CVE tracker — Exploitation, versions & score history

Scroll across the table to compare exploitation and severity.

Matching CVEs and exploitation evidence. CVSS measures reported severity. Unknown scores are not zero.
CVE / vulnerability	Exploitation	CVSS
CVE-2020-29583 Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2020-29557 D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2020-28949 PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2020-2883 Oracle WebLogic Server Unspecified Vulnerability Oracle Corporation WebLogic Server Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2020-27950 Apple Multiple Products Memory Initialization Vulnerability Apple watchOS, Apple iOS and iPadOS, Apple macOS Versions & vendor guidance →	Known exploitedCISA KEV	5.5Medium
CVE-2020-27932 Apple Multiple Products Type Confusion Vulnerability Apple watchOS, Apple iOS and iPadOS, Apple macOS Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2020-27930 Apple Multiple Products Memory Corruption Vulnerability Apple watchOS, Apple iOS and iPadOS, Apple macOS Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2020-26919 Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2020-2555 Oracle Multiple Products Remote Code Execution Vulnerability Oracle Corporation WebCenter Portal, Oracle Corporation Utilities Framework Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2020-2551 Oracle Fusion Middleware Unspecified Vulnerability Oracle Corporation WebLogic Server Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2020-25506 D-Link DNS-320 Device Command Injection Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2020-25223 Sophos SG UTM Remote Code Execution Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2020-25213 WordPress File Manager Plugin Remote Code Execution Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	10Critical
CVE-2020-2509 Command Injection Vulnerability in QTS and QuTS hero QNAP Systems Inc. QTS, QNAP Systems Inc. QuTS hero Reported fix guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2020-25079 D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2020-25078 D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.5High
CVE-2020-2506 improper access control vulnerability in Helpdesk QNAP Systems Inc. Helpdesk Reported fix guidance →	Known exploitedCISA KEV	7.3High
CVE-2020-24557 Trend Micro Multiple Products Improper Access Control Vulnerability Trend Micro Trend Micro Apex One, Trend Micro Trend Micro Worry-Free Business Security Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2020-24363 TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication Palo Alto Networks PAN-OS Reported fix guidance →	Known exploitedCISA KEV	10Critical
CVE-2020-1956 Apache Kylin OS Command Injection Vulnerability Apache Kylin Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2020-1938 Apache Tomcat Improper Privilege Management Vulnerability Apache Apache Tomcat Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2020-17530 Apache Struts Remote Code Execution Vulnerability Apache Software Foundation Apache Struts Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2020-17519 Apache Flink directory traversal attack: reading remote files through the REST API Apache Software Foundation Apache Flink Versions & vendor guidance →	Known exploitedCISA KEV	9.1Critical

Data sources, freshness & score definitions

The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.

CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records

CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable

FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records

CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.