CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-02, highest first.
- CVE-2020-36228An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, ropenldap
- CVE-2023-24955Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-28182Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usagenghttp2
- CVE-2006-3439Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including
- CVE-2017-1001000The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before
- CVE-2020-11023Potential XSS vulnerability in jQueryjQuery · jquery-rails +2
- CVE-2003-0772Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a denial of service and possibly execute arbitrary cod
- CVE-2023-32164D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure VulnerabilityD-Link D-View
- CVE-2013-3906GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and
- CVE-2023-41266A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 a
- CVE-2024-20328ClamAV VirusEvent File Processing Command Injection VulnerabilityCisco ClamAV
- CVE-2019-7214SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data.
- CVE-2021-2401Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).Oracle BI Publisher
- CVE-2023-44352Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last versionAdobe ColdFusion
- CVE-2022-38111SolarWinds Platform Deserialization of Untrusted Data VulnerabilitySolarWinds Platform
- CVE-2023-21716Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +6
- CVE-2004-0493The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and p
- CVE-2022-24697Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parametersApache Software Foundation Apache Kylin · org.apache.kyl… +2
- CVE-2019-8449The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an informationAtlassian Jira
- CVE-2023-28343OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timez
- CVE-2002-0649Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote atta
- CVE-2026-81578PaperCut MF/NG: Authentication BypassPaperCut MF/NG
- CVE-2019-10758mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.mongo-express
- CVE-2015-6132Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Win
- CVE-2019-16663An issue was discovered in rConfig 3.9.2.
- CVE-2023-4542D-Link DAR-8000-10 sys1.php os command injectionD-Link DAR-8000-10
- CVE-2020-10923This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 rNETGEAR R6700
- CVE-2007-3925Multiple buffer overflows in the IMAP service (imapd32.exe) in Ipswitch IMail Server 2006 before 2006.21 allow remote authenticated users to
- CVE-2021-21029Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript ExecutionAdobe Magento Commerce · magento/community-edition
- CVE-2005-2278Stack-based buffer overflow in the IMAP daemon (imapd) in MailEnable Professional 1.54 allows remote authenticated users to execute arbitrar
- CVE-2009-0075Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to e
- CVE-2024-28986SolarWinds Web Help Desk Java Deserialization Remote Code Execution VulnerabilitySolarWinds Web Help Desk
- CVE-2003-0201Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG
- CVE-2019-11581There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail aAtlassian Jira Server and Data Center
- CVE-2025-64328FreePBX Administration GUI is Vulnerable to Authenticated Command InjectionFreePBX filestore
- CVE-2020-8656An issue was discovered in EyesOfNetwork 5.3.
- CVE-2024-21762A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortFortinet FortiOS · Fortinet FortiProxy
- CVE-2014-0556Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.2
- CVE-2013-6955webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 al
- CVE-2011-0997dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers t
- CVE-2018-17463Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sGoogle Chrome
- CVE-2017-17105Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind rem
- CVE-2020-28949Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as fildrupal/core · pear/archive_tar
- CVE-2013-3214vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.
- CVE-2023-25690Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxyApache Software Foundation Apache HTTP Server
- CVE-2020-15415On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution v
- CVE-2022-36974This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490.Ivanti Avalanche
- CVE-2023-0921Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2013-2566The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to
- CVE-2015-1830Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 fororg.apache.activemq:activemq-client