CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-02, highest first.
- CVE-2024-51567upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and
- CVE-2021-22123An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a rFortinet FortiWeb
- CVE-2020-12641rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration set
- CVE-2013-7285Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run com.thoughtworks.xstream:xstream
- CVE-2023-3388Beautiful Cookie Consent Banner <= 2.10.1 - Unauthenticated Stored Cross-Site Scriptingnikelschubert Beautiful Cookie Consent Banner
- CVE-2025-47916Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php.invisioncommunity Invision Power Board
- CVE-2019-12257Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component.
- CVE-2018-17246Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin.Elastic Kibana
- CVE-2020-5722The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request.Grandstream UCM6200 Series
- CVE-2024-43451NTLM Hash Disclosure Spoofing VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2017-0213Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2Microsoft Windows COM
- CVE-2010-3563Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect
- CVE-2024-38077Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-38112Windows MSHTML Platform Spoofing VulnerabilityMicrosoft Windows
- CVE-2021-25080Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site ScriptingContact Form Entries – Contact Form 7, WPforms and more
- CVE-2014-6037Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows
- CVE-2025-40551SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilitySolarWinds Web Help Desk
- CVE-2015-2857Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oaut
- CVE-2017-11317Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which a
- CVE-2021-21224Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftGoogle Chrome
- CVE-2024-12856Four-Faith Industrial Router adjust_sys_time OS Command InjectionFour-Faith F3x24 · Four-Faith F3x36
- CVE-2024-6782Calibre Remote Code ExecutionCalibre
- CVE-2021-24155Backup Guard < 1.6.0 - Authenticated Arbitrary File UploadWordPress Backup and Migrate Plugin – Backup Guard
- CVE-2020-25681A flaw was found in dnsmasq before version 2.83.dnsmasq
- CVE-2018-17552SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.
- CVE-2009-3129Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Offic
- CVE-2023-28128An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker tAvalanche
- CVE-2023-28432Minio Information Disclosure in Cluster Deploymentminio
- CVE-2015-3035Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0)
- CVE-2022-28368Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (withdompdf/dompdf
- CVE-2023-48022Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API.ray
- CVE-2022-30690A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2021-3781A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted ghostscript
- CVE-2018-17431Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL.
- CVE-2005-3252Stack-based buffer overflow in the Back Orifice (BO) preprocessor for Snort before 2.4.3 allows remote attackers to execute arbitrary code v
- CVE-2023-29325Windows OLE Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2009-2265Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary dire
- CVE-2020-10879rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is pas
- CVE-2020-3161Cisco IP Phones Web Server Remote Code Execution and Denial of Service VulnerabilityCisco IP phone
- CVE-2021-23174WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityWPChill Download Monitor
- CVE-2019-12314Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cg
- CVE-2021-38294Shell Command Injection Vulnerability in Nimbus Thrift ServerApache Software Foundation Apache Storm · org.apache.storm:…
- CVE-2007-2175Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to exe
- CVE-2019-1620Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution VulnerabilityCisco Data Center Network Manager
- CVE-2024-49113Windows Lightweight Directory Access Protocol (LDAP) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2019-9874Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to
- CVE-2023-50386Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2022-2753Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Stored XSSKetchup Restaurant Reservations
- CVE-2008-6508Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to byp
- CVE-2016-0701The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for