| CVE | Vendor · product | Added to KEV | Due | EPSS | APAC news |
|---|---|---|---|---|---|
| CVE-2019-17558
Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability |
Apache · Solr | Nov 3, 2021 | May 3, 2022 | 98.6% | — |
| CVE-2024-9463
Palo Alto Networks Expedition OS Command Injection Vulnerability |
Palo Alto Networks · Expedition | Nov 14, 2024 | Dec 5, 2024 | 98.5% | — |
| CVE-2019-11539 Ransomware
Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability |
Ivanti · Pulse Connect Secure and Pulse Policy Secure | Nov 3, 2021 | May 3, 2022 | 98.5% | — |
| CVE-2012-4681 Ransomware
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability |
Oracle · Java SE | Mar 3, 2022 | Mar 24, 2022 | 98.5% | — |
| CVE-2026-41940 Ransomware
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Cri… |
WebPros · cPanel & WHM and WP2 (WordPress Squared) | Apr 30, 2026 | May 3, 2026 | 98.5% | — |
| CVE-2024-50603
Aviatrix Controllers OS Command Injection Vulnerability |
Aviatrix · Controllers | Jan 16, 2025 | Feb 6, 2025 | 98.5% | — |
| CVE-2024-20767
Adobe ColdFusion Improper Access Control Vulnerability |
Adobe · ColdFusion | Dec 16, 2024 | Jan 6, 2025 | 98.5% | — |
| CVE-2019-5418
Rails Ruby on Rails Path Traversal Vulnerability |
Rails · Ruby on Rails | Jul 7, 2025 | Jul 28, 2025 | 98.5% | — |
| CVE-2026-34486
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability |
Apache · Tomcat | Aug 4, 2026 | Aug 7, 2026 | 98.5% | — |
| CVE-2022-30190 Ransomware
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerab… |
Microsoft · Windows | Jun 14, 2022 | Jul 5, 2022 | 98.5% | — |
| CVE-2021-21311
Adminer Server-Side Request Forgery Vulnerability |
Adminer · Adminer | Sep 29, 2025 | Oct 20, 2025 | 98.5% | — |
| CVE-2025-0108
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability |
Palo Alto Networks · PAN-OS | Feb 18, 2025 | Mar 11, 2025 | 98.5% | — |
| CVE-2023-48788 Ransomware
Fortinet FortiClient EMS SQL Injection Vulnerability |
Fortinet · FortiClient EMS | Mar 25, 2024 | Apr 15, 2024 | 98.4% | — |
| CVE-2016-3088
Apache ActiveMQ Improper Input Validation Vulnerability |
Apache · ActiveMQ | Feb 10, 2022 | Aug 10, 2022 | 98.4% | — |
| CVE-2022-21587 Ransomware
Oracle E-Business Suite Unspecified Vulnerability |
Oracle · E-Business Suite | Feb 2, 2023 | Feb 23, 2023 | 98.3% | — |
| CVE-2017-15944
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability |
Palo Alto Networks · PAN-OS | Aug 18, 2022 | Sep 8, 2022 | 98.3% | — |
| CVE-2018-1000861
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability |
Jenkins · Jenkins Stapler Web Framework | Feb 10, 2022 | Aug 10, 2022 | 98.3% | — |
| CVE-2016-1555
NETGEAR Multiple WAP Devices Command Injection Vulnerability |
NETGEAR · Wireless Access Point (WAP) Devices | Mar 25, 2022 | Apr 15, 2022 | 98.3% | — |
| CVE-2023-20887
Vmware Aria Operations for Networks Command Injection Vulnerability |
VMware · Aria Operations for Networks | Jun 22, 2023 | Jul 13, 2023 | 98.3% | — |
| CVE-2026-34197
Apache ActiveMQ Improper Input Validation Vulnerability |
Apache · ActiveMQ | Apr 16, 2026 | Apr 30, 2026 | 98.3% | — |
| CVE-2022-22947
VMware Spring Cloud Gateway Code Injection Vulnerability |
VMware · Spring Cloud Gateway | May 16, 2022 | Jun 6, 2022 | 98.3% | — |
| CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability |
Atlassian · Confluence | Jul 29, 2022 | Aug 19, 2022 | 98.2% | — |
| CVE-2024-12987
DrayTek Vigor Routers OS Command Injection Vulnerability |
DrayTek · Vigor Routers | May 15, 2025 | Jun 5, 2025 | 98.2% | — |
| CVE-2026-72898
Metabase SQL Injection Vulnerability |
Metabase · Metabase | Aug 11, 2026 | Aug 14, 2026 | 98.2% | — |
| CVE-2012-0507 Ransomware
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability |
Oracle · Java SE | Mar 3, 2022 | Mar 24, 2022 | 98.2% | — |
| CVE-2021-33766
Microsoft Exchange Server Information Disclosure |
Microsoft · Exchange Server | Jan 18, 2022 | Feb 1, 2022 | 98.2% | — |
| CVE-2023-27524
Apache Superset Insecure Default Initialization of Resource Vulnerability |
Apache · Superset | Jan 8, 2024 | Jan 29, 2024 | 98.1% | — |
| CVE-2020-6207
SAP Solution Manager Missing Authentication for Critical Function Vulnerability |
SAP · Solution Manager | Nov 3, 2021 | May 3, 2022 | 98.1% | — |
| CVE-2019-5544 Ransomware
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability |
VMware · VMware ESXi and Horizon DaaS | Nov 3, 2021 | May 3, 2022 | 98.1% | — |
| CVE-2021-39144
XStream Remote Code Execution Vulnerability |
XStream · XStream | Mar 10, 2023 | Mar 31, 2023 | 98.1% | — |
| CVE-2026-31431
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability |
Linux · Kernel | May 1, 2026 | May 15, 2026 | 98.1% | — |
| CVE-2024-3272
D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability |
D-Link · Multiple NAS Devices | Apr 11, 2024 | May 2, 2024 | 98.1% | — |
| CVE-2023-25717
Multiple Ruckus Wireless Products CSRF and RCE Vulnerability |
Ruckus Wireless · Multiple Products | May 12, 2023 | Jun 2, 2023 | 98.1% | — |
| CVE-2021-35395
Realtek AP-Router SDK Buffer Overflow Vulnerability |
Realtek · AP-Router SDK | Nov 3, 2021 | Nov 17, 2021 | 98.1% | — |
| CVE-2022-29303
SolarView Compact Command Injection Vulnerability |
SolarView · Compact | Jul 13, 2023 | Aug 3, 2023 | 98.0% | — |
| CVE-2020-1956
Apache Kylin OS Command Injection Vulnerability |
Apache · Kylin | Mar 25, 2022 | Apr 15, 2022 | 98.0% | — |
| CVE-2020-17519
Apache Flink Improper Access Control Vulnerability |
Apache · Flink | May 23, 2024 | Jun 13, 2024 | 98.0% | — |
| CVE-2022-22536
SAP Multiple Products HTTP Request Smuggling Vulnerability |
SAP · Multiple Products | Aug 18, 2022 | Sep 8, 2022 | 97.9% | — |
| CVE-2018-19410
Paessler PRTG Network Monitor Local File Inclusion Vulnerability |
Paessler · PRTG Network Monitor | Feb 4, 2025 | Feb 25, 2025 | 97.9% | — |
| CVE-2023-25280
D-Link DIR-820 Router OS Command Injection Vulnerability |
D-Link · DIR-820 Router | Sep 30, 2024 | Oct 21, 2024 | 97.9% | — |
| CVE-2021-40444 Ransomware
Microsoft MSHTML Remote Code Execution Vulnerability |
Microsoft · MSHTML | Nov 3, 2021 | Nov 17, 2021 | 97.8% | — |
| CVE-2021-45382
D-Link Multiple Routers Remote Code Execution Vulnerability |
D-Link · Multiple Routers | Apr 4, 2022 | Apr 25, 2022 | 97.8% | — |
| CVE-2021-36380
Sunhillo SureLine OS Command Injection Vulnerablity |
Sunhillo · SureLine | Mar 5, 2024 | Mar 26, 2024 | 97.8% | — |
| CVE-2020-11738
WordPress Snap Creek Duplicator Plugin File Download Vulnerability |
WordPress · Snap Creek Duplicator Plugin | Nov 3, 2021 | May 3, 2022 | 97.8% | — |
| CVE-2015-7450
IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. |
IBM · WebSphere Application Server and Server Hypervisor Edition | Jan 10, 2022 | Jul 10, 2022 | 97.8% | — |
| CVE-2026-21643
Fortinet FortiClient EMS SQL Injection Vulnerability |
Fortinet · FortiClient EMS | Apr 13, 2026 | Apr 16, 2026 | 97.7% | — |
| CVE-2020-14883
Oracle WebLogic Server Unspecified Vulnerability |
Oracle · WebLogic Server | Nov 3, 2021 | May 3, 2022 | 97.7% | — |
| CVE-2022-43769
Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability |
Hitachi Vantara · Pentaho Business Analytics (BA) Server | Mar 3, 2025 | Mar 24, 2025 | 97.7% | — |
| CVE-2025-20281
Cisco Identity Services Engine Injection Vulnerability |
Cisco · Identity Services Engine | Jul 28, 2025 | Aug 18, 2025 | 97.6% | — |
| CVE-2025-34028
Commvault Command Center Path Traversal Vulnerability |
Commvault · Command Center | May 2, 2025 | May 23, 2025 | 97.6% | — |
Sources: CISA KEV and FIRST EPSS, refreshed daily. EPSS estimates the probability that a CVE is exploited in the next 30 days. CVEs named in the news but absent from KEV are listed under "In Asia-Pacific news" as well.