CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-02, highest first.
- CVE-2022-40127Apache Airflow <2.4.0 has an RCE in a bash exampleApache Software Foundation Apache Airflow · apache-airflow
- CVE-2020-35774server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS com.twitter:twitter-server_2.12
- CVE-2023-4634Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Executiondglingren Media Library Assistant
- CVE-2015-0311Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and throu
- CVE-2020-3580Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesCisco Adaptive Security Appliance (ASA) Software
- CVE-2001-0803Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to exec
- CVE-2015-7501Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Applicommons-collections:commons-collections · org.apache.com… +3
- CVE-2015-7858SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a
- CVE-2017-9769A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a
- CVE-2006-4847Multiple buffer overflows in Ipswitch WS_FTP Server 5.05 before Hotfix 1 allow remote authenticated users to execute arbitrary code via long
- CVE-2025-32429XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterxwiki-platform · org.xwiki.platform:xwiki-platform-distribu…
- CVE-2003-0533Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (L
- CVE-2004-0330Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to th
- CVE-2017-9100login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spac
- CVE-2017-15715In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, raApache Software Foundation Apache HTTP Server
- CVE-2011-0063The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal a
- CVE-2023-39362Authenticated command injection in SNMP options of a Devicecacti
- CVE-2012-0152The Remote Desktop Protocol (RDP) service in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers
- CVE-2026-48907Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5joomlacontenteditor.net Joomla Content Editor (JCE) extensi…
- CVE-2021-31805Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.Apache Software Foundation Apache Struts · org.apache.strut…
- CVE-2024-21888A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a useIvanti ICS · Ivanti IPS
- CVE-2021-41174XSS vulnerability allowing arbitrary JavaScript executiongrafana · @grafana/data
- CVE-2017-14495Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a
- CVE-2022-2414Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks.Dogtag PKI
- CVE-2024-1728Local File Inclusion in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2015-3828The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a min
- CVE-2005-2086PHP remote file inclusion vulnerability in viewtopic.php in phpBB 2.0.15 and earlier allows remote attackers to execute arbitrary PHP code.
- CVE-2012-4940Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or de
- CVE-2022-0306Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2025-34152Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time ParameterShenzhen Aitemi E Commerce Co. M300 Wi-Fi Repeater
- CVE-2018-6961VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component.VMware NSX SD-WAN by VeloCloud
- CVE-2026-50751User Authentication Bypass in VPN Remote Access and Mobile Accesscheckpoint Quantum Security Gateway · checkpoint Spark Fire…
- CVE-2022-0441MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account CreationMasterStudy LMS – WordPress LMS Plugin
- CVE-2020-35476A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter.net.opentsdb:opentsdb
- CVE-2021-1675Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-3799Directory Traversal with spring-cloud-config-serverSpring Cloud Config · org.springframework.cloud:spring-clou…
- CVE-2023-25157Unfiltered SQL Injection Vulnerabilities in Geoservergeoserver · org.geoserver.community:gs-jdbcconfig
- CVE-2017-14493Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code vi
- CVE-2013-2423Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows r
- CVE-1999-1053guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to exec
- CVE-2025-8110File overwrite in file update API in GogsGogs · gogs.io/gogs
- CVE-2001-0499Buffer overflow in Transparent Network Substrate (TNS) Listener in Oracle 8i 8.1.7 and earlier allows remote attackers to gain privileges vi
- CVE-2018-6000An issue was discovered in AsusWRT before 3.0.0.4.384_10007.
- CVE-2006-5478Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e F
- CVE-2014-0322Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving
- CVE-2019-20361There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the data
- CVE-2023-40498LG Simple Editor cp Command Directory Traversal Remote Code Execution VulnerabilityLG Simple Editor
- CVE-2022-41142This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.Centreon
- CVE-2009-2335WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists,
- CVE-2020-36221An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resultopenldap