90,000 CVEs this year. 283 that matter.

An attacker who already has arbitrary read and write capability may be able to bypass Pointer Authentication, a memory protection, on Apple devices. Safari, iOS, iPadOS, macOS, tvOS and watchOS are affected.

unclassified

Update Apple devices and Safari to the fixed releases: Safari 17.5, iOS and iPadOS 16.7.8 or 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5.

During a full-package core upgrade, WordPress Core 4.7 through 7.1.3 stages files at predictable, web-accessible paths. An unauthenticated attacker who strikes in that upgrade window can run code on the server.

Update WordPress Core to a release newer than 7.1.3 on every site.

CVE-2026-111357HIGH

Ivanti Connect Secure 22.8R2.4 mishandles how its dsinvoked broker trusts DSCache configuration data, letting a local attacker with a login escalate to root. It can be chained with CVE-2026-104935 and CVE-2026-118527.

Follow Ivanti's Connect Secure advisory now and address this flaw together with CVE-2026-104935 and CVE-2026-118527.

Explore the collection Build your own deck

A field guide to cyber risk

Know the risk.
Hold the cards.

Real vulnerabilities. Collectible clarity.
Understand what matters, why it matters, and your next move.

1018 cards. One common language.

CVE-2014-0160HIGH

Heartbleed

A missing length check in OpenSSL's heartbeat handling lets any remote attacker read 64 kilobytes of server memory at a time — private keys, session cookies, passwords — while leaving nothing behind in the logs.

credential accessT1190

Upgrade OpenSSL to 1.0.1g or later, then replace every certificate and rotate every credential the server held.

CVE-2021-44228CRITICAL

Log4Shell

initial accessT1190 T1059

A logging library resolves lookups inside the text it is asked to log, so any attacker-controlled string that reaches a log line — a username, a header — makes the server fetch and run remote code.

Upgrade Log4j past 2.15.0, and hunt for outbound callbacks from application servers.

CVE-2019-0708CRITICAL

BlueKeep

The Windows remote desktop service frees a channel object and keeps using it, so an unauthenticated attacker who can open a session runs code on the machine — no credentials, no user action.

initial accessT1210

Apply Microsoft's update on every affected Windows version, and require network-level authentication on remote desktop until you have.

Real data. A different perspective.

BUILT ON THE FACTS

CISA KEVNIST NVDFIRST EPSS

Traceable sources. Human-reviewed cards.

THE OPEN ARCHIVE

The collection.

1018 base cards1018 known exploited

/

1018 cards in the archive

Search syntax

Combine terms to narrow your hand. Click one to try it.

EPSS uses percentages. All filters must match.

Fresh from the archive

The latest additions & revisions

CVE-2022-37042CRITICAL

Zimbra Collaboration

The mboximport function in Zimbra Collaboration 8.8.15 and 9.0 can be reached without authentication, so an attacker can upload an archive whose files land anywhere on the system, leading to RCE. It stems from an incomplete fix for CVE-2022-27925.

Apply the fix from Zimbra's security advisories to every 8.8.15 and 9.0 server.

Windows Common Log File System Driver

CVE-2022-37969HIGH

privilege escalationT1068

An unspecified flaw in the Windows Common Log File System (CLFS) driver lets a local attacker with low privileges escalate their privileges. Ransomware campaigns are known to use this flaw.

Install the Microsoft update for CVE-2022-37969 on every Windows system.

Arm Mali GPU Kernel Driver

CVE-2022-38181HIGH

The Arm Mali graphics processor kernel driver mishandles memory operations, so an unprivileged user can reach freed memory and may gain root privileges or disclose information. Bifrost, Valhall and Midgard drivers are affected, and public exploit code exists.

Update the Arm Mali driver following Arm's security updates, or install your device vendor's update.

CVE-2022-39197HIGH

Cobalt Strike Teamserver

A cross-site scripting (XSS) flaw in Cobalt Strike through 4.7 lets a remote attacker set a malformed username in a payload's configuration and run markup on the teamserver, which can lead to remote code execution.

executionT1059.007

Update Cobalt Strike to a release newer than 4.7.1, which also covers CVE-2022-42948.

Trend Micro Apex One clients do not properly validate rollback components, so someone with server admin console access can make clients download an unverified package, which could lead to RCE on those clients.

Apply Trend Micro solution 000291528 and review who holds Apex One administration console access.

CVE-2022-40765HIGH

Mitel MiVoice Connect

The Edge Gateway component of Mitel MiVoice Connect through 19.3 does not restrict link parameters, so an authenticated attacker with internal network access can run commands on the system. Ransomware campaigns are known to use this flaw.

executionT1059

Follow Mitel security advisory 22-0007 and keep MiVoice Connect reachable only from trusted internal networks.

Windows COM+ Event System Service

CVE-2022-41033HIGH

An unspecified flaw in the Windows event system service for component software lets a local attacker with low privileges escalate their privileges.

Install the Microsoft update for CVE-2022-41033 on every Windows system.

CVE-2022-41049MEDIUM

Windows Mark of the Web

A flaw in Windows Mark of the Web (MOTW) lets an attacker bypass this security feature, causing a limited loss of integrity and availability of security features.

defense evasion

Install the Microsoft update for CVE-2022-41049 on every Windows system.

Hot off the press

The most recently disclosed vulnerabilities

CVE-2026-118527HIGH

Predictable filenames in Ivanti Connect Secure let a remote attacker with a login upload attacker-controlled content to a known location on disk. It can be chained with CVE-2026-104935 and CVE-2026-111357.

unclassified

Update Ivanti Connect Secure to 25.1.1.3 or 22.8R2.6 or later, and address the chained flaws at the same time.

Update WordPress Core to a release newer than 7.1.3 on every site.

Cisco Secure Firewall ASA and FTD

CVE-2026-76418HIGH

A logic error in the remote access virtual private network (VPN) service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) software lets an unauthenticated attacker force a device reload, causing a denial of service.

impact

Apply the guidance in Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 to every affected firewall.

Brotli decoder out-of-bounds write

CVE-2026-111497CRITICAL

Broccoli2Shell

An out-of-bounds write in the Google Brotli decoder lets crafted compressed data corrupt memory, causing a crash, memory disclosure or RCE. The decoder sits inside Node.js, Bun, PowerShell 7, Envoy, Istio and many other products, and attackers are exploiting it.

Update Brotli and every product that bundles it to a fixed release, rebuild containers and bundled applications, then redeploy and restart services.

Arista VeloCloud Orchestrator

CVE-2026-114625CRITICAL

A SQL injection flaw in on-premises VeloCloud Orchestrator lets any authenticated user gain operator privileges, pose as a local superuser and reach internal-only functions. That can compromise the orchestrator, its host and the data it manages.

Apply Arista Security Advisory 0199 to on-premises VeloCloud Orchestrator. Hosted versions are already patched.

Upload-progress use-after-free

CVE-2026-109618CRITICAL

PHP2Shell

A use-after-free in the upload-progress handler of the scripting language (PHP) lets an unauthenticated attacker read freed server memory, including passwords and keys, and can lead to RCE. Versions since 5.4 are affected, and attacks began before the patch.

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, then restart PHP-FPM or your web server.

Backtrace use-after-free / OPcache

CVE-2026-109619CRITICAL

PHP2Shell

After a fatal error, the scripting language (PHP) can keep state that points at freed memory, and a later request treats it as live data, which can lead to RCE without a login. Versions since 5.4 are affected, and attacks began before the patch.

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, then restart PHP-FPM or your web server.

BeyondTrust Remote Support

CVE-2026-102764CRITICAL

Internal components of BeyondTrust Remote Support do not properly check where messages come from. Under the right conditions, a remote attacker can spoof a message and perform file operations on the appliance.

unclassified

Apply the mitigations in BeyondTrust advisory BT26-05 and restrict network access to the appliance until that is done.

In the wild

Known exploited. Newest listings first.

Apple Pointer Authentication Bypass

CVE-2024-27834MEDIUM

Update Apple devices and Safari to the fixed releases: Safari 17.5, iOS and iPadOS 16.7.8 or 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5.

Update WordPress Core to a release newer than 7.1.3 on every site.

CVE-2026-111357HIGH

Follow Ivanti's Connect Secure advisory now and address this flaw together with CVE-2026-104935 and CVE-2026-118527.

CVE-2026-118527HIGH

Update Ivanti Connect Secure to 25.1.1.3 or 22.8R2.6 or later, and address the chained flaws at the same time.

Cisco Secure Firewall ASA and FTD

CVE-2026-76418HIGH

Apply the guidance in Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 to every affected firewall.

CVE-2026-97229CRITICAL

GitLab CE/EE

Weak validation of regular expressions in continuous integration and delivery (CI/CD) configuration lets an unauthenticated user, under certain conditions, run arbitrary code on a GitLab server. The root flaw is an integer overflow, and versions from 19.2 are affected.

initial access

Update GitLab CE/EE to 19.2.8, 19.3.5 or 19.4.2 now.

The VMware host software (ESX) does not log everything an administrator does. A malicious actor with admin access can perform certain operations without leaving a log entry, which makes their activity harder to trace.

Apply the guidance in Broadcom security advisory 38017 and review who holds administrator access to ESX hosts.

CVE-2026-46300HIGH

Linux Kernel

privilege escalationT1068

When the Linux kernel merges socket buffers it can lose the marker for shared memory fragments, so encrypted packet processing decrypts in place over page-cache data. It can be chained with CVE-2026-109618 and CVE-2026-109619 to run commands as root.

Install a Linux kernel update containing the skb_try_coalesce fix, then reboot affected hosts.

The heat is on

Highest exploitation probability

CVE-2014-0160HIGH

Heartbleed

Upgrade OpenSSL to 1.0.1g or later, then replace every certificate and rotate every credential the server held.

credential accessT1190

CVE-2014-6271CRITICAL

Shellshock

The Bourne-again shell keeps parsing after a function definition inside an environment variable, so anything that puts attacker text into the environment — a web gateway, a mail filter — hands it command execution.

executionT1190 T1059

Patch the shell on every host, including containers and appliances, then hunt for requests carrying function definitions in headers.

CVE-2015-1635CRITICAL

Windows HTTP.sys

The Windows kernel driver that serves web requests mishandles a crafted range header, letting a remote attacker run code with kernel privileges before any application ever sees the request.

executionT1190 T1059

Apply Microsoft's security update on every affected Windows version, including servers where only the web stack is enabled.

CVE-2017-5638CRITICAL

Apache Struts

Apache Struts builds an error message out of a malformed upload header and evaluates it as an expression, so one crafted header runs commands on the server.

Upgrade Struts to 2.3.32 or 2.5.10.1, and check upload handling on any service that ran unpatched.

CVE-2017-9841CRITICAL

PHPUnit

initial accessT1190 T1059

A test helper shipped inside a widely used testing library runs whatever code arrives in a request body, and it is routinely left reachable inside deployed web roots.

Upgrade to 4.8.28 or 5.6.3, and keep development dependencies out of anything served to the web.

CVE-2018-13379CRITICAL

Fortinet FortiOS

credential accessT1190 T1083

The remote-access portal on Fortinet's firewalls serves files from outside its own directory to unauthenticated callers, and the file attackers reached for held session credentials in plain text.

Upgrade past 6.0.4, 5.6.7 or 5.4.12, then reset every credential the portal held — patching does not undo what was already taken.

CVE-2019-0708CRITICAL

BlueKeep

The Windows remote desktop service frees a channel object and keeps using it, so an unauthenticated attacker who can open a session runs code on the machine — no credentials, no user action.

initial accessT1210

Apply Microsoft's update on every affected Windows version, and require network-level authentication on remote desktop until you have.

CVE-2019-11510CRITICAL

Pulse Connect Secure

Pulse Connect Secure gateways answer a specially crafted web address by handing back any file on the appliance to an unauthenticated caller — the remote access gateway reads out its own contents to anyone who asks the right way.

Upgrade Pulse Connect Secure to 8.2R12.1, 8.3R7.1 or 9.0R3.4 per advisory SA44101; then rotate every credential and session secret the appliance held.

The legends

The vulnerabilities that made history

CVE-2021-44228CRITICAL

Log4Shell

initial accessT1190 T1059

Upgrade Log4j past 2.15.0, and hunt for outbound callbacks from application servers.

CVE-2014-0160HIGH

Heartbleed

Upgrade OpenSSL to 1.0.1g or later, then replace every certificate and rotate every credential the server held.

credential accessT1190

CVE-2021-26855CRITICAL

ProxyLogon

Microsoft Exchange accepts a request and forwards it onward on the caller's behalf, letting an unauthenticated attacker act as the server and reach mailboxes — the opening move of the ProxyLogon chain.

Apply Microsoft's Exchange security update, then hunt for web shells and exported mailboxes — this one was mass-exploited before most sites patched.

CVE-2020-1472CRITICAL

Zerologon

privilege escalationT1068

A flawed cryptographic step lets an attacker on the network set the domain controller's own account password, taking the entire directory in seconds.

Apply Microsoft's update and then enforce secure channel mode; the patch alone leaves the permissive path open.

CVE-2019-0708CRITICAL

BlueKeep

The Windows remote desktop service frees a channel object and keeps using it, so an unauthenticated attacker who can open a session runs code on the machine — no credentials, no user action.

initial accessT1210

Apply Microsoft's update on every affected Windows version, and require network-level authentication on remote desktop until you have.

CVE-2023-34362CRITICAL

MOVEit Transfer

Progress MOVEit Transfer lets an unauthenticated caller inject SQL through its web interface, which one crew used to empty the file stores of hundreds of organisations at once.

Upgrade MOVEit Transfer to a fixed build, and review what was downloaded during the exposure window.

CVE-2023-4966HIGH

Citrix Bleed

Citrix gateway appliances return leftover memory inside a response, and that memory holds valid session tokens — enough for an attacker to take over a logged-in session without ever knowing a password.

credential accessT1539

Upgrade NetScaler to a fixed build per Citrix's advisory, then terminate every active session — patching alone leaves stolen tokens valid.