Interactive tool
Patch Priority Triage
Filter curated security advisories by environment, compare transparent patch-priority signals, and verify each finding against primary sources.
54 curated advisories. The verdict is a triage aid, not a substitute for your own analysis — every row links to NVD / CISA KEV. Verify before you act.
54 of 54 advisories
Linux kernel algif_aead AEAD use-after-free LPE
Local privilege escalation in the kernel crypto AEAD interface. Added to CISA KEV 2026-05-01 after confirmed exploitation; working exploit circulates publicly.
MetInfo CMS unauthenticated PHP code injection (RCE)
Unauthenticated RCE under active exploitation from 2026-04-25 against ~2,000 internet-exposed instances; public PoC by Egidio Romano, campaign flagged by VulnCheck.
Palo Alto PAN-OS GlobalProtect command injection (unauth RCE)
Widely-known unauthenticated RCE in the GlobalProtect feature, exploited in the wild and added to CISA KEV in 2024. Verify exact affected/fixed builds on the Palo Alto Security Advisories page.
Citrix NetScaler ADC/Gateway sensitive-information disclosure (CitrixBleed)
CitrixBleed: session-token leak enabling auth bypass; mass-exploited including by ransomware affiliates, in CISA KEV. Patching alone is insufficient — kill existing sessions. Verify builds on the Citrix advisory.
Ivanti Connect Secure stack overflow (unauth RCE)
Unauthenticated RCE in Ivanti Connect Secure, exploited as a zero-day and added to CISA KEV in early 2025. Confirm affected/fixed versions and run ICT per the Ivanti advisory.
Ivanti Connect Secure command injection (chained with auth bypass)
Command-injection half of the 2024 Ivanti zero-day chain, mass-exploited and KEV-listed. Verify exact versions and mitigation steps on the Ivanti advisory.
Cisco IOS XE Web UI privilege escalation (unauth admin)
Mass-exploited IOS XE Web UI flaw allowing creation of a privileged account; tens of thousands of devices implanted in 2023. In CISA KEV. Verify fixed train on the Cisco advisory.
Jenkins CLI arbitrary file read (path to RCE)
Arbitrary file read via the Jenkins CLI, escalatable to RCE and used in ransomware intrusions; KEV-listed. CI/CD relevance for supply-chain exposure. Verify versions on the Jenkins advisory.
Apache Log4j2 JNDI lookup RCE (Log4Shell)
Log4Shell: trivially exploitable, internet-wide RCE via attacker-controlled log strings; mass-exploited including by ransomware. Canonical KEV entry — still found in unpatched estates.
F5 BIG-IP iControl REST authentication bypass (RCE)
Auth-bypass to unauthenticated RCE on BIG-IP management; exploited within days of disclosure, KEV-listed. Verify affected/fixed versions on the F5 advisory.
Microsoft Outlook elevation of privilege (NTLM leak, zero-click)
Zero-click NTLM-credential leak via a crafted calendar reminder, exploited in the wild (KEV). High AD relevance via relay. Verify patched build on MSRC.
Windows Print Spooler RCE (PrintNightmare)
PrintNightmare: Print Spooler RCE/LPE usable for domain compromise, exploited including by ransomware; KEV-listed. Especially severe on domain controllers. Verify patch state on MSRC.
Netlogon elevation of privilege (Zerologon)
Zerologon: instant domain-controller takeover via Netlogon crypto flaw; mass-exploited including by ransomware, KEV-listed. Two-phase Microsoft remediation. Verify enforcement state.
Microsoft Exchange Server SSRF (ProxyLogon, pre-auth chain)
ProxyLogon: pre-auth SSRF starting the Exchange RCE chain, mass-exploited globally including by ransomware; KEV-listed. Patch and assume compromise if exposed and unpatched.
Progress MOVEit Transfer SQL injection (mass data theft)
SQL injection in MOVEit Transfer driving the Cl0p mass-exfiltration campaign affecting thousands of organizations; KEV-listed. Verify versions on the Progress advisory.
Barracuda Email Security Gateway remote command injection
Command injection in Barracuda ESG, exploited as a zero-day for months by a state actor; KEV-listed. Notably, the vendor recommended appliance replacement. Verify guidance on Barracuda's advisory.
XZ Utils (liblzma) backdoor in upstream release tarballs
Deliberately planted supply-chain backdoor in xz release tarballs targeting sshd; caught before wide deployment. KEV-listed as a supply-chain compromise. Verify your distro's advisory.
OpenSSH sshd signal-handler race RCE (regreSSHion)
Signal-handler race in sshd enabling unauthenticated RCE on glibc Linux; exploitation difficult but demonstrated, internet-exposed by definition. Verify the affected range on the OpenSSH release notes.
OpenSSL X.509 punycode buffer overflow
Stack overflow in punycode decoding during X.509 verification. Downgraded from the initial 'critical' pre-announcement to high; low real-world exploitation. Useful triage contrast vs hype. Verify on the OpenSSL advisory.
ConnectWise ScreenConnect authentication bypass
Trivial auth-bypass on ScreenConnect, mass-exploited within days including by ransomware affiliates; KEV-listed. Verify fixed version on the ConnectWise advisory.
Atlassian Confluence Data Center broken access control (privilege escalation)
Exploited-in-the-wild privilege escalation creating admin accounts on internet-facing Confluence; KEV-listed. Verify affected/fixed versions on the Atlassian advisory.
Ivanti Connect Secure stack-based buffer overflow (LPE, chained)
Local privilege escalation disclosed alongside the actively-exploited CVE-2025-0282; lower urgency on its own but patch together. Verify versions on the Ivanti advisory.
Fortinet FortiOS SSL VPN out-of-bounds write (unauth RCE)
Unauthenticated RCE in the FortiOS SSL VPN, exploited in the wild and KEV-listed. Verify exact affected/fixed builds on the Fortinet PSIRT advisory.
Fortinet FortiOS SSL VPN heap overflow (XORtigate, pre-auth RCE)
Pre-auth heap overflow in FortiOS SSL VPN (XORtigate), exploited in the wild, KEV-listed. Verify affected/fixed builds on the Fortinet PSIRT advisory.
TunnelVision — DHCP option 121 routes traffic outside the VPN tunnel
TunnelVision: a hostile DHCP server can route a victim's traffic outside the VPN tunnel without breaking the connection. Technique-level issue; useful triage example of 'monitor / compensate' vs patch. Verify scope per the disclosure.
Apache Commons Text interpolation RCE (Text4Shell)
Variable-interpolation RCE in Commons Text (Text4Shell). High severity but exploitation requires the app to pass untrusted input to interpolation — far less ubiquitous than Log4Shell. Triage-context entry. Verify on the Apache advisory.
PHP-CGI argument injection on Windows (RCE)
Argument-injection bypass of the old CVE-2012-1823 fix, giving RCE on Windows PHP-CGI; exploited including by ransomware, KEV-listed. Verify affected/fixed versions on the PHP advisory.
7-Zip Mark-of-the-Web bypass (phishing-delivered RCE chain)
Mark-of-the-Web is not propagated to files extracted from nested archives, enabling SmartScreen bypass; reported exploited in phishing campaigns. Verify on NVD / vendor.
Ivanti Connect Secure web component authentication bypass
Auth-bypass half of the 2024 Ivanti zero-day chain, mass-exploited, KEV-listed. Verify versions and mitigation steps on the Ivanti advisory.
VMware ESXi Active Directory integration auth bypass
Ransomware groups abused an ESXi AD-integration auth bypass to gain full hypervisor control; KEV-listed. High AD + virtualization relevance. Verify builds on the VMware advisory.
Fortinet FortiClientEMS SQL injection (unauth RCE)
Unauthenticated SQL injection leading to RCE in FortiClientEMS, exploited in the wild, KEV-listed. Verify affected/fixed versions on the Fortinet PSIRT advisory.
Palo Alto PAN-OS management web interface privilege escalation
Privilege escalation chained with an auth bypass against exposed PAN-OS management interfaces; exploited in the wild, KEV-listed. Verify versions on the Palo Alto advisory.
Fortinet FortiManager missing authentication (FortiJump)
Missing authentication in the FortiManager fgfm protocol (FortiJump), exploited in the wild against managed-device fleets, KEV-listed. Verify versions on the Fortinet PSIRT advisory.
Apache ActiveMQ OpenWire deserialization RCE
Unauthenticated deserialization RCE in ActiveMQ OpenWire, mass-exploited including by ransomware (HelloKitty), KEV-listed. Verify versions on the Apache advisory.
Microsoft Support Diagnostic Tool RCE (Follina)
Follina: document-triggered RCE via the ms-msdt URI scheme, exploited in the wild before a patch existed; KEV-listed. Verify patch state on MSRC.
Cisco NX-OS CLI command injection (local, signed by Velvet Ant abuse)
Local command injection in NX-OS abused by an espionage actor for stealthy persistence on Nexus switches; KEV-listed despite needing admin creds. Verify versions on the Cisco advisory.
Fortra GoAnywhere MFT authentication bypass (admin creation)
Auth-bypass allowing creation of an admin user on GoAnywhere MFT; exploited and used by ransomware, KEV-listed. Verify fixed version on the Fortra advisory.
Windows OLE remote code execution (email preview vector)
Use-after-free in Windows OLE reachable via a malicious RTF in email preview; rated critical, no confirmed exploitation at disclosure. Mail/Windows triage example. Verify build on MSRC.
Citrix NetScaler ADC/Gateway unauthenticated RCE
Unauthenticated RCE on internet-facing NetScaler, exploited as a zero-day with webshell deployment; KEV-listed. Verify builds on the Citrix advisory.
Check Point Security Gateway information disclosure (VPN)
Information-disclosure flaw on internet-facing Check Point gateways enabling credential theft, exploited in the wild, KEV-listed. Verify affected products on the Check Point advisory.
Spring Framework data binding RCE (Spring4Shell)
Spring4Shell: data-binding RCE under specific (common) deployment conditions; exploited in the wild, KEV-listed. Exploitability is condition-dependent — good triage nuance. Verify on the Spring advisory.
SonicWall SMA1000 deserialization (unauth RCE)
Pre-auth deserialization RCE on SonicWall SMA1000, reported exploited in the wild, KEV-listed. Verify affected/fixed versions on the SonicWall advisory.
Fortinet FortiOS authentication bypass via Node.js websocket
Auth-bypass to super-admin on FortiOS via the Node.js websocket module, exploited in the wild against exposed management interfaces, KEV-listed. Verify builds on the Fortinet PSIRT advisory.
Microsoft Outlook RCE (Moniker Link / #monikerlink)
Moniker Link: a crafted email bypasses Protected View and can leak NTLM creds / enable RCE; high severity, no confirmed in-the-wild exploitation at disclosure. Mail triage example. Verify build on MSRC.
Apache Struts path traversal -> file upload RCE
Path-traversal in file-upload params enabling RCE on Struts apps; exploitation reported shortly after disclosure. Verify affected/fixed versions on the Apache advisory.
Windows TCP/IP IPv6 remote code execution (zero-click)
Zero-click RCE via crafted IPv6 packets against the Windows TCP/IP stack; rated critical and wormable, no confirmed exploitation at disclosure. Verify patch state on MSRC.
HTTP/2 Rapid Reset denial of service
HTTP/2 Rapid Reset: record-breaking DDoS technique abusing stream cancellation, exploited in the wild against many providers; KEV-listed. Per-implementation fixes. Verify your stack's advisory.
Apache Tomcat partial-PUT deserialization RCE
Deserialization RCE via partial PUT under specific Tomcat configurations; public PoC and reported exploitation shortly after disclosure. Condition-dependent — verify config and versions on the Apache advisory.
Windows LDAP remote code execution (LDAPNightmare)
Integer-overflow RCE in Windows LDAP reachable against domain controllers; public PoC (DoS demonstrated), no confirmed in-the-wild RCE at disclosure. High AD relevance. Verify build on MSRC.
Ivanti EPM agent portal deserialization RCE
Unauthenticated deserialization RCE in Ivanti EPM; public PoC, no confirmed exploitation at disclosure but high-value given Ivanti's exploitation history. Verify versions on the Ivanti advisory.
Microsoft SharePoint Server privilege escalation (spoofed JWT)
Auth-bypass via spoofed JWT on SharePoint, chained for RCE in public exploit chains; exploited in the wild, KEV-listed. Verify builds on MSRC.
Atlassian Confluence OGNL injection (unauth RCE)
Unauthenticated OGNL-injection RCE in Confluence, exploited as a zero-day including by ransomware/cryptominers; KEV-listed. Verify versions on the Atlassian advisory.
runc container escape via leaked file descriptor
Leaked-fd container escape (Leaky Vessels) affecting most container runtimes; public PoC, broad blast radius for container/K8s estates. Verify runtime version against the runc advisory.
Kubernetes ingress-nginx admission-controller RCE (IngressNightmare)
Unauthenticated RCE via the ingress-nginx admission controller (IngressNightmare), affecting a large share of clusters; public PoC, no confirmed mass exploitation at disclosure. Verify versions on the project advisory.
Scoring model & sourcing
Advisory corpus curated from primary vendor, CISA and NVD records plus techsentinel.news coverage. KEV status, KEV add-date and ransomware association are regenerated from the CISA Known Exploited Vulnerabilities feed (catalogVersion 2026.09.14), and every CVSS base score is taken from the NVD record for that CVE, with the vector and the scoring source carried on each entry. Only entries with a CVE identifier are scored; incident and campaign reports without one are listed separately under "incidents" and carry no KEV, CVSS, exploitation or ransomware flags. Proof-of-concept availability and any exploitation not reflected in KEV are point-in-time judgements from the linked source. Verify against the vendor advisory, NVD (https://nvd.nist.gov) and the CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) before acting.
Transparent score: CISA KEV +50 · actively exploited
+35 · public PoC +15 · ransomware-associated +20 · internet-exposed
advisory +12 · matches a system you marked internet-exposed +13 ·
CVSS contributes its value as points. Verdicts:
score ≥ 70 → act now; ≥ 40 → schedule; ≥ 20 →
monitor; otherwise ignore (for now). Every card's
"why this verdict" lists the exact contributing factors. This is a
prioritisation aid — confirm applicability, affected versions and the
current fixed release against the vendor advisory and NVD. Corpus as
of 2026-09-16. The page is static; the
?env= URL state is structured so a live advisory feed
worker could be layered on later.