Every vulnerability we have written a full remediation guide for
48 guides. Each one answers the same four questions for one CVE: what breaks, whether you are affected, how bad it really is, and exactly what to run to fix it. Affected-version tables are generated from the NVD record rather than written by hand, so no guide can send you to a release that is still vulnerable.
Of the vulnerabilities covered here, 38 are confirmed exploited in the wild by CISA and 38 are recorded as used in ransomware campaigns. This page is rebuilt automatically as guides are published.
See also: the KEV tracker for what CISA confirmed this month, and the exploit likelihood watchlist for what a model expects next.
| CVSS | CVE and guide | Product | Exploitation status |
|---|---|---|---|
| 10.0 | CVE-2026-20131 CVE-2026-20131 – Immediate Action Guide for Cisco FMC and SCC |
Secure Firewall Management Center (FMC) | Exploited CISA confirmed 2026-03-19 Ransomware |
| 10.0 | CVE-2025-34037 CVE-2025-34037 – Critical OS command injection in Linksys E‑Series routers |
— | Not confirmed exploited |
| 10.0 | CVE-2025-59528 CVE-2025-59528 – Immediate steps for Flowise remote code execution |
flowiseai | Not confirmed exploited |
| 9.9 | CVE-2025-49844 CVE-2025-49844 – Immediate actions for Redis administrators |
redis | Not confirmed exploited |
| 9.8 | CVE-2024-4577 CVE-2024-4577 – Critical PHP CGI Command Injection |
PHP | Exploited CISA confirmed 2024-06-12 Ransomware |
| 9.8 | CVE-2024-23897 CVE-2024-23897 – Jenkins CLI Path Traversal – What you need to know and fix now |
Jenkins Command Line Interface (CLI) | Exploited CISA confirmed 2024-08-19 Ransomware |
| 9.8 | CVE-2024-40766 CVE-2024-40766 – Immediate actions for SonicWall SonicOS firewalls |
SonicOS | Exploited CISA confirmed 2024-09-09 Ransomware |
| 9.8 | CVE-2024-6670 CVE-2024-6670 – WhatsUp Gold SQL injection – What you need to know and fix now |
WhatsUp Gold | Exploited CISA confirmed 2024-09-16 Ransomware |
| 9.8 | CVE-2024-9680 CVE-2024-9680 – Critical Use‑After‑Free in Firefox and Thunderbird |
Firefox | Exploited CISA confirmed 2024-10-15 Ransomware |
| 9.8 | CVE-2024-40711 CVE-2024-40711 – Immediate actions for Veeam Backup & Replication |
Backup & Replication | Exploited CISA confirmed 2024-10-17 Ransomware |
| 9.8 | CVE-2024-0012 CVE-2024-0012 – PAN‑OS authentication bypass – immediate actions |
PAN-OS | Exploited CISA confirmed 2024-11-18 Ransomware |
| 9.8 | CVE-2024-55591 CVE-2024-55591 – Immediate Action Guide for FortiOS and FortiProxy |
FortiOS and FortiProxy | Exploited CISA confirmed 2025-01-14 Ransomware |
| 9.8 | CVE-2025-23006 CVE-2025-23006: SonicWall SMA1000 Remote Code Execution – Immediate Action Required |
SMA1000 Appliances | Exploited CISA confirmed 2025-01-24 Ransomware |
| 9.8 | CVE-2024-53704 CVE-2024-53704 – SonicWall SSLVPN authentication bypass – what to do |
SonicOS | Exploited CISA confirmed 2025-02-18 Ransomware |
| 9.8 | CVE-2025-53770 CVE-2025-53770 SharePoint Server – Immediate Action Guide |
SharePoint | Exploited CISA confirmed 2025-07-20 Ransomware |
| 9.8 | CVE-2025-61882 CVE-2025-61882 – Immediate Action Guide for Oracle E‑Business Suite |
E-Business Suite | Exploited CISA confirmed 2025-10-06 Ransomware |
| 9.8 | CVE-2025-26399 CVE-2025-26399 – Immediate actions for SolarWinds Web Help Desk |
Web Help Desk | Exploited CISA confirmed 2026-03-09 Ransomware |
| 9.8 | CVE-2026-35273 CVE-2026-35273 – Critical PeopleSoft PeopleTools Authentication Bypass |
PeopleSoft Enterprise PeopleTools | Exploited CISA confirmed 2026-06-12 Ransomware |
| 9.8 | CVE-2025-1974 CVE-2025-1974 – Critical Kubernetes Ingress‑NGINX Remote Code Execution |
— | Not confirmed exploited |
| 9.8 | CVE-2026-61511 CVE-2026-61511 – Immediate guide for vBulletin admins |
— | Not confirmed exploited |
| 9.5 | CVE-2026-6875 CVE-2026-6875 – ServiceNow AI Platform Remote Code Execution – What You Need to Do |
— | Not confirmed exploited |
| 9.4 | CVE-2026-26980 CVE-2026-26980 – Immediate Action Guide for Ghost Administrators |
ghost | Not confirmed exploited |
| 9.1 | CVE-2025-29927 CVE-2025-29927 – Critical Next.js Authorization Bypass – Immediate Action Required |
vercel | Not confirmed exploited |
| 9.0 | CVE-2025-0282 CVE-2025-0282 – Critical Remote Code Execution in Ivanti Connect Secure, Policy Secure and |
Connect Secure, Policy Secure, and ZTA Gatew | Exploited CISA confirmed 2025-01-08 Ransomware |
| 9.0 | CVE-2025-22457 CVE-2025-22457 – Critical Remote Code Execution in Ivanti Connect Secure, Policy Secure an |
Connect Secure, Policy Secure, and ZTA Gatew | Exploited CISA confirmed 2025-04-04 Ransomware |
| 8.8 | CVE-2024-49039 CVE-2024-49039 – Windows Task Scheduler privilege escalation fix guide |
Windows | Exploited CISA confirmed 2024-11-12 Ransomware |
| 8.8 | CVE-2025-49704 CVE-2025-49704 – Immediate actions for Microsoft SharePoint code‑injection risk |
SharePoint | Exploited CISA confirmed 2025-07-22 Ransomware |
| 8.8 | CVE-2020-0618 CVE-2020-0618 – SQL Server Reporting Services deserialization risk and remediation |
SQL Server | Exploited CISA confirmed 2024-09-18 Ransomware |
| 8.8 | CVE-2023-21529 CVE-2023-21529 – Immediate actions for Microsoft Exchange Server |
Exchange Server | Exploited CISA confirmed 2026-04-13 Ransomware |
| 8.8 | CVE-2026-45659 CVE-2026-45659 – SharePoint Server deserialization flaw – what it means and how to fix it |
SharePoint Server | Exploited CISA confirmed 2026-07-01 Ransomware |
| 8.8 | CVE-2026-43284 CVE-2026-43284 – Linux kernel ESP‑in‑UDP in‑place decryption flaw |
linux | Not confirmed exploited |
| 8.2 | CVE-2025-22225 CVE-2025-22225 – VMware ESXi arbitrary write vulnerability – what you need to know at 2 am |
ESXi | Exploited CISA confirmed 2025-03-04 Ransomware |
| 8.1 | CVE-2025-24472 CVE-2025-24472 – FortiOS/FortiProxy authentication bypass explained |
FortiOS and FortiProxy | Exploited CISA confirmed 2025-03-18 Ransomware |
| 8.1 | CVE-2025-1094 CVE-2025-1094 – PostgreSQL libpq quoting injection – quick guide |
— | Not confirmed exploited |
| 7.8 | CVE-2024-26169 CVE-2024-26169 – Windows Error Reporting Service Privilege Escalation |
Windows | Exploited CISA confirmed 2024-06-13 Ransomware |
| 7.8 | CVE-2017-1000253 CVE-2017-1000253 – Linux kernel privilege‑escalation vulnerability explained |
Kernel | Exploited CISA confirmed 2024-09-09 Ransomware |
| 7.8 | CVE-2018-8639 CVE-2018-8639 – Local Privilege Escalation in Windows Win32k |
Windows | Exploited CISA confirmed 2025-03-03 Ransomware |
| 7.8 | CVE-2025-29824 CVE-2025-29824 – Windows CLFS driver privilege‑escalation – what you need to know |
Windows | Exploited CISA confirmed 2025-04-08 Ransomware |
| 7.8 | CVE-2021-43226 CVE-2021-43226 – Windows CLFS Driver Privilege Escalation – What You Need to Do |
Windows | Exploited CISA confirmed 2025-10-06 Ransomware |
| 7.5 | CVE-2025-5777 CVE-2025-5777 – What it is, risk, and how to remediate Citrix NetScaler ADC/Gateway |
NetScaler ADC and Gateway | Exploited CISA confirmed 2025-07-10 Ransomware |
| 7.5 | CVE-2025-61884 CVE-2025-61884 – Immediate steps for Oracle E‑Business Suite Configurator SSRF |
E-Business Suite | Exploited CISA confirmed 2025-10-20 Ransomware |
| 7.3 | CVE-2024-27199 CVE-2024-27199 – JetBrains TeamCity relative path traversal – quick fix guide |
TeamCity | Exploited CISA confirmed 2026-04-20 Ransomware |
| 7.2 | CVE-2024-38094 CVE-2024-38094 – Immediate actions for Microsoft SharePoint |
SharePoint | Exploited CISA confirmed 2024-10-22 Ransomware |
| 7.2 | CVE-2024-9474 CVE-2024-9474 – Immediate Action Required for PAN‑OS Web UI Command Injection |
PAN-OS | Exploited CISA confirmed 2024-11-18 Ransomware |
| 7.0 | CVE-2024-30088 CVE-2024-30088 – Windows Kernel TOCTOU Privilege Escalation – What You Need to Know |
Windows | Exploited CISA confirmed 2024-10-15 Ransomware |
| 7.0 | CVE-2025-26633 CVE-2025-26633 – Immediate steps for Windows MMC vulnerability |
Windows | Exploited CISA confirmed 2025-03-11 Ransomware |
| 6.8 | CVE-2024-37085 CVE-2024-37085 – Immediate Action Guide for VMware ESXi AD Authentication Bypass |
ESXi | Exploited CISA confirmed 2024-07-30 Ransomware |
| 6.5 | CVE-2025-49706 CVE-2025-49706 – SharePoint Server improper authentication – what you need to know and fix |
SharePoint | Exploited CISA confirmed 2025-07-22 Ransomware |
