CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-03, highest first.
- CVE-2023-46263An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker…Ivanti Avalanche
- CVE-2009-4324Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before
- CVE-2016-3087Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote…org.apache.struts:struts2-core
- CVE-2019-7254Linear eMerge E3-Series devices allow File Inclusion.
- CVE-2004-0597Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via…
- CVE-2022-20615Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions…Jenkins project Jenkins Matrix Project Plugin · org.jenkins…
- CVE-2022-45402Apache Airflow: Open redirect during loginApache Software Foundation Apache Airflow · apache-airflow
- CVE-2022-32214The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP…NodeJS Node · llhttp
- CVE-2021-20034An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete…SonicWall SMA100
- CVE-2021-25114Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL InjectionPaid Memberships Pro
- CVE-2023-2915Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityRockwell Automation ThinManager ThinServer
- CVE-2018-10660An issue was discovered in multiple models of Axis IP Cameras.
- CVE-2020-26258Server-Side Forgery Request can be activated unmarshalling with XStreamx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2020-9315* PRODUCT NOT SUPPORTED WHEN ASSIGNED * Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the…
- CVE-2023-43177CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
- CVE-2004-1172Stack-based buffer overflow in the Agent Browser in Veritas Backup Exec 8.x before 8.60.3878 Hotfix 68, and 9.x before 9.1.4691 Hotfix 40…
- CVE-2025-34026Versa Concerto Actuator Authentication Bypass Information LeakVersa Concerto
- CVE-2026-105134Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectionAhsayCBS
- CVE-2015-7871Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
- CVE-2022-34169Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheetsApache Software Foundation Apache Xalan-J · xalan:xalan
- CVE-2022-34783Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability…Jenkins project Jenkins Plot Plugin · org.jenkins-ci.plugin…
- CVE-2020-27868This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395.Qognify Ocularis
- CVE-2012-2763Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13…
- CVE-2023-34992A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to…Fortinet FortiSIEM
- CVE-2018-13382An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 tFortinet FortiOS, FortiProxy
- CVE-2014-8516Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a…
- CVE-2020-8864This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and…D-Link Multiple Routers
- CVE-2019-0752A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2021-26411Internet Explorer Memory Corruption VulnerabilityMicrosoft Internet Explorer · Microsoft Edge
- CVE-2010-3971Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used…
- CVE-2014-4114Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and
- CVE-2007-0774Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web…
- CVE-2021-42125An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service…Ivanti Avalance
- CVE-2024-23478SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code ExecutionSolarWinds Access Rights Manager
- CVE-2019-9513Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
- CVE-2023-31099Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.
- CVE-2022-36958SolarWinds Platform Deserialization of Untrusted DataSolarWinds Platform · SolarWinds Orion Platform
- CVE-2020-9294An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow…Fortinet FortiMail · Fortinet FortiVoiceEnterprise
- CVE-2024-5806MOVEit Transfer Authentication Bypass VulnerabilityProgress MOVEit Transfer
- CVE-2019-10092In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page.Apache HTTP Server
- CVE-2023-32031Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Microsof…
- CVE-2016-2098Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary…actionpack
- CVE-2018-5955An issue was discovered in GitStack through 2.3.10.
- CVE-2021-21628Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site…Jenkins project Jenkins Build With Parameters Plugin · org.…
- CVE-2017-0290The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2…Microsoft Malware Protection Engine
- CVE-2021-35216Deserialization of Untrusted Data in Resource Controls Remote Code ExecutionSolarWinds Patch Manager
- CVE-2010-2883Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows
- CVE-2021-2456Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General).Oracle Business Intelligence Enterprise Edition
- CVE-2021-33543UDP Technology/Geutebrück camera devices: Authentication BypassGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2017-11826Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, WoMicrosoft Office