Skip to content
BackEsc
Sign in

CWE-912 · weakness in Supply Chain and Malicious Code

Hidden Functionality

98 CVEs · 3 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
3
check available
1
likely to be exploited
2

Every one of the 98 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Hardcoded Admin Credentials For Cisco Smart Licensing Utility APICVE-2024-20439Cisco · CVSS 9.8 · 97% likely

    Cisco

  2. A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.CVE-2021-25371Samsung Mobile · CVSS 6.1 · 0.8% likely

    Samsung

  3. The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than describe…CVE-2025-47729TeleMessage · CVSS 1.9 · 0.5% likely

    TeleMessage

  4. ProFTPd-1.3.3c - Backdoor Command ExecutionCVE-2010-20103ProFTPD Project · CVSS 9.3 · 15% likely

    ProFTPD Project

  5. Netcore / Netis Routers RCE via UDP Port 53413 BackdoorCVE-2025-34117Netcore Technology · CVSS 9.3 · 21% likely

    Netcore

  6. Backdoored Plugins & Themes from AccessPress ThemesCVE-2021-24867AccessPress Themes · 18% likely

    AccessPress Themes

  7. D-Link router - Hidden BackdoorCVE-2024-6045D-Link · CVSS 8.8 · 6.3% likely

    D-Link

  8. The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W…CVE-2020-16204N-Tron 702-W / 702M12-W · 5.5% likely
  9. myBB 1.6.4 Backdoor Arbitrary Command ExecutionCVE-2011-10018myBB Group · CVSS 10 · 3.0% likely

    MyBB

  10. Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx productsCVE-2020-12504Pepperl+Fuchs · CVSS 9.8 · 3.0% likely

    Pepperl+Fuchs

  11. Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShellCVE-2026-61515Puwell Technology Inc. · CVSS 9.8 · 2.4% likelycovered by CyberSIXT
  12. OpenClinic GACVE-2020-14487OpenClinic GA · CVSS 9.4 · 2.2% likely
  13. A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted network request can lead to arbitrar…CVE-2022-38452Netgear · CVSS 7.2 · 2.1% likely

    NETGEAR

  14. A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON object can lead to arb…CVE-2022-36429Netgear · CVSS 7.2 · 2.0% likely

    NETGEAR

  15. A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to code ex…CVE-2020-28593Cosori · CVSS 8.1 · 1.9% likely
  16. Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProvi…CVE-2025-32370Kentico · CVSS 7.2 · 1.6% likely

    Kentico

  17. ua-parser-js Crypto Mining backdoorCVE-2021-4229ua-parser-js · CVSS 5 · 1.5% likely
  18. vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to…CVE-2022-46996CVSS 9.8 · 1.4% likely
  19. Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).CVE-2025-27840Espressif · CVSS 6.8 · 1.4% likely

    Espressif

  20. MvcTools 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 was discovered to contain a code execution backdoor via the request package (requirements.txt). This vulnerability allows attacke…CVE-2023-24108Zetacomponents · CVSS 9.8 · 1.4% likely
  21. A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to root access. An attack…CVE-2024-39754Wavlink · CVSS 10 · 1.3% likely

    Wavlink

  22. Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the af…CVE-2023-40158CBC Co.,Ltd. · CVSS 8.8 · 1.3% likely
  23. A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects Solar-Log devices that use firmwa…CVE-2022-47767CVSS 9.8 · 1.3% likely
  24. mySCADA myPROCVE-2021-43987mySCADA · CVSS 9.8 · 1.3% likely

    mySCADA

  25. Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access…CVE-2022-46997CVSS 9.8 · 1.2% likely
  26. Hidden Functionality vulnerability in Contec Health CMS8000 Patient MonitorCVE-2025-0626Contec Health · CVSS 7.5 · 1.1% likely

    Contec Health

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in