CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-03, highest first.
- CVE-2016-0742The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer…
- CVE-2021-28164In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e…The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2020-17505Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php.
- CVE-2024-44000WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerabilityLiteSpeed Technologies LiteSpeed Cache
- CVE-2017-2741A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D.HP PageWide Printers; HP OfficeJet Pro Printers
- CVE-2020-27955Git LFS 2.12.0 allows Remote Code Execution.github.com/git-lfs/git-lfs
- CVE-2018-9995TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR…
- CVE-2021-26120Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.smarty/smarty
- CVE-2023-44412D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure VulnerabilityD-Link D-View
- CVE-2021-44224Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlierApache Software Foundation Apache HTTP Server
- CVE-2023-20888Aria Operations for Networks contains an authenticated deserialization vulnerability.Aria Operations for Networks
- CVE-2009-2521Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote…
- CVE-2023-27992The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versZyxel NAS326 firmware · Zyxel NAS540 firmware +1
- CVE-2016-10134SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the…
- CVE-2011-2140Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1…
- CVE-2021-34996This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.Commvault CommCell
- CVE-2007-1036The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote…
- CVE-2020-9465An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3.
- CVE-2003-0818Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and…
- CVE-2010-0806Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote at
- CVE-2017-0038gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows…Microsoft Windows Graphics Component
- CVE-2024-10924Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication BypassReally Simple Plugins Really Simple Security Pro multisi… +1
- CVE-2014-1510The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before…
- CVE-2012-0053protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request…
- CVE-2017-17090An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified…
- CVE-2023-48646Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings.
- CVE-2026-88771A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commandsCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2018-6789An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1.
- CVE-2021-21351XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · activemq +1
- CVE-2023-25762Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet…Jenkins Project Jenkins Pipeline: Build Step Plugin · org.j…
- CVE-2016-0800The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify…
- CVE-2021-35392Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols.
- CVE-2015-6922Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not…
- CVE-2023-30253Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in…dolibarr/dolibarr
- CVE-2022-44690Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2003-0812Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute…
- CVE-2023-38096NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass VulnerabilityNETGEAR ProSAFE Network Management System
- CVE-2023-36469Code injection through NotificationRSSService in XWiki Platformxwiki-platform · org.xwiki.platform:xwiki-platform-notifica…
- CVE-2022-1175Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all…GitLab
- CVE-2018-0886The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1…Microsoft Windows
- CVE-2023-40492LG Simple Editor deleteCheckSession Directory Traversal Arbitrary File Deletion VulnerabilityLG Simple Editor
- CVE-2023-40494LG Simple Editor deleteFolder Directory Traversal Arbitrary File Deletion VulnerabilityLG Simple Editor
- CVE-2014-8440Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR…
- CVE-2021-40449Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-35578An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0.
- CVE-2023-1698WAGO: WBM Command Injection in multiple productsWAGO Compact Controller CC100 · WAGO Edge Controller +5
- CVE-2016-10372The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP…
- CVE-2009-2526Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows…
- CVE-2020-7200A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6.HPE Systems Insight Manager
- CVE-2015-6128Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allows local users to…