5 CVEs matched to Phished by name in NVD, none on CISA's Known Exploited list.
Back to the Phished profile · Alternatives to Phished · CVE RSS feed
1 CVE has an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hi…
Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an o…
There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with administ…
| Year | Critical | High | Medium | Low | Unscored | Total |
|---|---|---|---|---|---|---|
| 2026 | 0 | 1 | 1 | 0 | 0 | 2 |
| 2024 | 0 | 0 | 2 | 0 | 0 | 2 |
| 2019 | 0 | 0 | 1 | 0 | 0 | 1 |
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.
| CVE | EPSS | Percentile |
|---|---|---|
| CVE-2024-28239 | 0.6% | 47% |
| CVE-2018-20816 | 0.6% | 46% |
| CVE-2026-91164 | 0.4% | 35% |
| CVE-2024-25707 | 0.4% | 28% |
| CVE-2026-58269 | 0.2% | 12% |
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then call…
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_token into RequestAuthorization::U…
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validat…
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates wi…
There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with administrative access to supply a crafted string…
Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user t…
An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add das…