{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1496 Resource Hijacking","home_page_url":"https://patchfirst.co/technique/T1496/","feed_url":"https://patchfirst.co/feed/technique/T1496.json","description":"New and newly exploited CVEs that lead to ATT&CK T1496 Resource Hijacking, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-4632#kev","url":"https://patchfirst.co/cve/CVE-2025-4632/","title":"[KEV] CVE-2025-4632: Samsung MagicINFO 9 Server Path Traversal Vulnerability","content_text":"Samsung · MagicINFO 9 Server. In CISA KEV since 2025-05-22. ENISA EUVD lists it as exploited. EPSS 24.1% (higher than 97.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking; T1608.001 Upload Malware. Priority 69.4 of 100.","summary":"Samsung MagicINFO 9 Server Path Traversal Vulnerability","date_published":"2025-05-22T00:00:00.000Z","date_modified":"2026-06-17T09:33:39.000Z","tags":["kev","public-exploit","T1068","T1059","T1496","T1608.001"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2025-05-22","ransomware":false},"epss":{"score":0.24066,"percentile":0.97843},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Samsung","product":"MagicINFO 9 Server","techniqueIds":["T1068","T1059","T1496","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-23692#kev","url":"https://patchfirst.co/cve/CVE-2024-23692/","title":"[KEV] CVE-2024-23692: Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","content_text":"Rejetto · HTTP File Server. In CISA KEV since 2024-07-09, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1082 System Information Discovery; T1005 Data from Local System; T1105 Ingress Tool Transfer; T1496 Resource Hijacking. Priority 79.8 of 100.","summary":"Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","date_published":"2024-07-09T00:00:00.000Z","date_modified":"2026-08-11T04:17:15.000Z","tags":["kev","ransomware","public-exploit","T1082","T1005","T1105","T1496"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2024-07-09","ransomware":true},"epss":{"score":0.99485,"percentile":0.99944},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Rejetto","product":"HTTP File Server","techniqueIds":["T1082","T1005","T1105","T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-22527#kev","url":"https://patchfirst.co/cve/CVE-2023-22527/","title":"[KEV] CVE-2023-22527: Atlassian Confluence Data Center and Server Template Injection Vulnerability","content_text":"Atlassian · Confluence Data Center and Server. In CISA KEV since 2024-01-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1496 Resource Hijacking. Priority 79.9 of 100.","summary":"Atlassian Confluence Data Center and Server Template Injection Vulnerability","date_published":"2024-01-24T00:00:00.000Z","date_modified":"2026-06-17T05:35:38.000Z","tags":["kev","ransomware","public-exploit","T1496"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2024-01-24","ransomware":true},"epss":{"score":0.99984,"percentile":0.99982},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Atlassian","product":"Confluence Data Center and Server","techniqueIds":["T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-49897#kev","url":"https://patchfirst.co/cve/CVE-2023-49897/","title":"[KEV] CVE-2023-49897: FXC AE1021, AE1021PE OS Command Injection Vulnerability","content_text":"FXC · AE1021, AE1021PE. In CISA KEV since 2023-12-21. ENISA EUVD lists it as exploited. EPSS 50.4% (higher than 98.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1496 Resource Hijacking; T1498 Network Denial of Service. Priority 68.9 of 100.","summary":"FXC AE1021, AE1021PE OS Command Injection Vulnerability","date_published":"2023-12-21T00:00:00.000Z","date_modified":"2026-06-17T06:36:40.000Z","tags":["kev","public-exploit","T1496","T1498"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2023-12-21","ransomware":false},"epss":{"score":0.50447,"percentile":0.98911},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"FXC","product":"AE1021, AE1021PE","techniqueIds":["T1496","T1498"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-47565#kev","url":"https://patchfirst.co/cve/CVE-2023-47565/","title":"[KEV] CVE-2023-47565: QNAP VioStor NVR OS Command Injection Vulnerability","content_text":"QNAP · VioStor NVR. In CISA KEV since 2023-12-21. ENISA EUVD lists it as exploited. EPSS 73.3% (higher than 99.46% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1496 Resource Hijacking; T1498 Network Denial of Service. Priority 64.1 of 100.","summary":"QNAP VioStor NVR OS Command Injection Vulnerability","date_published":"2023-12-21T00:00:00.000Z","date_modified":"2026-06-17T06:32:55.000Z","tags":["kev","T1496","T1498"],"_patchfirst":{"reason":"kev","priority":64.1,"kev":{"dateAdded":"2023-12-21","ransomware":false},"epss":{"score":0.73277,"percentile":0.99458},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"QNAP","product":"VioStor NVR","techniqueIds":["T1496","T1498"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-32315#kev","url":"https://patchfirst.co/cve/CVE-2023-32315/","title":"[KEV] CVE-2023-32315: Ignite Realtime Openfire Path Traversal Vulnerability","content_text":"Ignite Realtime · Openfire. In CISA KEV since 2023-08-24. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1202 Indirect Command Execution; T1505.003 Web Shell; T1087.002 Domain Account; T1496 Resource Hijacking. Named in 1 threat report. Priority 82.1 of 100.","summary":"Ignite Realtime Openfire Path Traversal Vulnerability","date_published":"2023-08-24T00:00:00.000Z","date_modified":"2026-06-17T05:58:33.000Z","tags":["kev","public-exploit","T1202","T1505.003","T1087.002","T1496"],"_patchfirst":{"reason":"kev","priority":82.1,"kev":{"dateAdded":"2023-08-24","ransomware":false},"epss":{"score":0.99999,"percentile":0.99992},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Ignite Realtime","product":"Openfire","techniqueIds":["T1202","T1505.003","T1087.002","T1496"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-38035#kev","url":"https://patchfirst.co/cve/CVE-2023-38035/","title":"[KEV] CVE-2023-38035: Ivanti Sentry Authentication Bypass Vulnerability","content_text":"Ivanti · Sentry. In CISA KEV since 2023-08-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1018 Remote System Discovery; T1046 Network Service Discovery; T1071.001 Web Protocols; T1105 Ingress Tool Transfer; +2 more. Priority 79.9 of 100.","summary":"Ivanti Sentry Authentication Bypass Vulnerability","date_published":"2023-08-22T00:00:00.000Z","date_modified":"2026-06-17T06:09:16.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1018","T1046","T1071.001","T1105","T1496","T1571"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2023-08-22","ransomware":true},"epss":{"score":0.9995,"percentile":0.99974},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Sentry","techniqueIds":["T1190","T1059","T1018","T1046","T1071.001","T1105","T1496","T1571"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-29303#kev","url":"https://patchfirst.co/cve/CVE-2022-29303/","title":"[KEV] CVE-2022-29303: SolarView Compact Command Injection Vulnerability","content_text":"SolarView · Compact. In CISA KEV since 2023-07-13. ENISA EUVD lists it as exploited. EPSS 98.0% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1505 Server Software Component; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking. Priority 69.8 of 100.","summary":"SolarView Compact Command Injection Vulnerability","date_published":"2023-07-13T00:00:00.000Z","date_modified":"2026-06-17T04:39:59.000Z","tags":["kev","public-exploit","T1505","T1059","T1496"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2023-07-13","ransomware":false},"epss":{"score":0.98039,"percentile":0.9991},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarView","product":"Compact","techniqueIds":["T1505","T1059","T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-1389#kev","url":"https://patchfirst.co/cve/CVE-2023-1389/","title":"[KEV] CVE-2023-1389: TP-Link Archer AX-21 Command Injection Vulnerability","content_text":"TP-Link · Archer AX21. In CISA KEV since 2023-05-01. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1106 Native API; T1496 Resource Hijacking; T1041 Exfiltration Over C2 Channel; T1070 Indicator Removal; T1498 Network Denial of Service. Priority 69.2 of 100.","summary":"TP-Link Archer AX-21 Command Injection Vulnerability","date_published":"2023-05-01T00:00:00.000Z","date_modified":"2026-06-17T05:27:50.000Z","tags":["kev","public-exploit","T1106","T1496","T1041","T1070","T1498"],"_patchfirst":{"reason":"kev","priority":69.2,"kev":{"dateAdded":"2023-05-01","ransomware":false},"epss":{"score":0.99999,"percentile":0.99992},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"TP-Link","product":"Archer AX21","techniqueIds":["T1106","T1496","T1041","T1070","T1498"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-29464#kev","url":"https://patchfirst.co/cve/CVE-2022-29464/","title":"[KEV] CVE-2022-29464: WSO2 Multiple Products Unrestrictive Upload of File Vulnerability","content_text":"WSO2 · Multiple Products. In CISA KEV since 2022-04-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1202 Indirect Command Execution; T1496 Resource Hijacking. Priority 79.9 of 100.","summary":"WSO2 Multiple Products Unrestrictive Upload of File Vulnerability","date_published":"2022-04-25T00:00:00.000Z","date_modified":"2026-06-17T04:40:13.000Z","tags":["kev","ransomware","public-exploit","T1190","T1202","T1496"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2022-04-25","ransomware":true},"epss":{"score":0.99999,"percentile":0.99992},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"WSO2","product":"Multiple Products","techniqueIds":["T1190","T1202","T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-44228#kev","url":"https://patchfirst.co/cve/CVE-2021-44228/","title":"[KEV] CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability","content_text":"Apache · Log4j2. In CISA KEV since 2021-12-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1486 Data Encrypted for Impact; T1496 Resource Hijacking; T1505.003 Web Shell; T1608.001 Upload Malware. Named in 10 threat reports. Priority 90.0 of 100.","summary":"Apache Log4j2 Remote Code Execution Vulnerability","date_published":"2021-12-10T00:00:00.000Z","date_modified":"2026-08-11T19:33:44.000Z","tags":["kev","ransomware","public-exploit","T1190","T1486","T1496","T1505.003","T1608.001"],"_patchfirst":{"reason":"kev","priority":90,"kev":{"dateAdded":"2021-12-10","ransomware":true},"epss":{"score":0.99999,"percentile":1},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache","product":"Log4j2","techniqueIds":["T1190","T1486","T1496","T1505.003","T1608.001"],"reportCount":10,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-35394#kev","url":"https://patchfirst.co/cve/CVE-2021-35394/","title":"[KEV] CVE-2021-35394: Realtek Jungle SDK Remote Code Execution Vulnerability","content_text":"Realtek · Jungle Software Development Kit (SDK). In CISA KEV since 2021-12-10. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1496 Resource Hijacking; T1499 Endpoint Denial of Service; +1 more. Priority 69.9 of 100.","summary":"Realtek Jungle SDK Remote Code Execution Vulnerability","date_published":"2021-12-10T00:00:00.000Z","date_modified":"2026-06-17T03:57:29.000Z","tags":["kev","public-exploit","T1190","T1059","T1071.001","T1105","T1496","T1499","T1569.002"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2021-12-10","ransomware":false},"epss":{"score":0.99877,"percentile":0.99964},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Realtek","product":"Jungle Software Development Kit (SDK)","techniqueIds":["T1190","T1059","T1071.001","T1105","T1496","T1499","T1569.002"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-26084#kev","url":"https://patchfirst.co/cve/CVE-2021-26084/","title":"[KEV] CVE-2021-26084: Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability","content_text":"Atlassian · Confluence Server and Data Center. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1496 Resource Hijacking. Named in 3 threat reports. Priority 87.6 of 100.","summary":"Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:42:49.000Z","tags":["kev","ransomware","public-exploit","T1059","T1496"],"_patchfirst":{"reason":"kev","priority":87.6,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99993},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Atlassian","product":"Confluence Server and Data Center","techniqueIds":["T1059","T1496"],"reportCount":3,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-7600#kev","url":"https://patchfirst.co/cve/CVE-2018-7600/","title":"[KEV] CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability","content_text":"Drupal · Drupal Core. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1485 Data Destruction; T1496 Resource Hijacking. Named in 1 threat report. Priority 83.7 of 100.","summary":"Drupal Core Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:03:25.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1485","T1496"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99991,"percentile":0.99985},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Drupal","product":"Drupal Core","techniqueIds":["T1190","T1059","T1485","T1496"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-18935#kev","url":"https://patchfirst.co/cve/CVE-2019-18935/","title":"[KEV] CVE-2019-18935: Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability","content_text":"Progress · Telerik UI for ASP.NET AJAX. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1496 Resource Hijacking; T1505.003 Web Shell. Named in 1 threat report. Priority 83.7 of 100.","summary":"Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:25:36.000Z","tags":["kev","ransomware","public-exploit","T1190","T1041","T1496","T1505.003"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99737,"percentile":0.99954},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Progress","product":"Telerik UI for ASP.NET AJAX","techniqueIds":["T1190","T1041","T1496","T1505.003"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-11776#kev","url":"https://patchfirst.co/cve/CVE-2018-11776/","title":"[KEV] CVE-2018-11776: Apache Struts Remote Code Execution Vulnerability","content_text":"Apache · Struts. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking. Named in 1 threat report. Priority 82.5 of 100.","summary":"Apache Struts Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T01:36:34.000Z","tags":["kev","public-exploit","T1190","T1059","T1496"],"_patchfirst":{"reason":"kev","priority":82.5,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.99996,"percentile":0.99989},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Apache","product":"Struts","techniqueIds":["T1190","T1059","T1496"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22205#kev","url":"https://patchfirst.co/cve/CVE-2021-22205/","title":"[KEV] CVE-2021-22205: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability","content_text":"GitLab · Community and Enterprise Editions. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1498 Network Denial of Service; T1496 Resource Hijacking. Priority 80.0 of 100.","summary":"GitLab Community and Enterprise Editions Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-06T05:16:35.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1498","T1496"],"_patchfirst":{"reason":"kev","priority":80,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99731,"percentile":0.99953},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"Community and Enterprise Editions","techniqueIds":["T1190","T1059","T1498","T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-9822#kev","url":"https://patchfirst.co/cve/CVE-2017-9822/","title":"[KEV] CVE-2017-9822: DotNetNuke (DNN) Remote Code Execution Vulnerability","content_text":"DotNetNuke (DNN) · DotNetNuke (DNN). In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 94.8% (higher than 99.86% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking. Priority 79.1 of 100.","summary":"DotNetNuke (DNN) Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T01:28:59.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1496"],"_patchfirst":{"reason":"kev","priority":79.1,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.94789,"percentile":0.99859},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"DotNetNuke (DNN)","product":"DotNetNuke (DNN)","techniqueIds":["T1190","T1059","T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-8515#kev","url":"https://patchfirst.co/cve/CVE-2020-8515/","title":"[KEV] CVE-2020-8515: Multiple DrayTek Vigor Routers Web Management Page Vulnerability","content_text":"DrayTek · Multiple Vigor Routers. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1496 Resource Hijacking. Priority 69.9 of 100.","summary":"Multiple DrayTek Vigor Routers Web Management Page Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:26:30.000Z","tags":["kev","public-exploit","T1133","T1059","T1496"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.99993,"percentile":0.99987},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"DrayTek","product":"Multiple Vigor Routers","techniqueIds":["T1133","T1059","T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-16200","url":"https://patchfirst.co/cve/CVE-2020-16200/","title":"CVE-2020-16200: Philips Clinical Collaboration Platform Algorithm Downgrade","content_text":"Philips · Clinical Collaboration Platform. Not in CISA KEV. EPSS 0.6% (higher than 49.8% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1496 Resource Hijacking. Priority 14.5 of 100.","summary":"Philips Clinical Collaboration Platform Algorithm Downgrade","date_published":"2020-09-18T00:00:00.000Z","date_modified":"2025-06-04T21:21:08.000Z","tags":["T1496"],"_patchfirst":{"reason":"published","priority":14.5,"kev":null,"epss":{"score":0.00621,"percentile":0.49756},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Philips","product":"Clinical Collaboration Platform","techniqueIds":["T1496"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-11084","url":"https://patchfirst.co/cve/CVE-2018-11084/","title":"CVE-2018-11084: Garden-runC prevents deletion of some app environments","content_text":"Cloud Foundry · Garden-runC. Not in CISA KEV. EPSS 1.2% (higher than 67.7% of CVEs). CVSS 6.8 MEDIUM. ATT&CK: T1496 Resource Hijacking. Priority 19.7 of 100.","summary":"Garden-runC prevents deletion of some app environments","date_published":"2018-09-18T00:00:00.000Z","date_modified":"2024-09-16T16:49:02.000Z","tags":["T1496"],"_patchfirst":{"reason":"published","priority":19.7,"kev":null,"epss":{"score":0.01182,"percentile":0.6772},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.0"},"vendor":"Cloud Foundry","product":"Garden-runC","techniqueIds":["T1496"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}