CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-03, highest first.
- CVE-2011-5034Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions…org.apache.geronimo:geronimo
- CVE-2009-1185udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by…
- CVE-2010-0805The Tabular Data Control (TDC) ActiveX control in Microsoft Internet Explorer 5.01 SP4, 6 on Windows XP SP2 and SP3, and 6 SP1 allows…
- CVE-2008-4397Directory traversal vulnerability in the RPC interface (asdbapi.dll) in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1…
- CVE-2023-26035ZoneMinder vulnerable to Missing Authorizationzoneminder
- CVE-2013-4123client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a…
- CVE-2021-1499Cisco HyperFlex HX Data Platform File Upload VulnerabilityCisco HyperFlex HX Data Platform
- CVE-2023-5222Viessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded passwordViessmann Vitogate
- CVE-2022-37860The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection…
- CVE-2010-0361Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote…
- CVE-2017-0037Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakMicrosoft Internet Browser
- CVE-2022-38418Adobe ColdFusion Application Server Directory Traversal Remote Code Execution VulnerabilityAdobe ColdFusion
- CVE-2008-0244SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in…
- CVE-2024-23108An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to…Fortinet FortiSIEM
- CVE-2023-23836SolarWinds Platform Deserialization of Untrusted Data VulnerabilitySolarWinds Platform
- CVE-2024-46538A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted…
- CVE-2004-0230TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connectio
- CVE-2003-0349Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft…
- CVE-2007-5365Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd…
- CVE-2024-2653CVE-2024-2653amphp/http-client · amphp/http
- CVE-2012-4969Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attacker
- CVE-2014-3829displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to…
- CVE-2026-45659Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2014-9583common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and…
- CVE-2002-1359Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial…
- CVE-2024-56325Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not requiredApache Software Foundation Apache Pinot · org.apache.pin… +2
- CVE-2015-7387ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute…
- CVE-2023-44353ColdFusion WDDX Deserialization GadgetsAdobe ColdFusion
- CVE-2020-14871Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module).Oracle Solaris Operating System
- CVE-2023-22952In SugarCRM before 12.0.
- CVE-2009-1386ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via…
- CVE-2019-0567A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka…Microsoft Edge · Microsoft ChakraCore +1
- CVE-2004-0790Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP…
- CVE-2024-54003Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS)…Jenkins Project Jenkins Simple Queue Plugin · io.jenkins.pl…
- CVE-2024-4990Unsafe Reflection in base Component class in yiisoft/yii2yiisoft/yii2
- CVE-2022-4223The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities…pgadmin4
- CVE-2023-39143PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files.
- CVE-2022-20705Cisco Small Business RV Series Routers VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2018-12465Remote Code Execution in Micro Focus Secure Messaging GatewayMicro Focus Secure Messaging Gateway
- CVE-2025-32969org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST APIxwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…
- CVE-2006-3677Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain…
- CVE-2016-7201The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memMicrosoft.ChakraCore
- CVE-2021-4191An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2.GitLab
- CVE-2022-37024Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29…
- CVE-2023-40176SXSS in the user profile via the timezone displayerxwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- CVE-2013-5743Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.
- CVE-2000-0246IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote…
- CVE-2016-4553client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which…
- CVE-2006-4691Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and…
- CVE-2019-11600A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands…