https://exploit-radar.com/en/flux/categories/web-middleware.xml Exploit Radar: Web and application servers The latest additions to CISA’s catalog of exploited vulnerabilities in the “Web and application servers” category (indicative classification). 2026-09-24T00:00:00Z Exploit Radar https://exploit-radar.com/en/cve/CVE-2026-5430/ CVE-2026-5430 — WSO2 API Manager, Identity Server, Integrator 2026-09-24T00:00:00Z Apply the patches or mitigations from WSO2; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 24, 2026. https://exploit-radar.com/en/cve/CVE-2026-21962/ CVE-2026-21962 — Oracle WebLogic Server 2026-08-24T00:00:00Z Apply the patches or mitigations from Oracle; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on August 24, 2026. https://exploit-radar.com/en/cve/CVE-2026-34486/ CVE-2026-34486 — Apache Tomcat 2026-08-04T00:00:00Z Apply the patches or mitigations from Apache; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on August 4, 2026. https://exploit-radar.com/en/cve/CVE-2026-48282/ CVE-2026-48282 — Adobe ColdFusion 2026-07-07T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on July 7, 2026. https://exploit-radar.com/en/cve/CVE-2026-54420/ CVE-2026-54420 — LiteSpeed cPanel Plugin 2026-06-15T00:00:00Z Apply the patches or mitigations from LiteSpeed; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on June 15, 2026. https://exploit-radar.com/en/cve/CVE-2024-21182/ CVE-2024-21182 — Oracle WebLogic Server 2026-06-01T00:00:00Z Apply the patches or mitigations from Oracle; if none are available, stop using the product. For cloud services, follow the guidance from Oracle. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on June 1, 2026. https://exploit-radar.com/en/cve/CVE-2026-48172/ CVE-2026-48172 — LiteSpeed cPanel Plugin 2026-05-26T00:00:00Z Apply the patches or mitigations from LiteSpeed; if none are available, stop using the product. For cloud services, follow the guidance from LiteSpeed. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on May 26, 2026. https://exploit-radar.com/en/cve/CVE-2026-41940/ CVE-2026-41940 — cPanel (WebPros) cPanel & WHM (WP Squared) 2026-04-30T00:00:00Z Apply the patches or mitigations from cPanel (WebPros); if none are available, stop using the product. For cloud services, follow the guidance from cPanel (WebPros). CISA deadline: 3 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on April 30, 2026. https://exploit-radar.com/en/cve/CVE-2026-34197/ CVE-2026-34197 — Apache ActiveMQ 2026-04-16T00:00:00Z Apply the patches or mitigations from Apache; if none are available, stop using the product. For cloud services, follow the guidance from Apache. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on April 16, 2026. https://exploit-radar.com/en/cve/CVE-2025-48703/ CVE-2025-48703 — CWP (Control Web Panel / CentOS Web Panel) Control Web Panel 2025-11-04T00:00:00Z Apply the patches or mitigations from CWP (Control Web Panel / CentOS Web Panel); if none are available, stop using the product. For cloud services, follow the guidance from CWP (Control Web Panel / CentOS Web Panel). CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on November 4, 2025. https://exploit-radar.com/en/cve/CVE-2024-38475/ CVE-2024-38475 — Apache HTTP Server 2025-05-01T00:00:00Z Apply the patches or mitigations from Apache; if none are available, stop using the product. For cloud services, follow the guidance from Apache. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 1, 2025. https://exploit-radar.com/en/cve/CVE-2025-24813/ CVE-2025-24813 — Apache Tomcat 2025-04-01T00:00:00Z Apply the patches or mitigations from Apache; if none are available, stop using the product. For cloud services, follow the guidance from Apache. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on April 1, 2025. https://exploit-radar.com/en/cve/CVE-2017-3066/ CVE-2017-3066 — Adobe ColdFusion 2025-02-24T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on February 24, 2025. https://exploit-radar.com/en/cve/CVE-2020-2883/ CVE-2020-2883 — Oracle WebLogic Server 2025-01-07T00:00:00Z Apply the patches or mitigations from Oracle; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on January 7, 2025. https://exploit-radar.com/en/cve/CVE-2024-20767/ CVE-2024-20767 — Adobe ColdFusion 2024-12-16T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on December 16, 2024. https://exploit-radar.com/en/cve/CVE-2024-51378/ CVE-2024-51378 — CyberPanel (CyberPersons) CyberPanel 2024-12-04T00:00:00Z Apply the patches or mitigations from CyberPanel (CyberPersons); if none are available, stop using the product. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on December 4, 2024. https://exploit-radar.com/en/cve/CVE-2019-16278/ CVE-2019-16278 — Nostromo nhttpd 2024-11-07T00:00:00Z Apply the patches or mitigations from Nostromo; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on November 7, 2024. https://exploit-radar.com/en/cve/CVE-2024-51567/ CVE-2024-51567 — CyberPanel (CyberPersons) CyberPanel 2024-11-07T00:00:00Z Apply the patches or mitigations from CyberPanel (CyberPersons); if none are available, stop using the product. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on November 7, 2024. https://exploit-radar.com/en/cve/CVE-2020-14644/ CVE-2020-14644 — Oracle WebLogic Server 2024-09-18T00:00:00Z Apply the patches or mitigations from Oracle; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on September 18, 2024. https://exploit-radar.com/en/cve/CVE-2017-3506/ CVE-2017-3506 — Oracle WebLogic Server 2024-06-03T00:00:00Z Apply the patches or mitigations from Oracle; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on June 3, 2024. https://exploit-radar.com/en/cve/CVE-2023-29300/ CVE-2023-29300 — Adobe ColdFusion 2024-01-08T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on January 8, 2024. https://exploit-radar.com/en/cve/CVE-2023-38203/ CVE-2023-38203 — Adobe ColdFusion 2024-01-08T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on January 8, 2024. https://exploit-radar.com/en/cve/CVE-2020-2551/ CVE-2020-2551 — Oracle WebLogic Server 2023-11-16T00:00:00Z Apply the patches or mitigations from Oracle; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on November 16, 2023. https://exploit-radar.com/en/cve/CVE-2023-46604/ CVE-2023-46604 — Apache ActiveMQ 2023-11-02T00:00:00Z Apply the patches or mitigations from Apache; if none are available, stop using the product. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on November 2, 2023. https://exploit-radar.com/en/cve/CVE-2023-44487/ CVE-2023-44487 — Protocoles (IETF) HTTP/2 2023-10-10T00:00:00Z Apply the patches or mitigations from Protocoles (IETF); if none are available, stop using the product. For cloud services, follow the guidance from Protocoles (IETF). CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on October 10, 2023. https://exploit-radar.com/en/cve/CVE-2023-33246/ CVE-2023-33246 — Apache RocketMQ 2023-09-06T00:00:00Z Apply the patches or mitigations from Apache; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on September 6, 2023. https://exploit-radar.com/en/cve/CVE-2023-26359/ CVE-2023-26359 — Adobe ColdFusion 2023-08-21T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on August 21, 2023. https://exploit-radar.com/en/cve/CVE-2023-29298/ CVE-2023-29298 — Adobe ColdFusion 2023-07-20T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on July 20, 2023. https://exploit-radar.com/en/cve/CVE-2023-38205/ CVE-2023-38205 — Adobe ColdFusion 2023-07-20T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on July 20, 2023. https://exploit-radar.com/en/cve/CVE-2016-8735/ CVE-2016-8735 — Apache Tomcat 2023-05-12T00:00:00Z Apply the security update from Apache. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 12, 2023. https://exploit-radar.com/en/cve/CVE-2023-21839/ CVE-2023-21839 — Oracle WebLogic Server 2023-05-01T00:00:00Z Apply the security update from Oracle. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on May 1, 2023. https://exploit-radar.com/en/cve/CVE-2023-26360/ CVE-2023-26360 — Adobe ColdFusion 2023-03-15T00:00:00Z Apply the security update from Adobe. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 15, 2023. https://exploit-radar.com/en/cve/CVE-2022-44877/ CVE-2022-44877 — CWP (Control Web Panel / CentOS Web Panel) Control Web Panel 2023-01-17T00:00:00Z Apply the security update from CWP (Control Web Panel / CentOS Web Panel). CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on January 17, 2023. https://exploit-radar.com/en/cve/CVE-2018-2628/ CVE-2018-2628 — Oracle WebLogic Server 2022-09-08T00:00:00Z Apply the security update from Oracle. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on September 8, 2022. https://exploit-radar.com/en/cve/CVE-2022-24112/ CVE-2022-24112 — Apache APISIX 2022-08-25T00:00:00Z Apply the security update from Apache. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on August 25, 2022. https://exploit-radar.com/en/cve/CVE-2012-1710/ CVE-2012-1710 — Oracle Fusion Middleware 2022-05-25T00:00:00Z Apply the security update from Oracle. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on May 25, 2022. https://exploit-radar.com/en/cve/CVE-2010-1428/ CVE-2010-1428 — Red Hat JBoss Application Server / EAP 2022-05-25T00:00:00Z Apply the security update from Red Hat. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on May 25, 2022. https://exploit-radar.com/en/cve/CVE-2010-0738/ CVE-2010-0738 — Red Hat JBoss Application Server / EAP 2022-05-25T00:00:00Z Apply the security update from Red Hat. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on May 25, 2022. https://exploit-radar.com/en/cve/CVE-2022-29464/ CVE-2022-29464 — WSO2 API Manager, Identity Server, Integrator 2022-04-25T00:00:00Z Apply the security update from WSO2. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on April 25, 2022. https://exploit-radar.com/en/cve/CVE-2010-2861/ CVE-2010-2861 — Adobe ColdFusion 2022-03-25T00:00:00Z Apply the security update from Adobe. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2019-15107/ CVE-2019-15107 — Webmin 2022-03-25T00:00:00Z Apply the security update from Webmin. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2017-12615/ CVE-2017-12615 — Apache Tomcat 2022-03-25T00:00:00Z Apply the security update from Apache. CISA deadline: 21 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2017-12617/ CVE-2017-12617 — Apache Tomcat 2022-03-25T00:00:00Z Apply the security update from Apache. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 25, 2022. https://exploit-radar.com/en/cve/CVE-2013-0625/ CVE-2013-0625 — Adobe ColdFusion 2022-03-07T00:00:00Z Apply the security update from Adobe. CISA deadline: 184 days. Added to CISA’s catalog of exploited vulnerabilities on March 7, 2022. https://exploit-radar.com/en/cve/CVE-2013-0629/ CVE-2013-0629 — Adobe ColdFusion 2022-03-07T00:00:00Z Apply the security update from Adobe. CISA deadline: 184 days. Added to CISA’s catalog of exploited vulnerabilities on March 7, 2022. https://exploit-radar.com/en/cve/CVE-2013-0631/ CVE-2013-0631 — Adobe ColdFusion 2022-03-07T00:00:00Z Apply the security update from Adobe. CISA deadline: 184 days. Added to CISA’s catalog of exploited vulnerabilities on March 7, 2022. https://exploit-radar.com/en/cve/CVE-2013-0632/ CVE-2013-0632 — Adobe ColdFusion 2022-03-03T00:00:00Z Apply the security update from Adobe. CISA deadline: 21 days. Added to CISA’s catalog of exploited vulnerabilities on March 3, 2022. https://exploit-radar.com/en/cve/CVE-2020-1938/ CVE-2020-1938 — Apache Tomcat 2022-03-03T00:00:00Z Apply the security update from Apache. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on March 3, 2022. https://exploit-radar.com/en/cve/CVE-2016-3088/ CVE-2016-3088 — Apache ActiveMQ 2022-02-10T00:00:00Z Apply the security update from Apache. CISA deadline: 181 days. Added to CISA’s catalog of exploited vulnerabilities on February 10, 2022. https://exploit-radar.com/en/cve/CVE-2017-10271/ CVE-2017-10271 — Oracle WebLogic Server 2022-02-10T00:00:00Z Apply the security update from Oracle. CISA deadline: 181 days. Used in ransomware campaigns. Added to CISA’s catalog of exploited vulnerabilities on February 10, 2022.