CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-03, highest first.
- CVE-2021-37350Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.
- CVE-2024-28156Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored…Jenkins Project Jenkins Build Monitor View Plugin · org.jen…
- CVE-2020-13947An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the…Apache ActiveMQ · org.apache.activemq:activemq-parent
- CVE-2016-4977When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the…Pivotal Spring Security OAuth · org.springframework.securit…
- CVE-2023-3486PaperCut NG Unauthenticated File UploadPaperCut NG
- CVE-2023-20889Aria Operations for Networks contains an information disclosure vulnerability.Aria Operations for Networks
- CVE-2024-42327SQL injection in user.get APIZabbix
- CVE-2005-1921Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc)…
- CVE-2016-8740The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not…Apache Software Foundation Apache HTTP Server
- CVE-2014-9295Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet…
- CVE-2018-18809TIBCO JasperReports Library Directory Traversal VulnerabilityTIBCO Software TIBCO JasperReports Library · TIBCO Softw… +2
- CVE-2014-9016The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal…
- CVE-2020-8821An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint.
- CVE-2022-23944Apache ShenYu 2.4.1 Improper access controlApache Software Foundation Apache ShenYu · org.apache.sheny…
- CVE-2021-33256A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an…
- CVE-2009-3548The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default…
- CVE-2018-17553An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8…
- CVE-2009-3843HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote…
- CVE-2015-7709The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass…
- CVE-2021-23124[20210102] - Core - XSS in mod_breadcrumbs aria-label attributeJoomla! Project Joomla! CMS
- CVE-2014-6034Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine…
- CVE-2018-0769Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the…Microsoft Edge
- CVE-2022-21279Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2018-10662An issue was discovered in multiple models of Axis IP Cameras.
- CVE-2013-3346Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a
- CVE-2000-0302Microsoft Index Server allows remote attackers to view the source code of ASP files by appending a %20 to the filename in the…
- CVE-2022-25305WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IPWP Statistics
- CVE-2025-4901D-Link DI-7003GV2 HTTP Endpoint state_view.data sub_41E304 information disclosureD-Link DI-7003GV2
- CVE-2013-0074Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which
- CVE-2019-1622Cisco Data Center Network Manager Information Disclosure VulnerabilityCisco Data Center Network Manager
- CVE-2022-21489Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2017-17692Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted…
- CVE-2012-4792Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web
- CVE-2018-7890A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640).
- CVE-2021-24931Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL InjectionSecure Copy Content Protection and Content Locking
- CVE-2023-50721XWiki Platform RCE from account through SearchAdminxwiki-platform · org.xwiki.platform:xwiki-platform-search-ui
- CVE-2020-6418Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2013-2730Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute…
- CVE-2021-20039Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote…SonicWall SMA100
- CVE-2015-0015Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of…
- CVE-2015-1868The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth)…
- CVE-2014-3791Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 6.8 allows remote attackers to execute arbitrary code via a long string…
- CVE-2012-5088Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers…
- CVE-2019-15954An issue was discovered in Total.js CMS 12.0.0.total4
- CVE-2023-38545This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.curl
- CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACELinux Kernel
- CVE-2006-0027Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1)…
- CVE-2017-3737OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism.OpenSSL Software Foundation OpenSSL
- CVE-2010-0022The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista…
- CVE-2000-0917Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands.