CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-04, highest first.
- CVE-2023-22047Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).Oracle PeopleSoft Enterprise PT PeopleTools
- CVE-2011-5227Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows…
- CVE-2018-1000049Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner API.
- CVE-2022-1179Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemropenemr/openemr
- CVE-2024-23334aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversalaio-libs aiohttp · aiohttp
- CVE-2022-41800Appliance mode iControl REST vulnerabilityF5 BIG-IP
- CVE-2006-5779OpenLDAP before 2.3.29 allows remote attackers to cause a denial of service (daemon crash) via LDAP BIND requests with long authcid names…
- CVE-2020-13638lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation.
- CVE-2021-29156ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol.
- CVE-2024-5932GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Executionstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2003-0190OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist…
- CVE-2018-15877The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the…
- CVE-2017-9101import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header…
- CVE-2017-9554An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote…
- CVE-2023-36899ASP.NET Elevation of Privilege VulnerabilityMicrosoft .NET Framework 2.0 Service Pack · Microsoft .N… +1
- CVE-2009-2685Stack-based buffer overflow in the login form in the management web server in HP Power Manager allows remote attackers to execute…
- CVE-2010-3600Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager…
- CVE-2012-1440The ELF file parser in Norman Antivirus 6.06.12, eSafe 7.0.17.0, CA eTrust Vet Antivirus 36.1.8511, Fortinet Antivirus 4.2.254.0, and…
- CVE-2021-39843Adobe Acrobat Reader XObject Out-of-Bound Write VulnerabilityAdobe Acrobat Reader
- CVE-2007-5423tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter…
- CVE-2022-2185A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1…GitLab
- CVE-2019-7238Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
- CVE-2021-35478Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function.
- CVE-2024-22120Time Based SQL Injection in Zabbix Server Audit LogZabbix
- CVE-2022-45699Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute…
- CVE-2005-3081wzdftpd 0.5.4 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the SITE command.
- CVE-2020-13965An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5.
- CVE-2022-44267ImageMagick 7.1.0-49 is vulnerable to Denial of Service.
- CVE-2008-0015Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneReques
- CVE-2018-15133In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potelaravel/framework
- CVE-2000-0649IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected…
- CVE-2014-3936Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev.
- CVE-2022-21280Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2018-12710An issue was discovered on D-Link DIR-601 2.02NA devices.
- CVE-2021-38406Delta Electronics DOPSoft 2 Out-of-Bounds WriteDelta Electronics DOPSoft
- CVE-2021-35218Chart Endpoint Deserialization of Untrusted Data Remote Code Execution VulnerabilitySolarWinds Patch Manager
- CVE-2011-3556Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update…
- CVE-2024-22319IBM Operational Decision Manager JDNI injectionIBM Operational Decision Manager
- CVE-2022-38053Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2013-0229The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a…
- CVE-2021-2394Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2021-21346XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · activemq +1
- CVE-2009-1979Unspecified vulnerability in the Network Authentication component in Oracle Database 10.1.0.5 and 10.2.0.4 allows remote attackers to…
- CVE-2022-36099XWiki Platform Wiki UI Main Wiki Eval Injection vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-platform-wiki-ui-…
- CVE-2023-5631Stored XSS vulnerability in RoundcubeRoundcubemail
- CVE-2013-0081Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned…
- CVE-2020-35951An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress.
- CVE-2010-4417Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, and…
- CVE-2018-15811DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.DotNetNuke.Core
- CVE-2014-5073vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell…