CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-03, highest first.
- CVE-2018-5712An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1.
- CVE-2016-0491Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and…
- CVE-2021-2198Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin).Oracle Knowledge Management
- CVE-2019-4279IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a…IBM WebSphere Application Server
- CVE-2006-4777Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet…
- CVE-2024-47076libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP serverOpenPrinting libcupsfilters
- CVE-2013-6829admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the…
- CVE-2017-13089GNU Wget: stack overflow in HTTP protocol handlingGNU Project Wget
- CVE-2024-8957PTZOptics NDI and SDI Cameras Command Injection via NTP Address ConfigurationPTZOptics PT30X-SDI · PTZOptics PT30X-NDI
- CVE-2021-42362WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File UploadWordPress Popular Posts
- CVE-2013-1331Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data
- CVE-2020-10987The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via t
- CVE-2017-12557A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found.Hewlett Packard Enterprise intelligent Management Center (i…
- CVE-2004-1080The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to…
- CVE-2007-0449Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup…
- CVE-2020-16139A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the device remotely…
- CVE-2012-1495install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.
- CVE-2016-2555SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands…
- CVE-2014-7866Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social…
- CVE-2016-6563D-Link DIR routers contain a stack-based buffer overflow in the HNAP Login actionD-Link DIR-823 · D-Link DIR-822 +7
- CVE-2022-34715Windows Network File System Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2011-4858Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the…org.apache.tomcat:tomcat
- CVE-2023-38408The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if
- CVE-2023-2745WordPress Core < 6.2.1 - Directory TraversalWordPress Foundation WordPress
- CVE-2021-21551Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of serviDell dbutil
- CVE-2026-41089Windows Netlogon Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2021-31250Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due…
- CVE-2017-11512The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the…Zoho ManageEngine ServiceDesk
- CVE-2006-5614Microsoft Windows NAT Helper Components (ipnathlp.dll) on Windows XP SP2, when Internet Connection Sharing is enabled, allows remote…
- CVE-2021-33620Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an…
- CVE-2023-21707Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2022-38421Adobe ColdFusion Application Server Directory Traversal Remote Code Execution VulnerabilityAdobe ColdFusion
- CVE-2021-41288Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
- CVE-2025-6204Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025Dassault Systèmes DELMIA Apriso
- CVE-2006-3392Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read…
- CVE-2021-21618Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a…Jenkins project Jenkins Repository Connector Plugin · org.j…
- CVE-2026-105133Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authenticationAhsayCBS
- CVE-2013-4810HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow rem
- CVE-2024-2044Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4pgadmin.org pgAdmin · pgadmin4
- CVE-2006-5276Stack-based buffer overflow in the DCE/RPC preprocessor in Snort before 2.6.1.3, and 2.7 before beta 2; and Sourcefire Intrusion Sensor…
- CVE-2008-5499Unspecified vulnerability in Adobe Flash Player for Linux 10.0.12.36, and 9.0.151.0 and earlier, allows remote attackers to execute…
- CVE-2006-5143Multiple buffer overflows in CA BrightStor ARCserve Backup r11.5 SP1 and earlier, r11.1, and 9.01; BrightStor ARCserve Backup for Windows…
- CVE-2022-21490Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2022-21972Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2020-13957Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used…Apache Solr · org.apache.solr:solr-parent +2
- CVE-2014-4872BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files…
- CVE-2021-21402Unauthenticated Arbitrary File Access in Jellyfinjellyfin
- CVE-2022-2487WAVLINK WN535K2/WN535K3 nightled.cgi os command injectionWAVLINK WN535K2 · WAVLINK WN535K3
- CVE-2021-33618Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY…dolibarr/dolibarr
- CVE-2024-8503VICIdial Unauthenticated SQL InjectionVICIdial