CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-03, highest first.
- CVE-2022-40770Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection.
- CVE-2003-0344Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash)…
- CVE-2025-34300Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCESawtooth Software Lighthouse Studio
- CVE-2024-2054Artica Proxy Unauthenticated PHP Deserialization VulnerabilityArtica Tech Artica Proxy
- CVE-2017-8779rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC…
- CVE-2021-30128Unsafe deserialization in Apache OFBizApache Software Foundation Apache OFBiz
- CVE-2003-0719Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft…
- CVE-2023-24488Cross site scriptingCitrix ADC and Citrix Gateway
- CVE-2017-10974Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080.
- CVE-2015-3827The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the…
- CVE-2016-8870The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when…
- CVE-2014-9195Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical FunctionPhoenix Contact ProConOs · Phoenix Contact MultiProg
- CVE-2021-31955Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2019-1003002A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in…Jenkins project Pipeline: Declarative Plugin · org.jenkinsc…
- CVE-2023-36932In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and…
- CVE-2011-0923The client in HP Data Protector does not properly validate EXEC_CMD arguments, which allows remote attackers to execute arbitrary Perl…
- CVE-2019-17602An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089.
- CVE-2013-4212Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL…
- CVE-2014-7862The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create…
- CVE-2024-43468Microsoft Configuration Manager Remote Code Execution VulnerabilityMicrosoft Configuration Manager
- CVE-2019-9621Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3
- CVE-2024-53675An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in…Hewlett Packard Enterprise (HPE) HPE Insight Remote Support
- CVE-2022-31704The vRealize Log Insight contains a broken access control vulnerability.vRealize Log Insight
- CVE-2017-0262Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly Microsoft Office
- CVE-2016-7255The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012
- CVE-2016-5734phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the…phpmyadmin/phpmyadmin
- CVE-2021-38540Apache Airflow: Variable Import endpoint missed authentication checkApache Software Foundation Apache Airflow · apache-airflow
- CVE-2022-25148WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_idWP Statistics
- CVE-2024-20419A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote…Cisco Smart Software Manager On-Prem
- CVE-2021-36749Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of…Apache Software Foundation Apache Druid · org.apache.druid:…
- CVE-2005-2535Buffer overflow in the Discovery Service in BrightStor ARCserve Backup 9.0 through 11.1 allows remote attackers to execute arbitrary…
- CVE-2020-7136A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access.Hewlett Packard Enterprise Smart Update Manager
- CVE-2023-50164Apache Struts: File upload component had a directory traversal vulnerabilityApache Software Foundation org.apache.struts · org.apache.s…
- CVE-2010-0094Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23…
- CVE-2018-0758Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the…Microsoft Edge
- CVE-2024-30044Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2017-16666Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded…
- CVE-2007-6203Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a…
- CVE-2010-3552Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to…
- CVE-2016-6433The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute…
- CVE-2019-10669An issue was discovered in LibreNMS through 1.47.
- CVE-2020-13160AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution.
- CVE-2018-12464Unauthenticated SQL injection in Micro Focus Secure Messaging GatewayMicro Focus Secure Messaging Gateway
- CVE-2015-7766PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions…
- CVE-2015-7808The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection…
- CVE-2021-21425Unauthenticated Arbitrary YAML Write/Update leads to Code Executiongetgrav grav-plugin-admin
- CVE-2021-4104Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1
- CVE-2023-27532Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained.Veeam Backup & Replication
- CVE-2024-2876Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injectionicegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2023-5151D-Link DAR-8000 autheditpwd.php sql injectionD-Link DAR-8000