Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-9428 | 8.8 high | 27.0% | zohocorp, manageengine_analytics_plus | Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api. | 8 Oct |
| CVE-2026-6516 | 10.0 critical | 5.0% | no CPE yet | Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API. | Sat 24 Oct |
| CVE-2025-10020 | 8.8 high | 5.0% | zohocorp, manageengine_admanager_plus | Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component. | 8 Oct |
| CVE-2026-12571 | 9.8 critical | 3.0% | no CPE yet | An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover. | 23 Oct |
| CVE-2025-8324 | 9.8 critical | 2.0% | no CPE yet | Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration. | 18 Oct |
| CVE-2026-3324 | 8.2 high | 1.0% | zohocorp, manageengine_log360 | Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration. | Mon 26 Oct |
| CVE-2026-5785 | 8.1 high | 1.0% | no CPE yet | Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module. | Mon 26 Oct |
| CVE-2026-3183 | 7.1 high | 1.0% | no CPE yet | Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass. | Sat 24 Oct |
| CVE-2025-6239 | 6.5 medium | 1.0% | zohocorp, manageengine_applications_manager | Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor. | 8 Oct |
| CVE-2025-5342 | 6.5 medium | 1.0% | zohocorp, manageengine_exchange_reporter_plus | Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module. | 8 Oct |
| CVE-2025-7633 | 6.1 medium | 1.0% | zohocorp, manageengine_exchange_reporter_plus | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report. | 18 Oct |
| CVE-2025-7429 | 5.4 medium | 1.0% | zohocorp, manageengine_exchange_reporter_plus | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report. | 18 Oct |
| CVE-2025-7430 | 5.4 medium | 1.0% | zohocorp, manageengine_exchange_reporter_plus | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report. | 18 Oct |
| CVE-2025-7632 | 5.4 medium | 1.0% | zohocorp, manageengine_exchange_reporter_plus | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report. | 18 Oct |
| CVE-2026-3182 | 4.3 medium | 1.0% | no CPE yet | Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability. | Sat 24 Oct |
| CVE-2025-11248 | 4.3 medium | 1.0% | zohocorp, manageengine_endpoint_central | ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token. | 8 Oct |
| CVE-2026-119680 | 8.5 high | — | manageengine, sharepoint manager plus | A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508. | 13 h ago |
| CVE-2026-119682 | 7.9 high | — | manageengine, sharepoint manager plus | An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506. | 13 h ago |
| CVE-2025-5494 | 7.8 high | 0.00% | zohocorp, manageengine_endpoint_central | ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup. This issue affects Endpoint Central: through 11.4.2500.25, through 11.4.2508.13. | 11 Oct |
| CVE-2025-9227 | 6.5 medium | 0.00% | no CPE yet | Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor. | 18 Oct |
| CVE-2025-5343 | 5.4 medium | 0.00% | zohocorp, manageengine_exchange_reporter_plus | Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option. | 8 Oct |
| CVE-2025-5347 | 5.4 medium | 0.00% | zohocorp, manageengine_exchange_reporter_plus | Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module. | 8 Oct |
| CVE-2025-7473 | 5.3 medium | 0.00% | zohocorp, manageengine_endpoint_central | Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection. | 8 Oct |
| CVE-2026-14308 | 4.9 medium | 0.00% | no CPE yet | Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService. | 15 Oct |
| CVE-2025-5496 | 3.3 low | 0.00% | zohocorp, manageengine_endpoint_central | ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerability in the agent setup component. | 8 Oct |
25 of 25
Download these 25 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.