August 2020 · Band 2
Check available, not yet exploited
21 CVEs
Each square is a CVE with a public nuclei template and no known exploitation yet. The named ones are the most likely to be exploited.
- check available
- 21
Every one of the 21 is a mark on the map. Named now: 1 to 21, most at risk first.
- WordPress wpDiscuz <=7.0.4 - Remote Code Execution
- Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection
- Apache HTTP Server - Remote Code Execution
- Artica Web Proxy 4.30 - OS Command Injection
- Cisco Unified IP Conference Station 7937G - Denial-of-Service
- SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution
- Citrix XenMobile Server - Local File Inclusion
- Joomla! Component GMapFP 3.5 - Arbitrary File Upload
- WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection
- OpenSIS 7.3 - SQL Injection
- NexusDB <4.50.23 - Local File Inclusion
- WordPress Plugin File Manager (wp-file-manager) Backup Disclosure
- Mara CMS 7.5 - Cross-Site Scripting
- Spring Cloud Netflix - Server-Side Request Forgery
- WordPress Sell Media 2.4.1 - Cross-Site Scripting
- Canvas LMS v2020-07-29 - Blind Server-Side Request Forgery
- Extreme Management Center 8.4.1.24 - Cross-Site Scripting
- Jeedom <=4.0.38 - Cross-Site Scripting
- Prometheus Blackbox Exporter - Server-Side Request Forgery (SSRF)
- Nova Lite < 1.3.9 - Cross-Site Scripting
- GiveWP - Missing Authorization to Settings Update
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.