| TP-EXP-2026-0008 | CVE-2026-34621 | Adobe Acrobat and Reader Prototype Pollution RCE (CVE-2026-34621) | Adobe Acrobat and Reader | high | patched | — | ✓ |
| TP-EXP-2020-0001 | CVE-2020-9715 | Adobe Acrobat Use-After-Free Vulnerability (CVE-2020-9715) | Adobe Acrobat | high | patched | — | ✓ |
| TP-EXP-2026-0009 | CVE-2026-34197 | Apache ActiveMQ Improper Input Validation Vulnerability (CVE-2026-34197) | Apache ActiveMQ | high | patched | — | ✓ |
| TP-EXP-2017-0001 | CVE-2017-5638 | Apache Struts Content-Type RCE (CVE-2017-5638) | Apache Struts 2.3.x before 2.3.32, 2.5.x before 2.5.10.1 | critical | patched | — | ✓ |
| TP-EXP-2026-0001 | CVE-2026-33825 | BlueHammer — Microsoft Defender Local Privilege Escalation | Windows 10 / 11 with Microsoft Defender enabled | high | patched | — | — |
| TP-EXP-2026-0006 | CVE-2026-5281 | Chrome Dawn WebGPU Use-After-Free — CVE-2026-5281 | Google Chrome < 146.0.7680.177 | high | patched | — | ✓ |
| TP-EXP-2026-0013 | CVE-2026-20122 | Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite via Privileged API (CVE-2026-20122) | Cisco Catalyst SD-WAN Manager < 20.15.4.2 | medium | patched | 0 | ✓ |
| TP-EXP-2026-0011 | CVE-2026-20128 | Cisco Catalyst SD-WAN Manager — DCA Credential File Exposure (CVE-2026-20128) | Cisco Catalyst SD-WAN Manager prior to 20.18 | high | patched | — | ✓ |
| TP-EXP-2026-0012 | CVE-2026-20133 | Cisco Catalyst SD-WAN Manager — OS-Level Sensitive Information Disclosure (CVE-2026-20133) | Cisco Catalyst SD-WAN Manager prior to 20.18.2.1 | high | patched | — | ✓ |
| TP-EXP-2026-0002 | CVE-2026-20131 | Cisco FMC Insecure Deserialization — Interlock Ransomware Zero-Day | Cisco Secure FMC | critical | patched | 37 | ✓ |
| TP-EXP-2024-0006 | CVE-2024-1708 | ConnectWise ScreenConnect Path Traversal — Authentication Bypass via Directory Traversal (CVE-2024-1708) | ConnectWise ScreenConnect < 23.9.8 | high | patched | — | ✓ |
| TP-EXP-2025-0005 | CVE-2025-29635 | D-Link DIR-823X Authenticated Command Injection via set_prohibiting API (CVE-2025-29635) | D-Link DIR-823X firmware 240126 / 240802 | high | active | — | ✓ |
| TP-EXP-2017-0002 | CVE-2017-0144 | EternalBlue — SMBv1 Remote Code Execution (CVE-2017-0144) | Microsoft Windows SMBv1 (Windows XP through Server 2008 R2) | critical | patched | — | ✓ |
| TP-EXP-2026-0004 | CVE-2026-35616 | FortiClient EMS API Authentication Bypass — Pre-Auth RCE | FortiClient EMS 7.4.5–7.4.6 | critical | patched | 4 | ✓ |
| TP-EXP-2026-0007 | CVE-2026-21643 | Fortinet FortiClient EMS SQL Injection (CVE-2026-21643) | Fortinet FortiClient EMS | critical | patched | — | ✓ |
| TP-EXP-2026-0016 | CVE-2026-3854 | GitHub Enterprise Server Git Push Option Injection RCE (CVE-2026-3854) | GitHub Enterprise Server ≤ 3.19.3; GitHub.com (mitigated) | high | patched | — | — |
| TP-EXP-2014-0002 | CVE-2014-0160 | Heartbleed — OpenSSL TLS Heartbeat Buffer Over-read (CVE-2014-0160) | OpenSSL 1.0.1 through 1.0.1f | critical | patched | — | ✓ |
| TP-EXP-2026-0003 | CVE-2026-1340 | Ivanti EPMM Code Injection — Bash Arithmetic Expansion RCE | Ivanti EPMM ≤ 12.7.0.0 | critical | patched | — | ✓ |
| TP-EXP-2024-0002 | CVE-2024-27199 | JetBrains TeamCity Relative Path Traversal — Unauthenticated Limited Admin Actions (CVE-2024-27199) | JetBrains TeamCity prior to 2023.11.4 | high | patched | — | ✓ |
| TP-EXP-2025-0003 | CVE-2025-2749 | Kentico Xperience Staging Sync Server Path Traversal and RCE (CVE-2025-2749) | Kentico Xperience CMS (through version 13.0.178) | high | patched | — | ✓ |
| TP-EXP-2021-0001 | CVE-2021-44228 | Log4Shell — Apache Log4j2 Remote Code Execution (CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.14.1 | critical | patched | 9 | ✓ |
| TP-EXP-2026-0014 | CVE-2026-39987 | Marimo Pre-Authentication Remote Code Execution via Terminal WebSocket (CVE-2026-39987) | Marimo < 0.23.0 | critical | patched | 0 | ✓ |
| TP-EXP-2023-0001 | CVE-2023-21529 | Microsoft Exchange Server Deserialization of Untrusted Data (CVE-2023-21529) | Microsoft Exchange Server 2013, 2016, 2019 | high | patched | — | ✓ |
| TP-EXP-2009-0001 | CVE-2009-0238 | Microsoft Office Excel Remote Code Execution (CVE-2009-0238) | Microsoft Office Excel 2000 through 2007 | high | patched | — | ✓ |
| TP-EXP-2026-0010 | CVE-2026-32201 | Microsoft SharePoint Server Improper Input Validation Vulnerability (CVE-2026-32201) | Microsoft SharePoint Server | medium | patched | — | ✓ |
| TP-EXP-2012-0001 | CVE-2012-1854 | Microsoft Visual Basic for Applications Insecure Library Loading (CVE-2012-1854) | Microsoft Visual Basic for Applications (VBA) in Office 2003 SP3, 2007 SP2/SP3, 2010 SP1 | high | patched | — | ✓ |
| TP-EXP-2023-0002 | CVE-2023-36424 | Microsoft Windows Out-of-Bounds Read Vulnerability (CVE-2023-36424) | Microsoft Windows | high | patched | — | ✓ |
| TP-EXP-2025-0001 | CVE-2025-60710 | Microsoft Windows Host Process for Windows Tasks Link Following LPE (CVE-2025-60710) | Microsoft Windows 11 (24H2, 25H2), Windows Server 2025 | high | patched | — | ✓ |
| TP-EXP-2026-0015 | CVE-2026-32202 | Microsoft Windows Shell Spoofing Vulnerability (CVE-2026-32202) | Microsoft Windows | medium | patched | — | ✓ |
| TP-EXP-2024-0001 | CVE-2024-3400 | Palo Alto PAN-OS GlobalProtect Command Injection (CVE-2024-3400) | Palo Alto Networks PAN-OS 10.2, 11.0, 11.1 | critical | patched | 26 | ✓ |
| TP-EXP-2023-0001 | CVE-2023-27351 | PaperCut NG/MF SecurityRequestFilter Authentication Bypass (CVE-2023-27351) | PaperCut NG and PaperCut MF (versions prior to 20.1.7, 21.2.11, 22.0.9) | high | patched | — | ✓ |
| TP-EXP-2025-0002 | CVE-2025-32975 | Quest KACE SMA SSO Authentication Bypass (CVE-2025-32975) | Quest KACE Systems Management Appliance (SMA) | critical | patched | — | ✓ |
| TP-EXP-2024-0004 | CVE-2024-7399 | Samsung MagicINFO 9 Server Unauthenticated File Upload to Remote Code Execution (CVE-2024-7399) | Samsung MagicINFO 9 Server <= 21.1050 | high | patched | — | ✓ |
| TP-EXP-2024-0003 | CVE-2024-57726 | SimpleHelp Technician Privilege Escalation to Admin via API Key Creation (CVE-2024-57726) | SimpleHelp <= 5.5.7 | critical | patched | — | ✓ |
| TP-EXP-2024-0005 | CVE-2024-57728 | SimpleHelp Admin Arbitrary File Upload via Zip Slip (CVE-2024-57728) | SimpleHelp <= 5.5.7 | high | patched | — | ✓ |
| TP-EXP-2010-0001 | CVE-2010-2568 | Stuxnet — Windows Shell LNK Shortcut Remote Code Execution (CVE-2010-2568) | Microsoft Windows / Siemens SIMATIC WinCC Step 7 | critical | patched | — | ✓ |
| TP-EXP-2025-0004 | CVE-2025-48700 | Synacor Zimbra Collaboration Suite (ZCS) — Cross-Site Scripting in Classic UI (CVE-2025-48700) | Synacor Zimbra Collaboration Suite (ZCS) 8.8.15, 9.0, 10.0, 10.1 | medium | patched | — | ✓ |
| TP-EXP-2026-0005 | CVE-2026-3502 | TrueConf Update Integrity Bypass — Supply Chain Code Execution | TrueConf Windows Client < 8.5.3 | high | patched | — | ✓ |
| TP-EXP-2026-0017 | CVE-2026-41940 | WebPros cPanel & WHM and WP2 (WordPress Squared) Authentication Bypass via Login Flow (CVE-2026-41940) | WebPros cPanel & WHM (versions 11.40 through 136.x) and WP2 WordPress Squared (prior to 136.1.7) | critical | patched | — | ✓ |