{
  "query": {
    "exploited": "1",
    "page": "60"
  },
  "count": 20,
  "total": 1734,
  "page": 60,
  "limit": 20,
  "updated": {
    "cves": "2026-10-08T10:49:04.872Z",
    "kev": "2026-10-08T10:50:04.958Z",
    "epss": "2026-10-08T07:00:55.738Z",
    "breaches": "2026-10-08T06:48:55.302Z",
    "posts": "2026-10-08T10:49:04.872Z"
  },
  "links": {
    "web": "https://spydr.io/threats?exploited=1&page=60",
    "next": "https://spydr.io/threats.json?exploited=1&page=61"
  },
  "coverage": {
    "cves_published_since": "2026-06-10",
    "days": 120,
    "also": "every CVE in CISA KEV"
  },
  "unscored_hidden": 0,
  "warnings": [],
  "results": [
    {
      "id": "CVE-2020-8657",
      "url": "https://spydr.io/cve/CVE-2020-8657",
      "published": "2020-02-06T18:15:13.963Z",
      "modified": "2026-06-17T03:26:43.000Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.91874,
      "epss_percentile": 0.99816,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "eyesofnetwork"
      ],
      "products": [
        "eyesofnetwork"
      ],
      "cwes": [
        "CWE-798"
      ],
      "description": "An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token."
    },
    {
      "id": "CVE-2020-8644",
      "url": "https://spydr.io/cve/CVE-2020-8644",
      "published": "2020-02-05T22:15:11.003Z",
      "modified": "2026-06-17T03:26:41.917Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.86689,
      "epss_percentile": 0.99739,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "playsms"
      ],
      "products": [
        "playsms"
      ],
      "cwes": [
        "CWE-94"
      ],
      "description": "PlaySMS before 1.4.3 does not sanitize inputs from a malicious string."
    },
    {
      "id": "CVE-2020-3118",
      "url": "https://spydr.io/cve/CVE-2020-3118",
      "published": "2020-02-05T18:15:10.907Z",
      "modified": "2026-06-17T03:17:23.013Z",
      "score": 8.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.11685,
      "epss_percentile": 0.95962,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Cisco"
      ],
      "products": [
        "Cisco IOS XR Software"
      ],
      "cwes": [
        "CWE-134",
        "CWE-787"
      ],
      "description": "A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent)."
    },
    {
      "id": "CVE-2020-8515",
      "url": "https://spydr.io/cve/CVE-2020-8515",
      "published": "2020-02-01T13:15:12.623Z",
      "modified": "2026-06-17T03:26:30.047Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.99993,
      "epss_percentile": 0.99987,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "draytek"
      ],
      "products": [
        "draytek vigor2960 firmware",
        "draytek vigor300b firmware",
        "draytek vigor3900 firmware"
      ],
      "cwes": [
        "CWE-78"
      ],
      "description": "DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1."
    },
    {
      "id": "CVE-2020-7247",
      "url": "https://spydr.io/cve/CVE-2020-7247",
      "published": "2020-01-29T16:15:12.897Z",
      "modified": "2026-06-17T03:24:35.133Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.98972,
      "epss_percentile": 0.99929,
      "exploited": true,
      "kev": {
        "added": "2022-03-25",
        "due": "2022-04-15",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "openbsd",
        "debian",
        "fedoraproject",
        "canonical"
      ],
      "products": [
        "openbsd opensmtpd",
        "debian linux",
        "fedoraproject fedora",
        "canonical ubuntu linux"
      ],
      "cwes": [
        "CWE-78",
        "CWE-755"
      ],
      "description": "smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation."
    },
    {
      "id": "CVE-2019-18426",
      "url": "https://spydr.io/cve/CVE-2019-18426",
      "published": "2020-01-21T21:15:16.147Z",
      "modified": "2026-06-17T02:25:01.227Z",
      "score": 8.2,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "score_source": "NVD",
      "epss": 0.67859,
      "epss_percentile": 0.99306,
      "exploited": true,
      "kev": {
        "added": "2022-05-23",
        "due": "2022-06-13",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Facebook"
      ],
      "products": [
        "Facebook WhatsApp Desktop"
      ],
      "cwes": [
        "CWE-79"
      ],
      "description": "A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message."
    },
    {
      "id": "CVE-2020-2555",
      "url": "https://spydr.io/cve/CVE-2020-2555",
      "published": "2020-01-15T17:15:17.347Z",
      "modified": "2026-06-17T03:12:20.697Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.97116,
      "epss_percentile": 0.99894,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Oracle Corporation"
      ],
      "products": [
        "Oracle Corporation WebCenter Portal",
        "Oracle Corporation Utilities Framework"
      ],
      "cwes": [
        "CWE-502"
      ],
      "description": "Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."
    },
    {
      "id": "CVE-2020-2551",
      "url": "https://spydr.io/cve/CVE-2020-2551",
      "published": "2020-01-15T17:15:17.190Z",
      "modified": "2026-06-17T03:12:20.303Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.93217,
      "epss_percentile": 0.99834,
      "exploited": true,
      "kev": {
        "added": "2023-11-16",
        "due": "2023-12-07",
        "action": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Oracle Corporation"
      ],
      "products": [
        "Oracle Corporation WebLogic Server"
      ],
      "cwes": [],
      "description": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."
    },
    {
      "id": "CVE-2020-0646",
      "url": "https://spydr.io/cve/CVE-2020-0646",
      "published": "2020-01-14T23:15:33.143Z",
      "modified": "2026-06-17T02:46:15.230Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.99222,
      "epss_percentile": 0.99935,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2",
        "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2",
        "Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for 32-bit Systems",
        "Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for x64-based Systems",
        "Microsoft .NET Framework 4.8 on Windows Server, version 1803 (Server Core Installation)",
        "Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for 32-bit Systems",
        "Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for x64-based Systems",
        "Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for 32-bit Systems",
        "Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based Systems",
        "Microsoft .NET Framework 4.8 on Windows Server 2016",
        "Microsoft .NET Framework 4.8 on Windows Server 2016 (Server Core installation)",
        "Microsoft .NET Framework 4.8 on Windows 7 for 32-bit Systems Service Pack 1",
        "Microsoft .NET Framework 4.8 on Windows 7 for x64-based Systems Service Pack 1",
        "Microsoft .NET Framework 4.8 on Windows 8.1 for 32-bit systems",
        "Microsoft .NET Framework 4.8 on Windows 8.1 for x64-based systems",
        "Microsoft .NET Framework 4.8 on Windows RT 8.1",
        "Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1",
        "Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
        "Microsoft .NET Framework 4.8 on Windows Server 2012",
        "Microsoft .NET Framework 4.8 on Windows Server 2012 (Server Core installation)"
      ],
      "cwes": [
        "CWE-91"
      ],
      "description": "A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'."
    },
    {
      "id": "CVE-2020-0638",
      "url": "https://spydr.io/cve/CVE-2020-0638",
      "published": "2020-01-14T23:15:32.503Z",
      "modified": "2026-08-12T05:17:27.463Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.0237,
      "epss_percentile": 0.83303,
      "exploited": true,
      "kev": {
        "added": "2022-05-23",
        "due": "2022-06-13",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Windows",
        "Microsoft Windows 10 Version 1903 for ARM64-based Systems",
        "Microsoft Windows 10 Version 1903 for 32-bit Systems",
        "Microsoft Windows 10 Version 1903 for x64-based Systems",
        "Microsoft Windows Server",
        "Microsoft Windows Server, version 1903 (Server Core installation)",
        "Microsoft Windows 10 Version 1909 for 32-bit Systems",
        "Microsoft Windows 10 Version 1909 for x64-based Systems",
        "Microsoft Windows Server, version 1909 (Server Core installation)",
        "Microsoft Windows 10 Version 1909 for ARM64-based Systems"
      ],
      "cwes": [
        "CWE-59"
      ],
      "description": "An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'."
    },
    {
      "id": "CVE-2020-0601",
      "url": "https://spydr.io/cve/CVE-2020-0601",
      "published": "2020-01-14T23:15:30.207Z",
      "modified": "2026-06-17T02:46:08.127Z",
      "score": 8.1,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "score_source": "NVD",
      "epss": 0.89436,
      "epss_percentile": 0.99783,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Microsoft"
      ],
      "products": [
        "Microsoft Windows",
        "Microsoft Windows Server",
        "Microsoft Windows 10 Version 1903 for 32-bit Systems",
        "Microsoft Windows 10 Version 1903 for x64-based Systems",
        "Microsoft Windows 10 Version 1903 for ARM64-based Systems",
        "Microsoft Windows Server, version 1903 (Server Core installation)",
        "Microsoft Windows 10 Version 1909 for 32-bit Systems",
        "Microsoft Windows 10 Version 1909 for x64-based Systems",
        "Microsoft Windows Server, version 1909 (Server Core installation)",
        "Microsoft Windows 10 Version 1909 for ARM64-based Systems"
      ],
      "cwes": [
        "CWE-295"
      ],
      "description": "A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'."
    },
    {
      "id": "CVE-2019-17621",
      "url": "https://spydr.io/cve/CVE-2019-17621",
      "published": "2019-12-30T17:15:19.857Z",
      "modified": "2026-06-17T02:24:17.420Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.89624,
      "epss_percentile": 0.99786,
      "exploited": true,
      "kev": {
        "added": "2023-06-29",
        "due": "2023-07-20",
        "action": "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "dlink"
      ],
      "products": [
        "dlink dir-859 firmware",
        "dlink dir-822 firmware",
        "dlink dir-823 firmware",
        "dlink dir-865l firmware",
        "dlink dir-868l firmware",
        "dlink dir-869 firmware",
        "dlink dir-880l firmware",
        "dlink dir-890l firmware",
        "dlink dir-890r firmware",
        "dlink dir-885l firmware",
        "dlink dir-885r firmware",
        "dlink dir-895l firmware",
        "dlink dir-895r firmware",
        "dlink dir-818lx firmware"
      ],
      "cwes": [
        "CWE-78"
      ],
      "description": "The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network."
    },
    {
      "id": "CVE-2019-17558",
      "url": "https://spydr.io/cve/CVE-2019-17558",
      "published": "2019-12-30T17:15:19.780Z",
      "modified": "2026-06-17T02:24:09.007Z",
      "score": 7.5,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.98567,
      "epss_percentile": 0.99922,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "apache",
        "oracle"
      ],
      "products": [
        "Apache Solr"
      ],
      "cwes": [
        "CWE-74"
      ],
      "description": "Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user)."
    },
    {
      "id": "CVE-2019-20085",
      "url": "https://spydr.io/cve/CVE-2019-20085",
      "published": "2019-12-30T03:15:10.663Z",
      "modified": "2026-06-17T02:29:56.823Z",
      "score": 7.5,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "score_source": "NVD",
      "epss": 0.96071,
      "epss_percentile": 0.99877,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "tvt"
      ],
      "products": [
        "tvt nvms-1000 firmware"
      ],
      "cwes": [
        "CWE-22"
      ],
      "description": "TVT NVMS-1000 devices allow GET /.. Directory Traversal"
    },
    {
      "id": "CVE-2019-19781",
      "url": "https://spydr.io/cve/CVE-2019-19781",
      "published": "2019-12-27T14:15:12.070Z",
      "modified": "2026-08-12T05:17:21.853Z",
      "score": 9.8,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.99999,
      "epss_percentile": 0.99998,
      "exploited": true,
      "kev": {
        "added": "2021-11-03",
        "due": "2022-05-03",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Known"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "citrix"
      ],
      "products": [
        "citrix application delivery controller firmware",
        "citrix netscaler gateway firmware",
        "citrix gateway firmware"
      ],
      "cwes": [
        "CWE-22"
      ],
      "description": "An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal."
    },
    {
      "id": "CVE-2019-10758",
      "url": "https://spydr.io/cve/CVE-2019-10758",
      "published": "2019-12-24T22:15:11.183Z",
      "modified": "2026-06-17T02:11:36.920Z",
      "score": 9.9,
      "severity": "critical",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.84726,
      "epss_percentile": 0.99703,
      "exploited": true,
      "kev": {
        "added": "2021-12-10",
        "due": "2022-06-10",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "mongo-express project"
      ],
      "products": [
        "mongo-express"
      ],
      "cwes": [
        "CWE-94"
      ],
      "description": "mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment."
    },
    {
      "id": "CVE-2019-7483",
      "url": "https://spydr.io/cve/CVE-2019-7483",
      "published": "2019-12-19T01:15:10.803Z",
      "modified": "2026-06-17T02:40:39.057Z",
      "score": 7.5,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "score_source": "NVD",
      "epss": 0.0401,
      "epss_percentile": 0.90285,
      "exploited": true,
      "kev": {
        "added": "2022-03-28",
        "due": "2022-04-18",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "SonicWall"
      ],
      "products": [
        "SonicWall SMA100"
      ],
      "cwes": [
        "CWE-22"
      ],
      "description": "In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server."
    },
    {
      "id": "CVE-2019-8605",
      "url": "https://spydr.io/cve/CVE-2019-8605",
      "published": "2019-12-18T18:15:28.833Z",
      "modified": "2026-06-17T02:42:14.560Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.17609,
      "epss_percentile": 0.97078,
      "exploited": true,
      "kev": {
        "added": "2022-06-27",
        "due": "2022-07-18",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Apple"
      ],
      "products": [
        "Apple iOS",
        "Apple macOS",
        "Apple tvOS",
        "Apple watchOS"
      ],
      "cwes": [
        "CWE-416"
      ],
      "description": "A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges."
    },
    {
      "id": "CVE-2019-8526",
      "url": "https://spydr.io/cve/CVE-2019-8526",
      "published": "2019-12-18T18:15:24.223Z",
      "modified": "2026-06-17T02:42:06.077Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.00701,
      "epss_percentile": 0.51736,
      "exploited": true,
      "kev": {
        "added": "2023-04-17",
        "due": "2023-05-08",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Apple"
      ],
      "products": [
        "Apple macOS"
      ],
      "cwes": [
        "CWE-416"
      ],
      "description": "A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges."
    },
    {
      "id": "CVE-2019-8506",
      "url": "https://spydr.io/cve/CVE-2019-8506",
      "published": "2019-12-18T18:15:22.880Z",
      "modified": "2026-06-17T02:42:03.093Z",
      "score": 8.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "score_source": "NVD",
      "epss": 0.16159,
      "epss_percentile": 0.96856,
      "exploited": true,
      "kev": {
        "added": "2022-05-04",
        "due": "2022-05-25",
        "action": "Apply updates per vendor instructions.",
        "ransomware": "Unknown"
      },
      "ssvc_exploitation": "active",
      "vendors": [
        "Apple"
      ],
      "products": [
        "Apple iOS",
        "Apple tvOS",
        "Apple watchOS",
        "Apple Safari",
        "Apple iTunes for Windows",
        "Apple iCloud for Windows"
      ],
      "cwes": [
        "CWE-843"
      ],
      "description": "A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution."
    }
  ],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}