Skip to content

August 2018 · Band 1

Exploited in the wild

8 CVEs · 8 exploited

Each square is a CVE listed by CISA as exploited. The named ones are the most likely to be exploited again.

exploited in the wild
8

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

  1. Apache Struts2 S2-057 - Remote Code ExecutionCVE-2018-11776Apache Software Foundation · CVSS 8.1 · 100% likely

    Apache

  2. MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory trave…CVE-2018-14847MikroTik · CVSS 9.1 · 96% likely

    CWE-22Mikrotik

  3. NUUO NVRmini - Remote Command ExecutionCVE-2018-14933NUUO · CVSS 9.8 · 95% likely

    CWE-78NUUO

  4. In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. T…CVE-2018-15133Laravel · CVSS 8.1 · 77% likely

    CWE-502Laravel

  5. A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Wi…CVE-2018-8414Microsoft · CVSS 8.8 · 73% likely

    CWE-20Microsoft

  6. A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerabi…CVE-2018-8373Microsoft · CVSS 7.5 · 62% likely

    CWE-787Microsoft

  7. An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Pr…CVE-2018-8406Microsoft · CVSS 7.8 · 3.4% likely

    CWE-404Microsoft

  8. An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Pr…CVE-2018-8405Microsoft · CVSS 7.8 · 3.4% likely

    CWE-404Microsoft

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.