CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-03, highest first.
- CVE-2003-0822Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote…
- CVE-2020-3992OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a VMware ESXi
- CVE-2024-31984XWiki Platform: Remote code execution through space title and Solr space facetxwiki-platform · org.xwiki.platform:xwiki-platform-search-s…
- CVE-2021-25216A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackISC BIND9
- CVE-2018-17254The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.
- CVE-2019-14470cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the…cosenary/instagram
- CVE-2023-26469In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
- CVE-2018-16763FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter.
- CVE-2009-4006Stack-based buffer overflow in the TEA decoding algorithm in RhinoSoft Serv-U FTP server 7.0.0.1, 9.0.0.5, and other versions before…
- CVE-2016-0041Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT…
- CVE-2019-0539A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka…Microsoft Edge · Microsoft ChakraCore +1
- CVE-2024-42009A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of
- CVE-2021-27561Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authenticati
- CVE-2023-46262An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche…Ivanti Avalanche
- CVE-2022-28732Apache JSPWiki Cross-site scripting vulnerability on WeblogPluginApache Software Foundation Apache JSPWiki · org.apache.jspw…
- CVE-2019-1619Cisco Data Center Network Manager Authentication Bypass VulnerabilityCisco Data Center Network Manager
- CVE-2019-9514Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of servicestdlib · golang.org/x/net
- CVE-2021-26030[20210401] - Core - Escape xss in logo parameter error pagesJoomla! Project Joomla! CMS
- CVE-2006-0003Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in…
- CVE-2016-7200The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memMicrosoft.ChakraCore
- CVE-2005-0356Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote…
- CVE-2019-8942WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an…
- CVE-2020-2230Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored…Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2014-4511Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a…
- CVE-2015-8605ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application…
- CVE-2020-26217Remote Code Execution in XStreamx-stream xstream · activemq +1
- CVE-2024-0769D-Link DIR-859 HTTP POST Request hedwig.cgi path traversalD-Link DIR-859
- CVE-2019-7194This external control of file name or path vulnerability allows remote attackers to access or modify system files.QNAP NAS devices running Photo Station
- CVE-2025-33073Windows SMB Client Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41291ECOA BAS controller - Path Traversal-1ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2015-1187The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.c
- CVE-2014-1776Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial
- CVE-2026-111497Out-of-Bounds Write in Google Brotli DecoderGoogle Brotli · node +6
- CVE-2025-49844Redis Lua Use-After-Free may lead to remote code executionredis
- CVE-2022-1292The c_rehash script allows command injectionOpenSSL
- CVE-2024-9464Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential DisclosurePalo Alto Networks Expedition
- CVE-2017-5817A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.Hewlett Packard Enterprise Intelligent Management Center (i…
- CVE-2025-58434Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account TakeoverFlowiseAI Flowise · flowise
- CVE-2021-23758Deserialization of Untrusted DataAjaxPro.2 · AjaxNetProfessional
- CVE-2010-1297Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3,
- CVE-2009-2765httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute…
- CVE-2019-13372/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute…
- CVE-2020-8163The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument…https://github.com/rails/rails · actionview
- CVE-2017-9828'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which…
- CVE-2013-3861Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash…
- CVE-2018-16042Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and…
- CVE-2011-0276HP OpenView Performance Insight Server 5.2, 5.3, 5.31, 5.4, and 5.41 contains a "hidden account" in the…
- CVE-2022-36980This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490.Ivanti Avalanche
- CVE-2020-26259XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshallingx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2023-21931Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server