CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-02, highest first.
- CVE-2016-10073The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent mes
- CVE-2024-32651Server Side Template Injection in Jinja2 allows Remote Command Executiondgtlmoon changedetection.io · changedetection-io
- CVE-2008-3257Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allow
- CVE-2023-23074Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.
- CVE-2023-50719XWiki Platform Solr search discloses password hashes of all usersxwiki-platform · org.xwiki.platform:xwiki-platform-search-s…
- CVE-2019-0193In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whiApache Solr · org.apache.solr:solr-core
- CVE-2022-29081Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-contro
- CVE-2007-4560clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metachar
- CVE-2010-2075UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modificat
- CVE-2016-5195Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect ha
- CVE-2012-1889Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitra
- CVE-2014-1511Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypa
- CVE-2022-26923Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2005-1790Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of servic
- CVE-2023-36847Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary filesJuniper Networks Junos OS
- CVE-2009-2288statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) T
- CVE-2022-36981This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101.Ivanti Avalanche
- CVE-2019-9512Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of servicestdlib · golang.org/x/net
- CVE-2023-22232Adobe Connect Improper Access Control Security feature bypassAdobe Connect
- CVE-2001-1583lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request with a crafted control
- CVE-2014-7863The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 1
- CVE-2010-1871JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for
- CVE-2019-1935Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials VulnerabilityCisco Unified Computing System Director
- CVE-2009-3733Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.
- CVE-2011-4885PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allo
- CVE-2024-2653CVE-2024-2653amphp/http-client · amphp/http
- CVE-2014-0050MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attaccommons-fileupload:commons-fileupload · org.apache.tomcat:t…
- CVE-2016-10174The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html.
- CVE-2021-2400Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).Oracle BI Publisher
- CVE-2016-0792Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary codeorg.jenkins-ci.main:jenkins-core
- CVE-2021-29441Authentication bypassalibaba nacos · com.alibaba.nacos:nacos-common
- CVE-2024-10915D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionD-Link DNS-320 · D-Link DNS-320LW +2
- CVE-2014-9034wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers
- CVE-2020-7246A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier.
- CVE-2021-25094Tatsu < 3.3.12 - Unauthenticated RCETatsu
- CVE-2009-3953The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remot
- CVE-2025-14847Zlib compressed protocol header length confusion may allow memory readMongoDB Server
- CVE-2012-5958Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Device
- CVE-2021-28482Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Micro… +1
- CVE-2015-3090Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR
- CVE-2021-42392The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.h2database h2 · com.h2database:h2
- CVE-2022-24990TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/a
- CVE-2023-49785NextChat vulnerable to Server-Side Request Forgery and Cross-site ScriptingChatGPTNextWeb NextChat · nextchat
- CVE-2010-3765Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x bef
- CVE-2023-40502LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion VulnerabilityLG Simple Editor
- CVE-2020-7980Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.c
- CVE-2011-2921ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can resktsuss
- CVE-2024-10400Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filterthemeum Tutor LMS – eLearning and online course solution
- CVE-2022-42904Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.
- CVE-2021-27358The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remotgithub.com/grafana/grafana