-pra-and-remote-sup-cve-2024-12686.json)): medium, closed, patched, started 2025-01-13, CVE-2024-12686
- [Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)](https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282) ([json](https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282.json)): critical, closed, patched, started 2025-01-08, CVE-2025-0282
- [Acclaim Systems USAHERDS Use of Hard-Coded Credentials](https://pwn.watch/i/acclaim-systems-usaherds-cve-2021-44207) ([json](https://pwn.watch/i/acclaim-systems-usaherds-cve-2021-44207.json)): high, closed, patched, started 2024-12-23, CVE-2021-44207
- [NUUO NVRmini Devices OS Command Injection](https://pwn.watch/i/nuuo-nvrmini-devices-cve-2018-14933) ([json](https://pwn.watch/i/nuuo-nvrmini-devices-cve-2018-14933.json)): critical, closed, unpatched, started 2024-12-18, CVE-2018-14933
- [Reolink RLC-410W IP Camera OS Command Injection](https://pwn.watch/i/reolink-rlc-410w-ip-camera-cve-2021-40407) ([json](https://pwn.watch/i/reolink-rlc-410w-ip-camera-cve-2021-40407.json)): critical, closed, partial, started 2024-12-18, CVE-2021-40407
- [Reolink Multiple IP Cameras OS Command Injection](https://pwn.watch/i/reolink-multiple-ip-cameras-cve-2019-11001) ([json](https://pwn.watch/i/reolink-multiple-ip-cameras-cve-2019-11001.json)): high, closed, partial, started 2024-12-18, CVE-2019-11001
- [BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)](https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356) ([json](https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356.json)): critical, closed, patched, started 2024-12-05, CVE-2024-12356
- [Palo Alto PAN-OS management interface auth bypass + privilege escalation](https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474) ([json](https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474.json)): critical, closed, patched, started 2024-11-18, CVE-2024-0012, CVE-2024-9474
- [Nostromo nhttpd Directory Traversal](https://pwn.watch/i/nostromo-nhttpd-cve-2019-16278) ([json](https://pwn.watch/i/nostromo-nhttpd-cve-2019-16278.json)): critical, closed, patched, started 2024-11-07, CVE-2019-16278
- [Microsoft October 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573) ([json](https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573.json)): high, closed, patched, started 2024-10-08, CVE-2024-43572, CVE-2024-43573
- [D-Link DIR-820 Router OS Command Injection](https://pwn.watch/i/d-link-dir-820-router-cve-2023-25280) ([json](https://pwn.watch/i/d-link-dir-820-router-cve-2023-25280.json)): critical, closed, unpatched, started 2024-09-30, CVE-2023-25280
- [DrayTek Multiple Vigor Routers OS Command Injection](https://pwn.watch/i/draytek-multiple-vigor-routers-cve-2020-15415) ([json](https://pwn.watch/i/draytek-multiple-vigor-routers-cve-2020-15415.json)): critical, closed, patched, started 2024-09-30, CVE-2020-15415
- [SAP Commerce Cloud Deserialization of Untrusted Data](https://pwn.watch/i/sap-commerce-cloud-cve-2019-0344) ([json](https://pwn.watch/i/sap-commerce-cloud-cve-2019-0344.json)): critical, closed, patched, started 2024-09-30, CVE-2019-0344
- [Microsoft SQL Server Reporting Services Remote Code Execution](https://pwn.watch/i/microsoft-sql-server-cve-2020-0618) ([json](https://pwn.watch/i/microsoft-sql-server-cve-2020-0618.json)): critical, closed, patched, started 2024-09-18, CVE-2020-0618
- [Oracle ADF Faces Deserialization of Untrusted Data](https://pwn.watch/i/oracle-adf-faces-cve-2022-21445) ([json](https://pwn.watch/i/oracle-adf-faces-cve-2022-21445.json)): critical, closed, patched, started 2024-09-18, CVE-2022-21445
- [Oracle WebLogic Server Remote Code Execution](https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644) ([json](https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644.json)): critical, closed, patched, started 2024-09-18, CVE-2020-14644
- [PTZOptics PT30X-SDI/NDI Cameras: 2 actively exploited vulnerabilities](https://pwn.watch/i/ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957) ([json](https://pwn.watch/i/ptzoptics-pt30x-sdi-ndi-cameras-cve-2024-8956-8957.json)): critical, closed, patched, started 2024-09-17, CVE-2024-8956, CVE-2024-8957
- [Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor](https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380) ([json](https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380.json)): critical, closed, patched, started 2024-09-10, CVE-2024-8190, CVE-2024-8963, CVE-2024-9379…
- [Veeam Backup and Replication Deserialization](https://pwn.watch/i/veeam-backup-replication-cve-2024-40711) ([json](https://pwn.watch/i/veeam-backup-replication-cve-2024-40711.json)): critical, closed, patched, started 2024-09-07, CVE-2024-40711
- [Microsoft Exchange Server Information Disclosure](https://pwn.watch/i/microsoft-exchange-server-cve-2021-31196) ([json](https://pwn.watch/i/microsoft-exchange-server-cve-2021-31196.json)): high, closed, patched, started 2024-08-21, CVE-2021-31196
- [SolarWinds Web Help Desk Deserialization of Untrusted Data](https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28986) ([json](https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28986.json)): critical, closed, patched, started 2024-08-13, CVE-2024-28986
- [Microsoft August 2024: 6 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more) ([json](https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more.json)): high, closed, patched, started 2024-08-13, CVE-2024-38106, CVE-2024-38107, CVE-2024-38178…
- [Apache OFBiz Incorrect Authorization](https://pwn.watch/i/apache-ofbiz-cve-2024-38856) ([json](https://pwn.watch/i/apache-ofbiz-cve-2024-38856.json)): high, closed, patched, started 2024-08-05, CVE-2024-38856
- [Microsoft COM for Windows Deserialization of Untrusted Data](https://pwn.watch/i/microsoft-windows-cve-2018-0824) ([json](https://pwn.watch/i/microsoft-windows-cve-2018-0824.json)): high, closed, patched, started 2024-08-05, CVE-2018-0824
- [Palo Alto Networks Expedition: 3 actively exploited vulnerabilities](https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465) ([json](https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465.json)): critical, closed, patched, started 2024-07-10, CVE-2024-5910, CVE-2024-9463, CVE-2024-9465
- [Microsoft SharePoint Deserialization](https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094.json)): high, closed, patched, started 2024-07-09, CVE-2024-38094
- [OSGeo GeoServer GeoTools Eval Injection](https://pwn.watch/i/osgeo-geoserver-cve-2024-36401) ([json](https://pwn.watch/i/osgeo-geoserver-cve-2024-36401.json)): critical, closed, patched, started 2024-07-01, CVE-2024-36401
- [regreSSHion: unauthenticated RCE in OpenSSH sshd (CVE-2024-6387)](https://pwn.watch/i/openssh-regresshion-cve-2024-6387) ([json](https://pwn.watch/i/openssh-regresshion-cve-2024-6387.json)): high, closed, patched, started 2024-07-01, CVE-2024-6387
- [Cisco NX-OS Command Injection](https://pwn.watch/i/cisco-nx-os-cve-2024-20399) ([json](https://pwn.watch/i/cisco-nx-os-cve-2024-20399.json)): medium, closed, patched, started 2024-07-01, CVE-2024-20399
- [OSGeo GeoServer JAI-EXT Code Injection](https://pwn.watch/i/osgeo-jai-ext-cve-2022-24816) ([json](https://pwn.watch/i/osgeo-jai-ext-cve-2022-24816.json)): critical, closed, patched, started 2024-06-26, CVE-2022-24816
- [Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)](https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102) ([json](https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102.json)): critical, closed, patched, started 2024-06-13, CVE-2024-34102
- [Android Kernel Remote Code Execution](https://pwn.watch/i/android-kernel-cve-2024-36971) ([json](https://pwn.watch/i/android-kernel-cve-2024-36971.json)): high, closed, patched, started 2024-06-10, CVE-2024-36971
- [PHP-CGI argument injection on Windows (CVE-2024-4577)](https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577) ([json](https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577.json)): critical, closed, patched, started 2024-06-06, CVE-2024-4577
- [Oracle WebLogic Server OS Command Injection](https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506) ([json](https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506.json)): high, closed, patched, started 2024-06-03, CVE-2017-3506
- [NextGen Healthcare Mirth Connect Deserialization of Untrusted Data](https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208) ([json](https://pwn.watch/i/nextgen-healthcare-mirth-connect-cve-2023-43208.json)): critical, closed, patched, started 2024-05-20, CVE-2023-43208
- [Apache OFBiz Path Traversal](https://pwn.watch/i/apache-ofbiz-cve-2024-32113) ([json](https://pwn.watch/i/apache-ofbiz-cve-2024-32113.json)): critical, closed, patched, started 2024-05-08, CVE-2024-32113
- [Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)](https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400) ([json](https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400.json)): critical, closed, patched, started 2024-04-12, CVE-2024-3400
- [D-Link Multiple NAS Devices: 2 actively exploited vulnerabilities](https://pwn.watch/i/d-link-multiple-nas-devices-cve-2024-3272-3273) ([json](https://pwn.watch/i/d-link-multiple-nas-devices-cve-2024-3272-3273.json)): critical, closed, unpatched, started 2024-04-04, CVE-2024-3272, CVE-2024-3273
- [xz-utils backdoor (CVE-2024-3094)](https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094) ([json](https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094.json)): critical, closed, patched, started 2024-03-29, CVE-2024-3094
- [Microsoft SharePoint Server Code Injection](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955.json)): high, closed, patched, started 2024-03-26, CVE-2023-24955
- [Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection](https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529) ([json](https://pwn.watch/i/ivanti-endpoint-manager-cloud-service-appliance-ep-cve-2021-44529.json)): critical, closed, patched, started 2024-03-25, CVE-2021-44529
- [Nice Linear eMerge E3-Series OS Command Injection](https://pwn.watch/i/nice-linear-emerge-e3-series-cve-2019-7256) ([json](https://pwn.watch/i/nice-linear-emerge-e3-series-cve-2019-7256.json)): critical, closed, patched, started 2024-03-25, CVE-2019-7256
- [Sunhillo SureLine OS Command Injection](https://pwn.watch/i/sunhillo-sureline-cve-2021-36380) ([json](https://pwn.watch/i/sunhillo-sureline-cve-2021-36380.json)): critical, closed, patched, started 2024-03-05, CVE-2021-36380
- [Progress Kemp LoadMaster OS Command Injection](https://pwn.watch/i/progress-kemp-loadmaster-cve-2024-1212) ([json](https://pwn.watch/i/progress-kemp-loadmaster-cve-2024-1212.json)): critical, closed, patched, started 2024-02-21, CVE-2024-1212
- [Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE](https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897) ([json](https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897.json)): critical, closed, patched, started 2024-01-24, CVE-2024-23897
- [VMware vCenter Server Out-of-Bounds Write](https://pwn.watch/i/vmware-vcenter-server-cve-2023-34048) ([json](https://pwn.watch/i/vmware-vcenter-server-cve-2023-34048.json)): critical, closed, patched, started 2024-01-22, CVE-2023-34048
- [Citrix NetScaler ADC and NetScaler Gateway: 2 actively exploited vulnerabilities](https://pwn.watch/i/citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549) ([json](https://pwn.watch/i/citrix-netscaler-adc-and-netscaler-gatew-cve-2023-6548-6549.json)): high, closed, patched, started 2024-01-17, CVE-2023-6548, CVE-2023-6549
- [Atlassian Confluence Data Center and Server Template Injection](https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527) ([json](https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527.json)): critical, closed, patched, started 2024-01-16, CVE-2023-22527
- [Ivanti Connect Secure zero-days chained for mass VPN compromise](https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893) ([json](https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893.json)): critical, closed, patched, started 2024-01-10, CVE-2023-46805, CVE-2024-21887, CVE-2024-21893
- [D-Link DSL-2750B Devices Command Injection](https://pwn.watch/i/d-link-dsl-2750b-devices-cve-2016-20017) ([json](https://pwn.watch/i/d-link-dsl-2750b-devices-cve-2016-20017.json)): critical, closed, patched, started 2024-01-08, CVE-2016-20017
- [Spreadsheet::ParseExcel Remote Code Execution](https://pwn.watch/i/spreadsheet-parseexcel-cve-2023-7101) ([json](https://pwn.watch/i/spreadsheet-parseexcel-cve-2023-7101.json)): high, closed, patched, started 2024-01-02, CVE-2023-7101
- [FXC AE1021, AE1021PE: OS Command Injection (CVE-2023-49897)](https://pwn.watch/i/fxc-ae1021-ae1021pe-cve-2023-49897) ([json](https://pwn.watch/i/fxc-ae1021-ae1021pe-cve-2023-49897.json)): high, closed, patched, started 2023-12-21, CVE-2023-49897
- [QNAP VioStor NVR: OS Command Injection (CVE-2023-47565)](https://pwn.watch/i/qnap-viostor-nvr-cve-2023-47565) ([json](https://pwn.watch/i/qnap-viostor-nvr-cve-2023-47565.json)): high, closed, patched, started 2023-12-21, CVE-2023-47565
- [Sophos Web Appliance: Command Injection (CVE-2023-1671)](https://pwn.watch/i/sophos-web-appliance-cve-2023-1671) ([json](https://pwn.watch/i/sophos-web-appliance-cve-2023-1671.json)): critical, closed, patched, started 2023-11-16, CVE-2023-1671
- [Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)](https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604) ([json](https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604.json)): critical, closed, patched, started 2023-10-27, CVE-2023-46604
- [Trend Micro Apex One and Worry-Free Business Security: Remote Code Execution (CVE-2023-41179)](https://pwn.watch/i/trend-micro-apex-one-and-worry-free-business-cve-2023-41179) ([json](https://pwn.watch/i/trend-micro-apex-one-and-worry-free-business-cve-2023-41179.json)): high, closed, patched, started 2023-09-21, CVE-2023-41179
- [Cisco IOS XE web UI zero-days: implants on tens of thousands of devices](https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198) ([json](https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198.json)): critical, closed, patched, started 2023-09-18, CVE-2023-20198, CVE-2023-20273
- [TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793) ([json](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793.json)): critical, closed, patched, started 2023-09-18, CVE-2023-42793
- [WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)](https://pwn.watch/i/winrar-zero-day-cve-2023-38831) ([json](https://pwn.watch/i/winrar-zero-day-cve-2023-38831.json)): high, closed, patched, started 2023-08-02, CVE-2023-38831
- [NetScaler ADC/Gateway unauthenticated RCE (CVE-2023-3519)](https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519) ([json](https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519.json)): critical, closed, patched, started 2023-07-18, CVE-2023-3519
- [Microsoft Windows: Search Remote Code Execution (CVE-2023-36884)](https://pwn.watch/i/microsoft-windows-cve-2023-36884) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-36884.json)): high, closed, patched, started 2023-07-17, CVE-2023-36884
- [SolarView Compact: Command Injection (CVE-2022-29303)](https://pwn.watch/i/solarview-compact-cve-2022-29303) ([json](https://pwn.watch/i/solarview-compact-cve-2022-29303.json)): critical, closed, patched, started 2023-07-13, CVE-2022-29303
- [Zyxel Multiple Network-Attached Storage (NAS) Devices: Command Injection (CVE-2023-27992)](https://pwn.watch/i/zyxel-multiple-network-attached-storage-nas-cve-2023-27992) ([json](https://pwn.watch/i/zyxel-multiple-network-attached-storage-nas-cve-2023-27992.json)): critical, closed, patched, started 2023-06-23, CVE-2023-27992
- [VMware Aria Operations for Networks: Command Injection (CVE-2023-20887)](https://pwn.watch/i/vmware-aria-operations-for-networks-cve-2023-20887) ([json](https://pwn.watch/i/vmware-aria-operations-for-networks-cve-2023-20887.json)): critical, closed, patched, started 2023-06-22, CVE-2023-20887
- [FortiOS SSL-VPN pre-auth heap overflow (XORtigate, CVE-2023-27997)](https://pwn.watch/i/fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997) ([json](https://pwn.watch/i/fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997.json)): critical, closed, patched, started 2023-06-12, CVE-2023-27997
- [Zyxel Multiple Firewalls: 2 exploited vulnerabilities (CVE-2023-33009, CVE-2023-33010)](https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-33009-33010) ([json](https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-33009-33010.json)): critical, closed, patched, started 2023-06-05, CVE-2023-33009, CVE-2023-33010
- [Zyxel Multiple Firewalls: OS Command Injection (CVE-2023-28771)](https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-28771) ([json](https://pwn.watch/i/zyxel-multiple-firewalls-cve-2023-28771.json)): critical, closed, patched, started 2023-05-31, CVE-2023-28771
- [Barracuda Email Security Gateway zero-day (CVE-2023-2868)](https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868) ([json](https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868.json)): critical, closed, patched, started 2023-05-18, CVE-2023-2868
- [Ruckus Wireless Multiple Products: CSRF and RCE (CVE-2023-25717)](https://pwn.watch/i/ruckus-wireless-multiple-products-cve-2023-25717) ([json](https://pwn.watch/i/ruckus-wireless-multiple-products-cve-2023-25717.json)): critical, closed, patched, started 2023-05-12, CVE-2023-25717
- [TP-Link Archer AX21: AX-21 Command Injection (CVE-2023-1389)](https://pwn.watch/i/tp-link-archer-ax21-cve-2023-1389) ([json](https://pwn.watch/i/tp-link-archer-ax21-cve-2023-1389.json)): high, closed, patched, started 2023-05-01, CVE-2023-1389
- [PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)](https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350) ([json](https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350.json)): critical, closed, patched, started 2023-04-21, CVE-2023-27350
- [Fortra Cobalt Strike: 2 exploited vulnerabilities (CVE-2022-39197, CVE-2022-42948)](https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948) ([json](https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948.json)): critical, closed, patched, started 2023-03-30, CVE-2022-39197, CVE-2022-42948
- [Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26360)](https://pwn.watch/i/adobe-coldfusion-cve-2023-26360) ([json](https://pwn.watch/i/adobe-coldfusion-cve-2023-26360.json)): high, closed, patched, started 2023-03-15, CVE-2023-26360
- [Teclib GLPI: Remote Code Execution (CVE-2022-35914)](https://pwn.watch/i/teclib-glpi-cve-2022-35914) ([json](https://pwn.watch/i/teclib-glpi-cve-2022-35914.json)): critical, closed, patched, started 2023-03-07, CVE-2022-35914
- [Apache Spark: Command Injection (CVE-2022-33891)](https://pwn.watch/i/apache-spark-cve-2022-33891) ([json](https://pwn.watch/i/apache-spark-cve-2022-33891.json)): high, closed, patched, started 2023-03-07, CVE-2022-33891
- [Zoho ManageEngine: ADSelfService Plus Remote Code Execution (CVE-2022-28810)](https://pwn.watch/i/zoho-manageengine-cve-2022-28810) ([json](https://pwn.watch/i/zoho-manageengine-cve-2022-28810.json)): medium, closed, patched, started 2023-03-07, CVE-2022-28810
- [Cacti: Command Injection (CVE-2022-46169)](https://pwn.watch/i/cacti-cve-2022-46169) ([json](https://pwn.watch/i/cacti-cve-2022-46169.json)): critical, closed, patched, started 2023-02-16, CVE-2022-46169
- [SugarCRM Multiple Products: Remote Code Execution (CVE-2023-22952)](https://pwn.watch/i/sugarcrm-multiple-products-cve-2023-22952) ([json](https://pwn.watch/i/sugarcrm-multiple-products-cve-2023-22952.json)): high, closed, patched, started 2023-02-02, CVE-2023-22952
- [Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims](https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669) ([json](https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669.json)): high, closed, patched, started 2023-02-01, CVE-2023-0669
- [Zoho ManageEngine: Remote Code Execution (CVE-2022-47966)](https://pwn.watch/i/zoho-manageengine-cve-2022-47966) ([json](https://pwn.watch/i/zoho-manageengine-cve-2022-47966.json)): critical, closed, patched, started 2023-01-23, CVE-2022-47966
- [CWP Control Web Panel: OS Command Injection (CVE-2022-44877)](https://pwn.watch/i/cwp-control-web-panel-cve-2022-44877) ([json](https://pwn.watch/i/cwp-control-web-panel-cve-2022-44877.json)): critical, closed, patched, started 2023-01-17, CVE-2022-44877
- [Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)](https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080) ([json](https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080.json)): high, closed, patched, started 2023-01-10, CVE-2022-41080