Deze pagina toont kwetsbaarheden die actief worden misbruikt door cybercriminelen. De data komt van CISA (VS), het NCSC (NL) en FIRST EPSS. Dit is geen trending-lijst op sociale media, maar een overzicht van bewezen gevaarlijke kwetsbaarheden.

Top 10 Misbruikte Kwetsbaarheden - Nederland en Belgie

Gebaseerd op NCSC advisories, verrijkt met CISA KEV en EPSS data

CVE-2026-1731 BeyondTrust - Remote Support (RS) and Privileged Remote Access (PRA)

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute op...

CVSS 9.8 KRITIEK EPSS 60.9% CISA KEV Ransomware NCSC [H/H]

CVE-2026-20127 Cisco - Catalyst SD-WAN Controller and Manager

Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, ...

CVSS 10.0 KRITIEK EPSS 2.6% CISA KEV NCSC [H/H]

CVE-2022-20775 Cisco - SD-WAN

Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application...

CVSS 7.8 HOOG EPSS 0.4% CISA KEV NCSC [H/H]

CVE-2026-2441 Google - Chromium

Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multip...

CVSS 8.8 HOOG EPSS 0.3% CISA KEV NCSC [M/H]

CVE-2026-21513 Microsoft - Windows

Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

CVSS 8.8 HOOG EPSS 4.8% CISA KEV NCSC [M/H]

CVE-2026-21514 Microsoft - Office

Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.

CVSS 7.8 HOOG EPSS 3.3% CISA KEV NCSC [M/H]

CVE-2026-20700 Apple - Multiple Products

Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the cap...

CVSS 7.8 HOOG EPSS 0.4% CISA KEV NCSC [M/H]

CVE-2026-21510 Microsoft - Windows

Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

CVSS 8.8 HOOG EPSS 2.7% CISA KEV NCSC [M/H]

CVE-2026-21519 Microsoft - Windows

Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.

CVSS 7.8 HOOG EPSS 2.4% CISA KEV NCSC [M/H]

#10

CVE-2026-21533 Microsoft - Windows

Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.

CVSS 7.8 HOOG EPSS 1.9% CISA KEV NCSC [M/H]

Top 10 Misbruikte Kwetsbaarheden - Wereldwijd

Gebaseerd op CISA Known Exploited Vulnerabilities, gerangschikt op exploitatiekans (EPSS)

CVE-2020-7796 Synacor - Zimbra Collaboration Suite

Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.

CVSS 9.8 KRITIEK EPSS 93.5% CISA KEV

CVE-2025-49113 Roundcube - Webmail

RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in progra...

CVSS 9.9 KRITIEK EPSS 90.4% CISA KEV

CVE-2024-43468 Microsoft - Configuration Manager

Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment...

CVSS 9.8 KRITIEK EPSS 84.6% CISA KEV

CVE-2008-0015 Microsoft - Windows

Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views t...

CVSS 8.8 HOOG EPSS 80.6% CISA KEV

CVE-2025-40551 SolarWinds - Web Help Desk

SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This...

CVSS 9.8 KRITIEK EPSS 79.4% CISA KEV

CVE-2021-22175 GitLab - GitLab

GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.

CVSS 6.8 MIDDEL EPSS 73.3% CISA KEV

CVE-2025-40536 SolarWinds - Web Help Desk

SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.

CVSS 8.1 HOOG EPSS 68.1% CISA KEV

CVE-2026-1731 BeyondTrust - Remote Support (RS) and Privileged Remote Access (PRA)

CVSS 9.8 KRITIEK EPSS 60.9% CISA KEV Ransomware NCSC [H/H]

CVE-2021-39935 GitLab - Community and Enterprise Editions

GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.

CVSS 6.8 MIDDEL EPSS 54.3% CISA KEV

#10

CVE-2026-22769 Dell - RecoverPoint for Virtual Machines (RP4VMs)

Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underl...

CVSS 10.0 KRITIEK EPSS 34.2% CISA KEV

Top 10 Misbruikte Kwetsbaarheden - Gecombineerd

Gewogen ranking op basis van CISA KEV, NCSC severity, EPSS score, ransomware en recentheid

CVE-2026-1731 BeyondTrust - Remote Support (RS) and Privileged Remote Access (PRA)

CVSS 9.8 KRITIEK EPSS 60.9% CISA KEV Ransomware NCSC [H/H]

CVE-2025-49113 Roundcube - Webmail

CVSS 9.9 KRITIEK EPSS 90.4% CISA KEV

CVE-2020-7796 Synacor - Zimbra Collaboration Suite

Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.

CVSS 9.8 KRITIEK EPSS 93.5% CISA KEV

CVE-2026-24423 SmarterTools - SmarterMail

SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a m...

CVSS 9.8 KRITIEK EPSS 29.3% CISA KEV Ransomware

CVE-2024-43468 Microsoft - Configuration Manager

CVSS 9.8 KRITIEK EPSS 84.6% CISA KEV

CVE-2008-0015 Microsoft - Windows

CVSS 8.8 HOOG EPSS 80.6% CISA KEV

CVE-2025-40551 SolarWinds - Web Help Desk

CVSS 9.8 KRITIEK EPSS 79.4% CISA KEV

CVE-2026-20127 Cisco - Catalyst SD-WAN Controller and Manager

CVSS 10.0 KRITIEK EPSS 2.6% CISA KEV NCSC [H/H]

CVE-2021-22175 GitLab - GitLab

GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.

CVSS 6.8 MIDDEL EPSS 73.3% CISA KEV

#10

CVE-2025-40536 SolarWinds - Web Help Desk

SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.

CVSS 8.1 HOOG EPSS 68.1% CISA KEV

Legenda: CVSS = ernst-score (0-10): 9.0-10 Kritiek 7.0-8.9 Hoog 4.0-6.9 Middel 0.1-3.9 Laag | EPSS = kans op exploitatie (FIRST.org) | CISA KEV = bevestigd actief misbruikt | Ransomware = gebruikt in ransomware-campagnes | NCSC = NCSC advisory met ernst-rating