CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-02, highest first.
- CVE-2025-59528Flowise has Remote Code Execution vulnerabilityFlowiseAI Flowise · flowise
- CVE-2017-14491Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via
- CVE-2019-16057The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
- CVE-2024-3721TBK DVR-4104/DVR-4216 os command injectionTBK DVR-4104 · TBK DVR-4216
- CVE-2006-5444Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2
- CVE-2019-4716IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "adminIBM Planning Analytics
- CVE-2018-1160Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c.Netatalk
- CVE-2003-0085Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, al
- CVE-2011-2110Adobe Flash Player before 10.3.181.26 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.23 and earlier on Android, allows remote attack
- CVE-2021-27907Apache Superset stored XSS on Dashboard markdownApache Software Foundation Apache Superset · apache-superset
- CVE-2005-0773Stack-based buffer overflow in VERITAS Backup Exec Remote Agent 9.0 through 10.0 for Windows, and 9.0.4019 through 9.1.307 for Netware allow
- CVE-2023-5360Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File UploadRoyal Elementor Addons and Templates
- CVE-2021-45232security vulnerability on unauthorized access.Apache Software Foundation Apache APISIX Dashboard
- CVE-2021-21017Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionAdobe Acrobat Reader
- CVE-2013-7091Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2
- CVE-2024-25641Cacti RCE vulnerability when importing packagescacti
- CVE-2018-15379Cisco Prime Infrastructure Arbitrary File Upload and Command Execution VulnerabilityCisco Prime Infrastructure
- CVE-2024-29973** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5Zyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2017-5816A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.Hewlett Packard Enterprise Intelligent Management Center (i…
- CVE-2020-2038PAN-OS: OS command injection vulnerability in the management web interfacePalo Alto Networks PAN-OS
- CVE-2022-2992A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated usGitLab
- CVE-2016-20016MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI.
- CVE-2020-11652An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.salt
- CVE-2022-27166XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2Apache Software Foundation Apache JSPWiki · org.apache.jspw…
- CVE-2022-28730Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jspApache Software Foundation Apache JSPWiki · org.apache.jspw…
- CVE-2013-1493The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Upd
- CVE-2025-1098ingress-nginx controller - configuration injection via unsanitized mirror annotationskubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2005-4560The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Wind
- CVE-2008-5353The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2
- CVE-2020-14295A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter.
- CVE-2019-1003001A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFloJenkins project Pipeline: Groovy Plugin · org.jenkins-ci… +2
- CVE-2023-39265Apache Superset: Possible Unauthorized Registration of SQLite Database ConnectionsApache Software Foundation Apache Superset · apache-superset
- CVE-2022-37958SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2018-10661An issue was discovered in multiple models of Axis IP Cameras.
- CVE-2015-2545Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, ak
- CVE-2020-17523Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.Apache Shiro · org.apache.shiro:shiro-web +2
- CVE-2020-28871Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an in
- CVE-2023-43208NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution.
- CVE-2023-30625rudder-server vulnerable to SQL Injectionrudderlabs rudder-server · github.com/rudderlabs/rudder-ser…
- CVE-2023-34127Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall AnalytiSonicWall GMS · SonicWall Analytics
- CVE-2022-41678Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCEApache Software Foundation Apache ActiveMQ · org.apache.act…
- CVE-2015-1539Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remot
- CVE-2014-3470The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an ano
- CVE-2014-0226Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-b
- CVE-2021-30116Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
- CVE-2021-29447WordPress Authenticated XXE attack when installation is running PHP 8wordpress-develop
- CVE-2001-0241Buffer overflow in Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print reques
- CVE-2023-27997A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below,Fortinet FortiOS-6K7K · Fortinet FortiProxy +1
- CVE-2003-0109Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote
- CVE-2025-52691Upload Arbitrary FilesSmarterTools SmarterMail