Explore a curated list of the latest CVEs, with a focus on critical and high-severity vulnerabilities. Stay informed about actively exploited threats and get the insights you need to respond quickly and confidently.
| CVE ID | CVSS | Summary | Link |
|---|---|---|---|
| CVE-2026-2329 | 9.3 | CVE-2026-2329 is a critical stack-based buffer overflow in Grandstream GXP1600 VoIP phones. Unauthenticated attackers can exploit the /cgi-bin/api.values.get API to execute code with root privileges, risking full device compromise, credential theft, call interception, and internal network access. | View |
| CVE-2026-20127 | 10.0 | CVE-2026-20127 is a critical Cisco SD-WAN authentication bypass flaw allowing remote attackers to gain high-privileged access via crafted requests. Exploited in the wild, it enables NETCONF-based configuration changes, risking full control of the SD-WAN control plane and network operations. | View |
| CVE-2026-21902 | 9.3 | CVE-2026-21902 lets unauthenticated attackers gain root access on Juniper PTX routers via the anomaly detection service. Fixed in 25.4R1-S1-EVO and 25.4R2-EVO. | View |
| CVE-2026-1731 | 9.9 | CVE-2026-1731 is a critical flaw in BeyondTrust Remote Support and BeyondTrust Privileged Remote Access that allows attackers to run commands without authentication, risking system compromise. It is actively exploited and requires immediate patching. | View |
| CVE-2026-25593 | 8.4 | CVE-2026-25593 is a high-severity OpenClaw vulnerability enabling unauthenticated local command execution via the Gateway WebSocket API. Unsafe cliPath values in config.apply allowed command injection. Updating to version 2026.1.20 or later fixes the issue. | View |
| CVE-2026-24061 | 9.8 | CVE-2026-24061 is a critical vulnerability in GNU InetUtils telnetd that allows remote attackers to bypass authentication and gain root access due to improper USER variable validation. Affected versions 1.9.3 through 2.7 should be upgraded to 2.7 - 2 or Telnet disabled immediately. | View |
| CVE-2026-21962 | 10.0 | CVE-2026-21962 is a critical flaw in Oracle HTTP Server and WebLogic Proxy that lets unauthenticated attackers access internal resources. Affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0) remain at high risk until patched. | View |
| CVE-2026-20700 | 7.8 | CVE-2026-20700 is a zero-day memory flaw in Apple’s Dynamic Link Editor (dyld) that allows attackers to run code with elevated privileges, risking spyware, data theft, or full device takeover. All Apple OS versions before 26.3 are affected. Immediate patching with Apple’s security updates is strongly advised. | View |
| CVE-2026-2441 | 8.8 | CVE-2026-2441 is a high-risk Chrome CSS bug affecting versions before 145.0.7632.75/76. Attackers can run code in the browser sandbox using crafted HTML, risking data theft and credential loss. Update immediately to Chrome 145.0.7632.75 or later to fix the issue. | View |
| CVE-2026-25049 | 9.4 | CVE-2026-25049 lets authenticated n8n users run arbitrary server commands. It risks credentials, files, and workflows. Fixed in 1.123.17 and 2.5.2—update and rotate credentials immediately. | View |
| CVE-2026-21532 | 8.2 | CVE‑2026‑21532 is a high-severity Azure Functions vulnerability that lets attackers remotely access sensitive data without authentication. It mainly affects confidentiality, slightly impacts integrity, and doesn’t affect availability. Reported February 5, 2026, with Microsoft as the CNA. | View |
| CVE-2026-0227 | 6.6 | CVE-2026-0227 is a medium-risk flaw in PAN-OS and Prisma Access with GlobalProtect enabled. It lets a remote attacker disrupt firewall and VPN traffic. Cloud NGFW isn’t affected. Fix by updating to the latest versions and restricting GlobalProtect access. | View |
| CVE‑2026‑21509 | 7.8 | CVE-2026-21509 is a serious Microsoft Office vulnerability that allows attackers to bypass security protections by tricking users into opening malicious documents. It affects multiple Office versions, is actively exploited, and must be patched immediately. | View |
| CVE-2026-24858 | 9.8 | CVE‑2026‑24858 is a critical Fortinet FortiCloud SSO authentication bypass actively exploited in the wild. Due to weak SSO isolation, attackers can gain unauthorized admin access to other customers’ devices, steal configurations, and create persistent accounts. Immediate patching or disabling FortiCloud SSO is essential. | View |
| CVE-2025-68645 | 8.8 | CVE‑2025‑68645 lets attackers access Zimbra Webmail files without authentication. Update to ZCS 10.0.18 or 10.1.13+. | View |
| CVE-2025-59718 | 9.8 | CVE-2025-59718 is a critical Fortinet FortiCloud SSO flaw that lets attackers bypass authentication via crafted SAML messages, gain admin access, create rogue accounts, and steal firewall configs. Active exploitation is ongoing, making immediate patching and temporary SSO disablement essential. | View |
| CVE-2026-23550 | 10.0 | CVE‑2026‑23550 is a critical flaw in the Modular DS WordPress plugin (≤ 2.5.1) that lets unauthenticated attackers gain administrator access through weak routing and auto‑login. Actively exploited, it enables full site takeover and is fixed in versions 2.5.2 and 2.6.0. | View |
| CVE-2025-21333 | 7.8 | CVE-2025-21333 is a high‑severity Windows Hyper‑V vulnerability caused by a heap‑based buffer overflow in the NT Kernel Integration VSP. It allows low‑privileged local attackers to gain SYSTEM access. The issue is actively exploited and was fixed in Microsoft’s January 2025 security updates. | View |
| CVE-2025-52691 | 10.0 | CVE-2025-52691 is a critical SmarterMail vulnerability enabling unauthenticated file upload and remote code execution in builds 9406 and earlier, fixed in Build 9413. | View |
| CVE-2025-27840 | 6.8 | CVE-2025-27840 affects Espressif ESP32 Bluetooth firmware with hidden HCI commands that can modify internal memory. Accessible via standard Bluetooth tools, it requires high privileges and physical access, poses medium risk, and had no official fix at disclosure | View |
| CVE‑2025‑30208 | 5.3 | CVE-2025-30208 is a medium-severity flaw in the Vite development server that allows attackers to bypass file access restrictions using crafted query strings. It enables arbitrary file reads on network-exposed dev servers running vulnerable Vite versions prior to the fixed releases, potentially exposing sensitive local files. | View |
| CVE-2025-37164 | 10 | CVE‑2025‑37164 is a critical HPE OneView flaw enabling unauthenticated remote code execution and full infrastructure control. Actively exploited with public PoC, it affects versions before 11.00 and requires immediate patching or mitigation. | View |
| CVE-2025-8110 | 8.7 | CVE-2025-8110 is a critical Gogs flaw allowing file overwrite and code execution via symbolic links. Update to version 0.13.3 to fix. | View |
| CVE-2025-55182 | 10.0 | CVE‑2025‑55182 is a critical RCE in React Server Components and Next.js, allowing unauthenticated attackers to run code via unsafe deserialization. Immediate patching is required. | View |
| CVE-2025-61757 | 9.8 | CVE‑2025‑61757 lets attackers bypass authentication and run code on Oracle Identity Manager (v12.2.1.4.0, v14.1.2.1.0). Actively exploited, it’s patched in Oracle’s October 2025 CPU—urgent updates are required. | View |
| CVE-2025-24200 | 6.1 | CVE‑2025‑24200 lets physical attackers bypass USB Restricted Mode on locked iPhones and iPads, risking data exposure. Fixed in iOS 18.3.1 and iPadOS 18.3.1/17.7.5, devices should be updated promptly. | View |
| CVE-2025-20333 | 9.9 | CVE‑2025‑20333 is a critical zero‑day in the VPN web server of Cisco ASA and FTD devices. Due to improper HTTPS input handling, attackers with valid VPN credentials can send crafted requests and execute code as root. It is actively exploited, enabling full device compromise. Cisco has released patches, and upgrading is the only effective remediation. | View |
| CVE‑2025‑24201 | 10.0 | CVE‑2025‑24201 is a critical WebKit bug letting attackers escape the Web Content sandbox on Apple devices. It’s actively exploited and affects iOS, iPadOS, macOS, Safari, visionOS, and watchOS. Patching immediately is strongly recommended to prevent device compromise and data exposure. | View |
| CVE-2025-8941 | 7.8 | CVE‑2025‑8941 is a high‑severity linux‑pam flaw where improper path handling in pam_namespace allows local attackers to exploit symlink and race‑condition weaknesses to gain root privileges. It affects multiple Linux distributions, and remediation requires installing the updated linux‑pam packages provided in vendor security advisories. | View |
| CVE-2025-0411 | 7.0 | CVE‑2025‑0411 is a serious 7‑Zip flaw where extracted files lose the Windows Mark‑of‑the‑Web, allowing attackers to bypass security checks and run code. It affects versions before 24.09 and is already being exploited. Updating to 24.09 fixes the problem. | View |
| CVE-2025-62215 | 7.0 | CVE‑2025‑62215 is a critical Windows Kernel vulnerability caused by a race condition, allowing local low‑privileged users to gain SYSTEM-level access. Actively exploited in the wild, it impacts Windows 10, 11, Server, and 10 ESU, highlighting the urgency for immediate patching and strict enforcement of least-privilege access controls. | View |
| CVE-2025-25012 | 5.4 | CVE-2025-25012 is a medium-severity Kibana flaw that can redirect users to malicious sites. It affects versions 7.0.0 - 9.0.0. Fix by updating or enforcing strict URL validation. | View |
| CVE-2025-64446 | 9.8 | CVE-2025-64446 is a critical FortiWeb path traversal flaw (v7.0.0–8.0.1) that allows unauthenticated attackers to execute admin commands. Fortinet advises updating to the latest patched versions and disabling internet-facing HTTP/HTTPS until systems are secured, while monitoring logs for any unauthorized activity. | View |
| CVE-2025-27636 | 5.6 | CVE-2025-27636 is a medium‑severity Apache Camel flaw. Mixed‑case headers can bypass filters, letting attackers run commands. A public PoC exists. Update to Camel 3.22.4, 4.8.5, or 4.10.2 to fix it. | View |
| CVE-2025-43300 | 8.8 | CVE-2025-43300 is a high severity out of bounds write in Apple’s Image I/O (RawCamera.bundle). Crafted DNG or JPEG lossless files with mismatched metadata can trigger memory corruption, crashes, or targeted code execution. Install Apple’s security updates immediately. CISA lists this CVE as actively exploited. | View |
| CVE-2025-48989 | 7.5 | CVE-2025-48989 is a high-severity Apache Tomcat HTTP/2 bug that can cause DoS by exhausting resources. Patch to Tomcat 9.0.108, 10.1.44, or 11.0.10. | View |
| CVE-2025-4664 | 8.6 | CVE-2025-40778 is a BIND 9 flaw that lets attackers poison DNS caches and redirect users to malicious sites. Updating to fixed versions and enabling DNSSEC can prevent attacks. | View |
| CVE-2025-4664 | 4.3 | CVE-2025-4664 is a Chrome Loader flaw that lets malicious pages abuse Link headers’ referrer-policy to force browsers to send full referrer URLs (including query parameters like OAuth or session tokens) to attacker-controlled hosts. Public PoCs and active exploits were reported. Google patched it in Chrome 136.0.7103.113/.114; update promptly. | View |
| CVE-2025-0108 | 9.1 | CVE-2025-0108 is a critical PAN-OS authentication bypass that allows unauthenticated attackers to reach protected management PHP endpoints by exploiting path confusion between Nginx and Apache with double-encoded requests. Public proof-of-concepts exist and active exploitation has been reported. Affected PAN-OS 10.x and 11.x builds should be patched immediately; restrict management access to trusted IPs until fixed. | View |
| CVE-2025-59287 | 9.8 | CVE-2025-59287 is a critical WSUS flaw that allows remote attackers to execute code without authentication due to unsafe data handling. Active attacks began in October 2025, and Microsoft released urgent patches to fix it. | View |
| CVE-2025-0282 | 9.0 | CVE-2025-0282 is a critical pre‑auth bug in Ivanti Connect Secure (seen since Dec 2024) that lets attackers run commands remotely and install web shells, credential stealers, and persistent backdoors. Mitigate by installing Ivanti’s fix (22.7R2.5), run the Integrity Checker Tool, isolate suspected appliances, and factory‑reset/rebuild if infected. | View |
| CVE-2025-10035 | 10.0 | CVE‑2025‑10035 is a critical deserialization flaw in Fortra’s GoAnywhere MFT License Servlet (CVSS 10.0). Attackers supplying forged license responses can trigger deserialization of malicious objects, causing unauthenticated remote code execution when the Admin Console is reachable. Active exploitation and ransomware activity have been reported. Operators must patch to 7.8.4/7.6.3, remove internet exposure, and hunt for indicators. | View |
| CVE-2025-24085 | 7.8 | CVE-2025-24085 is a critical use‑after‑free flaw in Apple’s media processing (Core Media) that was actively exploited in the wild against older iOS releases. Successful exploitation can let a malicious app run code with elevated privileges; Apple fixed the issue in January 2025—update to iOS/iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3, or visionOS 2.3. | View |
| CVE‑2025‑8088 | 8.4 | CVE-2025-8088 is a Windows WinRAR bug that lets crafted RAR files drop hidden programs outside the chosen folder using NTFS alternate data streams. Update WinRAR to 7.13, avoid RARs from unknown senders, extract suspicious archives in a sandbox, and check %TEMP%, %LOCALAPPDATA%, and Startup for unexpected .exe/.dll/.lnk files. | View |
| CVE-2025-32433 | 10.0 | CVE-2025-32433 is a critical pre-authentication RCE in Erlang/OTP’s SSH server. By sending crafted SSH connection messages (e.g., channel_open/channel_request) before authentication, attackers can execute arbitrary commands without credentials. Public PoCs and real-world exploit activity were observed. Patch immediately to OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20 to prevent full system compromise. | View |
| CVE-2025-4598 | 4.7 | CVE-2025-4598 is a medium-severity race condition in systemd-coredump allowing a local attacker to crash a SUID process, swap in a non‑SUID binary, and read the privileged core dump—potentially exposing sensitive data like password hashes. Mitigate by setting /proc/sys/fs/suid_dumpable to 0, updating systemd, and auditing core-dump access logs. | View |
| CVE-2025-9556 | 9.8 | CVE-2025-9556 is a critical SSTI in Langchaingo caused by Gonja v1.5.3’s Jinja-like include/extends features. Malicious prompts can force template rendering to read arbitrary files (e.g., /etc/passwd), exposing secrets or enabling code execution. Patch Langchaingo to the RenderTemplateFS fix, disable template parsing for untrusted prompts, and block template directives until fixed. | View |
| CVE-2025-10585 | 9.8 | CVE-2025-10585 is a critical type-confusion zero-day in Chrome’s V8 engine, reported by Google TAG on Sept 16, 2025. It allows arbitrary code execution and possible sandbox escape when victims load malicious webpages. It is being exploited in the wild. Update Chrome right away to 140.0.7339.185/.186 (Windows/macOS) or 140.0.7339.185 (Linux). | View |
| CVE-2025-53786 | 8.0 | CVE-2025-53786 is a critical Microsoft Exchange flaw letting on-premises admins gain higher access in Exchange Online, putting cloud data and admin control at risk. Exploitation may leave minimal audit traces. Mitigation involves applying the April 2025 hotfix, switching to a dedicated hybrid app, cleaning service principal credentials, and monitoring hybrid configurations. | View |
| CVE-2025-20309 | 10.0 | CVE-2025-20309 is a critical vulnerability in Cisco Unified Communications Manager (ES releases 15.0.1.13010-1 through 15.0.1.13017-1) caused by hardcoded root SSH credentials. It allows unauthenticated remote root access, full system takeover, and arbitrary command execution. Cisco fixed it in 15SU3 (July 2025); apply the patch immediately and monitor SSH root logins. | View |
A CVE (Common Vulnerabilities and Exposures) is a unique identifier given to a publicly known cybersecurity flaw. It helps researchers and security teams talk about the same issue using a standard reference.
Vulnerabilities in cybersecurity are weaknesses or flaws in software, hardware, or systems that attackers can exploit to gain unauthorized access, disrupt operations, or steal sensitive information.
Each CVE can be linked to a CVSS (Common Vulnerability Scoring System) score, which rates the severity of the vulnerability (from 0 to 10). This score is usually available in the CVE details and helps assess how dangerous the issue is.
You can find CVEs through official databases like NVD, MITRE, vendor advisories, security blogs, or tools like scanners and vulnerability management platforms.
Fixing a CVE usually involves applying a patch or update released by the software vendor. In some cases, temporary workarounds or configuration changes can reduce the risk until a full fix is available.
A CVE is not calculated; it’s a unique ID assigned to a discovered vulnerability. However, the related CVSS score is calculated based on how easy the vulnerability is to exploit, the potential impact, and whether it needs user interaction.
See Fidelis Security platforms in action. Learn how our fast scalable platforms provide full visibility, deep insights, and rapid response to help security teams worldwide protect, detect, respond, and neutralize against advanced cyber adversaries.
