90,000 CVEs this year. 283 that matter.

A use-after-free in the upload-progress handler of the scripting language (PHP) lets an unauthenticated attacker read freed server memory, including passwords and keys, and can lead to RCE. Versions since 5.4 are affected, and attacks began before the patch.

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, then restart PHP-FPM or your web server.

After a fatal error, the scripting language (PHP) can keep state that points at freed memory, and a later request treats it as live data, which can lead to RCE without a login. Versions since 5.4 are affected, and attacks began before the patch.

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, then restart PHP-FPM or your web server.

An out-of-bounds write in the Google Brotli decoder lets crafted compressed data corrupt memory, causing a crash, memory disclosure or RCE. The decoder sits inside Node.js, Bun, PowerShell 7, Envoy, Istio and many other products, and attackers are exploiting it.

Update Brotli and every product that bundles it to a fixed release, rebuild containers and bundled applications, then redeploy and restart services.

Explore the collection Build your own deck

A field guide to cyber risk

Know the risk.
Hold the cards.

Real vulnerabilities. Collectible clarity.
Understand what matters, why it matters, and your next move.

940 cards. One common language.

CVE-2014-0160HIGH

Heartbleed

A missing length check in OpenSSL's heartbeat handling lets any remote attacker read 64 kilobytes of server memory at a time — private keys, session cookies, passwords — while leaving nothing behind in the logs.

credential accessT1190

Upgrade OpenSSL to 1.0.1g or later, then replace every certificate and rotate every credential the server held.

CVE-2021-44228CRITICAL

Log4Shell

initial accessT1190 T1059

A logging library resolves lookups inside the text it is asked to log, so any attacker-controlled string that reaches a log line — a username, a header — makes the server fetch and run remote code.

Upgrade Log4j past 2.15.0, and hunt for outbound callbacks from application servers.

CVE-2019-0708CRITICAL

BlueKeep

The Windows remote desktop service frees a channel object and keeps using it, so an unauthenticated attacker who can open a session runs code on the machine — no credentials, no user action.

initial accessT1210

Apply Microsoft's update on every affected Windows version, and require network-level authentication on remote desktop until you have.

Real data. A different perspective.

BUILT ON THE FACTS

CISA KEVNIST NVDFIRST EPSS

Traceable sources. Human-reviewed cards.

THE OPEN ARCHIVE

The collection.

940 base cards940 known exploited

/

940 cards in the archive

Search syntax

Combine terms to narrow your hand. Click one to try it.

EPSS uses percentages. All filters must match.

Fresh from the archive

The latest additions & revisions

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, then restart PHP-FPM or your web server.

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, then restart PHP-FPM or your web server.

Update Brotli and every product that bundles it to a fixed release, rebuild containers and bundled applications, then redeploy and restart services.

A crafted connection to the telnet port of Cisco's router software (IOS) occupies the virtual terminal lines, and further remote logins are refused. Releases 12.2(15) and earlier are affected, and other access paths go with it.

Move the device to a supported release, and reach management over a dedicated path with the telnet and reverse telnet ports closed to everyone else.

CVE-2010-3904HIGH

Linux kernel

The reliable datagram sockets code in Linux kernels before 2.6.36 takes addresses from user space without validating them, so a local user with crafted send and receive calls reaches root. Exploit code is public.

Update the kernel. Where that is impossible, prevent the datagram sockets module from loading at all — the flaw is unreachable without it.

A crafted site drives Internet Explorer 6 through 8 into using an object after it was freed, and the attacker's code runs. It was found in a watering-hole campaign in December 2012, and a public exploit module followed within weeks.

Retire Internet Explorer. The fix shipped as MS13-008 in 2013 and the browser is long out of support; anything still requiring it belongs on an isolated host.

CVE-2014-0196MEDIUM

Linux kernel

The terminal write path in Linux kernels up to 3.14.3 mismanages driver access in one echo mode, so a race between long reads and writes corrupts memory. A local user gets a crash, or privileges.

Update the kernel to your distribution's fixed build. A system still on a 3.x kernel from that era has collected a great deal more than this one flaw.

Several administrative pages on this D-Link router accept requests without checking where they came from — cross-site request forgery (CSRF). A page the administrator visits can create an account or switch on remote management. Fixed in firmware 2.17b02.

Update the router to firmware 2.17b02 or later, and open its administration interface from a browser session that is not also used for ordinary browsing.

Hot off the press

The most recently disclosed vulnerabilities

Update Brotli and every product that bundles it to a fixed release, rebuild containers and bundled applications, then redeploy and restart services.

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, then restart PHP-FPM or your web server.

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, then restart PHP-FPM or your web server.

Check Point Management Server

CVE-2026-93616CRITICAL

A path traversal in Check Point management and log servers lets an unauthenticated attacker upload an executable script outside the intended directory and run it, taking over the console that manages the gateway estate.

Patch Security Management, Multi-Domain and Log servers per Check Point sk1000171 now; hunt for unexpected scripts and jobs on the management host.

Arista VeloCloud Orchestrator

CVE-2026-93952CRITICAL

Arista's on-premises VeloCloud Orchestrator (VCO) does not properly validate input, so a remote attacker can reach privileged internal functions and take over the orchestrator host along with the data it manages.

Patch on-prem VeloCloud Orchestrator per Arista's advisory now; hosted tenants are already fixed. Review orchestrator logs for unexpected privileged calls.

CVE-2026-94127CRITICAL

F5 BIG-IP APM

When F5's Access Policy Manager (APM) runs as an OAuth authorization server on a virtual server, crafted traffic overflows a heap buffer and gives an unauthenticated attacker remote code execution on the appliance.

Patch BIG-IP per F5 article K000162605 now. Deployments using APM only as an OAuth client or resource server are unaffected; confirm your profiles first.

Acronis Backup Panel Plugins

CVE-2026-87886HIGH

The Acronis Backup plugins for cPanel, Plesk and DirectAdmin on Linux ship files with insecure permissions. A user with a low-privilege local account can abuse them to escalate privileges on the hosting server. Exploited in the wild.

Update the Acronis Backup plugin on every cPanel, Plesk and DirectAdmin host to the fixed build, and review those hosts for signs of local compromise.

Cisco Identity Services Engine

CVE-2026-76460CRITICAL

initial accessT1190 T1078

A programming interface on Cisco Identity Services Engine does not properly check who is calling it. Anyone who can reach the device over the network can send a crafted request and get in without logging in, skipping the web management interface entirely.

Apply Cisco's advisory mitigations for Identity Services Engine now, restrict the management interface to trusted networks, and review access logs for unexpected requests.

In the wild

Known exploited. Newest listings first.

Update Brotli and every product that bundles it to a fixed release, rebuild containers and bundled applications, then redeploy and restart services.

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, then restart PHP-FPM or your web server.

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, then restart PHP-FPM or your web server.

Check Point Quantum Gateway

CVE-2026-85102CRITICAL

Check Point gateways accept an untrusted certificate during virtual private network (VPN) negotiation, which lets an unauthenticated remote attacker run code on the gateway itself.

Patch Quantum Security Gateway and Spark per Check Point sk1000117 now; take internet-facing gateways first and check them for signs of compromise.

Check Point Management Server

CVE-2026-93616CRITICAL

Patch Security Management, Multi-Domain and Log servers per Check Point sk1000171 now; hunt for unexpected scripts and jobs on the management host.

Arista VeloCloud Orchestrator

CVE-2026-93952CRITICAL

Patch on-prem VeloCloud Orchestrator per Arista's advisory now; hosted tenants are already fixed. Review orchestrator logs for unexpected privileged calls.

Patch BIG-IP per F5 article K000162605 now. Deployments using APM only as an OAuth client or resource server are unaffected; confirm your profiles first.

CVE-2026-94127CRITICAL

CVE-2026-7273HIGH

Zyxel GS1900 switches

A stack-based buffer overflow in the web management program of Zyxel switches (GS1900-48HPv2) on firmware through 2.90(ABTQ.1)C0 lets an unauthenticated attacker on the local network run operating system commands with one crafted web (HTTP) request.

Apply Zyxel's advisory mitigations for GS1900 series now; restrict LAN access to the switch web management interface to trusted admin hosts and review it for tampering.

The heat is on

Highest exploitation probability

CVE-2014-0160HIGH

Heartbleed

Upgrade OpenSSL to 1.0.1g or later, then replace every certificate and rotate every credential the server held.

credential accessT1190

CVE-2014-6271CRITICAL

Shellshock

The Bourne-again shell keeps parsing after a function definition inside an environment variable, so anything that puts attacker text into the environment — a web gateway, a mail filter — hands it command execution.

executionT1190 T1059

Patch the shell on every host, including containers and appliances, then hunt for requests carrying function definitions in headers.

CVE-2015-1635CRITICAL

Windows HTTP.sys

The Windows kernel driver that serves web requests mishandles a crafted range header, letting a remote attacker run code with kernel privileges before any application ever sees the request.

executionT1190 T1059

Apply Microsoft's security update on every affected Windows version, including servers where only the web stack is enabled.

CVE-2017-5638CRITICAL

Apache Struts

Apache Struts builds an error message out of a malformed upload header and evaluates it as an expression, so one crafted header runs commands on the server.

Upgrade Struts to 2.3.32 or 2.5.10.1, and check upload handling on any service that ran unpatched.

CVE-2017-9841CRITICAL

PHPUnit

initial accessT1190 T1059

A test helper shipped inside a widely used testing library runs whatever code arrives in a request body, and it is routinely left reachable inside deployed web roots.

Upgrade to 4.8.28 or 5.6.3, and keep development dependencies out of anything served to the web.

CVE-2018-13379CRITICAL

Fortinet FortiOS

credential accessT1190 T1083

The remote-access portal on Fortinet's firewalls serves files from outside its own directory to unauthenticated callers, and the file attackers reached for held session credentials in plain text.

Upgrade past 6.0.4, 5.6.7 or 5.4.12, then reset every credential the portal held — patching does not undo what was already taken.

CVE-2019-0708CRITICAL

BlueKeep

The Windows remote desktop service frees a channel object and keeps using it, so an unauthenticated attacker who can open a session runs code on the machine — no credentials, no user action.

initial accessT1210

Apply Microsoft's update on every affected Windows version, and require network-level authentication on remote desktop until you have.

CVE-2019-11510CRITICAL

Pulse Connect Secure

Pulse Connect Secure gateways answer a specially crafted web address by handing back any file on the appliance to an unauthenticated caller — the remote access gateway reads out its own contents to anyone who asks the right way.

Upgrade Pulse Connect Secure to 8.2R12.1, 8.3R7.1 or 9.0R3.4 per advisory SA44101; then rotate every credential and session secret the appliance held.

The legends

The vulnerabilities that made history

CVE-2021-44228CRITICAL

Log4Shell

initial accessT1190 T1059

Upgrade Log4j past 2.15.0, and hunt for outbound callbacks from application servers.

CVE-2014-0160HIGH

Heartbleed

Upgrade OpenSSL to 1.0.1g or later, then replace every certificate and rotate every credential the server held.

credential accessT1190

CVE-2021-26855CRITICAL

ProxyLogon

Microsoft Exchange accepts a request and forwards it onward on the caller's behalf, letting an unauthenticated attacker act as the server and reach mailboxes — the opening move of the ProxyLogon chain.

Apply Microsoft's Exchange security update, then hunt for web shells and exported mailboxes — this one was mass-exploited before most sites patched.

CVE-2020-1472CRITICAL

Zerologon

A flawed cryptographic step lets an attacker on the network set the domain controller's own account password, taking the entire directory in seconds.

Apply Microsoft's update and then enforce secure channel mode; the patch alone leaves the permissive path open.

CVE-2019-0708CRITICAL

BlueKeep

The Windows remote desktop service frees a channel object and keeps using it, so an unauthenticated attacker who can open a session runs code on the machine — no credentials, no user action.

initial accessT1210

Apply Microsoft's update on every affected Windows version, and require network-level authentication on remote desktop until you have.

CVE-2023-34362CRITICAL

MOVEit Transfer

Progress MOVEit Transfer lets an unauthenticated caller inject SQL through its web interface, which one crew used to empty the file stores of hundreds of organisations at once.

Upgrade MOVEit Transfer to a fixed build, and review what was downloaded during the exposure window.

CVE-2023-4966HIGH

Citrix Bleed

Citrix gateway appliances return leftover memory inside a response, and that memory holds valid session tokens — enough for an attacker to take over a logged-in session without ever knowing a password.

credential accessT1539

Upgrade NetScaler to a fixed build per Citrix's advisory, then terminate every active session — patching alone leaves stolen tokens valid.