CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-03, highest first.
- CVE-2003-0714The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory…
- CVE-2013-0634Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before…
- CVE-2006-5745Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0…
- CVE-2016-4054Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side…
- CVE-2020-15148Unsafe deserialization in Yii 2yiisoft yii2 · yiisoft/yii2
- CVE-2022-34176Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site…Jenkins project Jenkins JUnit Plugin · org.jenkins-ci.plugi…
- CVE-2020-10808Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint.
- CVE-2016-0709Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote…org.apache.portals.jetspeed-2:jetspeed
- CVE-2014-6352Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and
- CVE-2020-11532Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server.
- CVE-2018-1270Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose Spring by Pivotal Spring Framework · org.springframework:sp…
- CVE-2008-2499Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and…
- CVE-2022-25149WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IPWP Statistics
- CVE-2024-1698NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL…wpdevteam NotificationX – FOMO, Live Sales Notification, Wo…
- CVE-2012-1675The TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.0.5, as used in…
- CVE-2016-10176The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the…
- CVE-2017-14143The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote…
- CVE-2023-36824Heap overflow in COMMAND GETKEYS and ACL evaluation in Redisredis
- CVE-2020-8012CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot…CA Technologies - A Broadcom Company CA Unified Infrastruct…
- CVE-2020-9850A logic issue was addressed with improved restrictions.Apple iOS · Apple tvOS +4
- CVE-2021-22883Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with…NodeJS Node
- CVE-2007-2449Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through…org.apache.tomcat:tomcat
- CVE-2019-10692In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names…
- CVE-2022-41080Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2013-3897Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers
- CVE-2018-9059Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code via a malicious…
- CVE-2019-1429A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2023-34192Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted scr
- CVE-2024-8877SQL InjectionRiello Netman
- CVE-2021-42129A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to…Ivanti Avalanche
- CVE-2020-36222A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial openldap
- CVE-2020-36227A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in deopenldap
- CVE-2021-29505XStream is vulnerable to a Remote Command Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2023-27856Rockwell Automation ThinManager ThinServer Path Traversal DownloadRockwell Automation ThinManager ThinServer
- CVE-2014-8741Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote…
- CVE-2007-2508Multiple stack-based buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2 Build 1174 allow remote attackers to…
- CVE-2021-42287Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2022-21449Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).Oracle Java SE JDK and JRE
- CVE-1999-1011The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods…
- CVE-2020-10173Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping…
- CVE-2020-10221lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacte
- CVE-2017-12243A vulnerability in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and…Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Ci…
- CVE-2022-29013A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary…
- CVE-2026-33824Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2013-1080The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for…
- CVE-2016-0854Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer…
- CVE-2019-15949Nagios XI before 5.6.6 allows remote command execution as root.
- CVE-2025-6514OS command injection in mcp-remote when connecting to untrusted MCP serversmcp-remote
- CVE-2020-11853Arbitrary code execution vulnerability on multiple Micro Focus productsMicro Focus Operation Bridge Manager · Micro Focus Appli… +5
- CVE-2007-3236PHP remote file inclusion vulnerability in footer.php in the Horoscope 1.0 module for XOOPS allows remote attackers to execute arbitrary…