https://exploit-radar.com/en/flux/categories/frameworks.xml Exploit Radar: Frameworks and libraries The latest additions to CISA’s catalog of exploited vulnerabilities in the “Frameworks and libraries” category (indicative classification). 2026-09-02T00:00:00Z Exploit Radar https://exploit-radar.com/en/cve/CVE-2026-48710/ CVE-2026-48710 — Starlette 2026-09-02T00:00:00Z Apply the patches or mitigations from Starlette; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on September 2, 2026. https://exploit-radar.com/en/cve/CVE-2021-23758/ CVE-2021-23758 — Ajax.NET Professional 2026-08-26T00:00:00Z Apply the patches or mitigations from Ajax.NET Professional; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on August 26, 2026. https://exploit-radar.com/en/cve/CVE-2026-45321/ CVE-2026-45321 — TanStack 2026-05-27T00:00:00Z Apply the patches or mitigations from TanStack; if none are available, stop using the product. For cloud services, follow the guidance from TanStack. CISA deadline: 14 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on May 27, 2026. https://exploit-radar.com/en/cve/CVE-2025-54068/ CVE-2025-54068 — Laravel Livewire 2026-03-20T00:00:00Z Apply the patches or mitigations from Laravel; if none are available, stop using the product. For cloud services, follow the guidance from Laravel. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on March 20, 2026. https://exploit-radar.com/en/cve/CVE-2025-55182/ CVE-2025-55182 — React (Meta) React Server Components 2025-12-05T00:00:00Z Apply the patches or mitigations from React (Meta); if none are available, stop using the product. For cloud services, follow the guidance from React (Meta). CISA deadline: 7 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on December 5, 2025. https://exploit-radar.com/en/cve/CVE-2016-10033/ CVE-2016-10033 — PHPMailer 2025-07-07T00:00:00Z Apply the patches or mitigations from PHPMailer; if none are available, stop using the product. For cloud services, follow the guidance from PHPMailer. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on July 7, 2025. https://exploit-radar.com/en/cve/CVE-2019-5418/ CVE-2019-5418 — Ruby on Rails 2025-07-07T00:00:00Z Apply the patches or mitigations from Ruby on Rails; if none are available, stop using the product. For cloud services, follow the guidance from Ruby on Rails. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on July 7, 2025. https://exploit-radar.com/en/cve/CVE-2025-32433/ CVE-2025-32433 — Erlang/OTP 2025-06-09T00:00:00Z Apply the patches or mitigations from Erlang; if none are available, stop using the product. For cloud services, follow the guidance from Erlang. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on June 9, 2025. https://exploit-radar.com/en/cve/CVE-2025-27363/ CVE-2025-27363 — FreeType 2025-05-06T00:00:00Z Apply the patches or mitigations from FreeType; if none are available, stop using the product. For cloud services, follow the guidance from FreeType. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 6, 2025. https://exploit-radar.com/en/cve/CVE-2024-58136/ CVE-2024-58136 — Yii Framework Yii 2025-05-02T00:00:00Z Apply the patches or mitigations from Yii Framework; if none are available, stop using the product. For cloud services, follow the guidance from Yii Framework. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 2, 2025. https://exploit-radar.com/en/cve/CVE-2024-29059/ CVE-2024-29059 — Microsoft .NET / Visual Studio 2025-02-04T00:00:00Z Apply the patches or mitigations from Microsoft; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on February 4, 2025. https://exploit-radar.com/en/cve/CVE-2020-11023/ CVE-2020-11023 — jQuery 2025-01-23T00:00:00Z Apply the patches or mitigations from jQuery; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on January 23, 2025. https://exploit-radar.com/en/cve/CVE-2022-21445/ CVE-2022-21445 — Oracle ADF Faces 2024-09-18T00:00:00Z Apply the patches or mitigations from Oracle; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on September 18, 2024. https://exploit-radar.com/en/cve/CVE-2016-3714/ CVE-2016-3714 — ImageMagick 2024-09-09T00:00:00Z Apply the patches or mitigations from ImageMagick; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on September 9, 2024. https://exploit-radar.com/en/cve/CVE-2024-4577/ CVE-2024-4577 — PHP 2024-06-12T00:00:00Z Apply the patches or mitigations from PHP; if none are available, stop using the product. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on June 12, 2024. https://exploit-radar.com/en/cve/CVE-2018-15133/ CVE-2018-15133 — Laravel Framework 2024-01-16T00:00:00Z Apply the patches or mitigations from Laravel; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on January 16, 2024. https://exploit-radar.com/en/cve/CVE-2023-7101/ CVE-2023-7101 — Spreadsheet::ParseExcel 2024-01-02T00:00:00Z Apply the patches or mitigations from Spreadsheet::ParseExcel; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on January 2, 2024. https://exploit-radar.com/en/cve/CVE-2023-29552/ CVE-2023-29552 — Protocoles (IETF) Service Location Protocol (SLP) 2023-11-08T00:00:00Z Specific CISA instructions: see the vulnerability page. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on November 8, 2023. https://exploit-radar.com/en/cve/CVE-2018-14667/ CVE-2018-14667 — Red Hat JBoss RichFaces 2023-09-28T00:00:00Z Apply the patches or mitigations from Red Hat; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on September 28, 2023. https://exploit-radar.com/en/cve/CVE-2021-3129/ CVE-2021-3129 — Laravel Ignition 2023-09-18T00:00:00Z Apply the patches or mitigations from Laravel; if none are available, stop using the product. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on September 18, 2023. https://exploit-radar.com/en/cve/CVE-2023-38180/ CVE-2023-38180 — Microsoft .NET / Visual Studio 2023-08-09T00:00:00Z Apply the patches or mitigations from Microsoft; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on August 9, 2023. https://exploit-radar.com/en/cve/CVE-2016-3427/ CVE-2016-3427 — Oracle Java SE (JRE / JDK) 2023-05-12T00:00:00Z Apply the security update from Oracle. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 12, 2023. https://exploit-radar.com/en/cve/CVE-2021-45046/ CVE-2021-45046 — Apache Log4j 2023-05-01T00:00:00Z Apply the security update from Apache. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on May 1, 2023. https://exploit-radar.com/en/cve/CVE-2021-39144/ CVE-2021-39144 — XStream 2023-03-10T00:00:00Z Apply the security update from XStream. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 10, 2023. https://exploit-radar.com/en/cve/CVE-2022-36537/ CVE-2022-36537 — ZK Framework AuUploader 2023-02-27T00:00:00Z Apply the security update from ZK Framework. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on February 27, 2023. https://exploit-radar.com/en/cve/CVE-2017-11357/ CVE-2017-11357 — Progress Telerik UI for ASP.NET AJAX 2023-01-26T00:00:00Z Apply the security update from Progress. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on January 26, 2023. https://exploit-radar.com/en/cve/CVE-2022-22963/ CVE-2022-22963 — Spring Cloud Function 2022-08-25T00:00:00Z Apply the security update from Spring. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on August 25, 2022. https://exploit-radar.com/en/cve/CVE-2020-28949/ CVE-2020-28949 — PEAR Archive_Tar 2022-08-25T00:00:00Z Apply the security update from PEAR. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on August 25, 2022. https://exploit-radar.com/en/cve/CVE-2020-36193/ CVE-2020-36193 — PEAR Archive_Tar 2022-08-25T00:00:00Z Apply the security update from PEAR. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on August 25, 2022. https://exploit-radar.com/en/cve/CVE-2010-0840/ CVE-2010-0840 — Oracle Java SE (JRE / JDK) 2022-05-25T00:00:00Z Apply the security update from Oracle. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 25, 2022. https://exploit-radar.com/en/cve/CVE-2013-0422/ CVE-2013-0422 — Oracle Java SE (JRE / JDK) 2022-05-25T00:00:00Z Apply the security update from Oracle. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on May 25, 2022. https://exploit-radar.com/en/cve/CVE-2013-0431/ CVE-2013-0431 — Oracle Java SE (JRE / JDK) 2022-05-25T00:00:00Z Apply the security update from Oracle. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on May 25, 2022. https://exploit-radar.com/en/cve/CVE-2013-2423/ CVE-2013-2423 — Oracle Java SE (JRE / JDK) 2022-05-25T00:00:00Z Apply the security update from Oracle. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 25, 2022. https://exploit-radar.com/en/cve/CVE-2017-8291/ CVE-2017-8291 — Artifex Ghostscript 2022-05-24T00:00:00Z Apply the security update from Artifex. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 24, 2022. https://exploit-radar.com/en/cve/CVE-2022-22947/ CVE-2022-22947 — Spring Cloud Gateway 2022-05-16T00:00:00Z Apply the security update from Spring. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 16, 2022. https://exploit-radar.com/en/cve/CVE-2014-0160/ CVE-2014-0160 — OpenSSL 2022-05-04T00:00:00Z Apply the security update from OpenSSL. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 4, 2022. https://exploit-radar.com/en/cve/CVE-2017-11317/ CVE-2017-11317 — Progress Telerik UI for ASP.NET AJAX 2022-04-11T00:00:00Z Apply the security update from Progress. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on April 11, 2022. https://exploit-radar.com/en/cve/CVE-2022-22965/ CVE-2022-22965 — Spring Framework 2022-04-04T00:00:00Z Apply the security update from Spring. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on April 4, 2022. https://exploit-radar.com/en/cve/CVE-2012-5076/ CVE-2012-5076 — Oracle Java SE (JRE / JDK) 2022-03-28T00:00:00Z Apply the security update from Oracle. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 28, 2022. https://exploit-radar.com/en/cve/CVE-2013-2465/ CVE-2013-2465 — Oracle Java SE (JRE / JDK) 2022-03-28T00:00:00Z Apply the security update from Oracle. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on March 28, 2022. https://exploit-radar.com/en/cve/CVE-2012-1823/ CVE-2012-1823 — PHP 2022-03-25T00:00:00Z Apply the security update from PHP. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2013-2251/ CVE-2013-2251 — Apache Struts 2022-03-25T00:00:00Z Apply the security update from Apache. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2018-1273/ CVE-2018-1273 — Spring Data 2022-03-25T00:00:00Z Apply the security update from Spring. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2019-11043/ CVE-2019-11043 — PHP 2022-03-25T00:00:00Z Apply the security update from PHP. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2014-0130/ CVE-2014-0130 — Ruby on Rails 2022-03-25T00:00:00Z Apply the security update from Ruby on Rails. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2016-0752/ CVE-2016-0752 — Ruby on Rails 2022-03-25T00:00:00Z Apply the security update from Ruby on Rails. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2020-5410/ CVE-2020-5410 — Spring Cloud Config 2022-03-25T00:00:00Z Apply the security update from Spring. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2009-3960/ CVE-2009-3960 — Adobe BlazeDS 2022-03-07T00:00:00Z Apply the security update from Adobe. CISA deadline: 184 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on March 7, 2022. https://exploit-radar.com/en/cve/CVE-2011-3544/ CVE-2011-3544 — Oracle Java SE (JRE / JDK) 2022-03-03T00:00:00Z Apply the security update from Oracle. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 3, 2022. https://exploit-radar.com/en/cve/CVE-2012-0507/ CVE-2012-0507 — Oracle Java SE (JRE / JDK) 2022-03-03T00:00:00Z Apply the security update from Oracle. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on March 3, 2022.