CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-04, highest first.
- CVE-2018-14728upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.
- CVE-2023-44221Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrSonicWall SMA100
- CVE-2021-22145A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting.Elasticsearch · org.elasticsearch.client:elasticsearch-rest…
- CVE-2022-34721Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2025-3102SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creationbrainstormforce OttoKit: All-in-One Automation Platform
- CVE-2021-21616Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting…Jenkins project Jenkins Active Choices Plugin · org.biouno:…
- CVE-2024-8504VICIdial Authenticated Remote Code ExecutionVICIdial
- CVE-2025-6389Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callbackSneeit Framework
- CVE-2023-29509org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…
- CVE-2022-2884A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an…GitLab
- CVE-2010-2156ISC DHCP 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1 allows remote attackers to cause a denial of service (server exit) via a zero-length…
- CVE-2023-36745Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Microsof…
- CVE-2007-0042Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows…
- CVE-2022-42424This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.Centreon
- CVE-2022-42425This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.Centreon
- CVE-2022-42427This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.Centreon
- CVE-2022-42429This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.Centreon
- CVE-2021-41303Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypassApache Software Foundation Apache Shiro · org.apache.shiro:…
- CVE-2026-25089A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 thFortinet FortiSandbox
- CVE-2013-1391Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR…
- CVE-2025-29891Apache Camel: Camel Message Header Injection through request parametersApache Software Foundation org.apache.camel:camel · org.apa…
- CVE-2023-4220Chamilo LMS Unauthenticated Big Upload File Remote Code ExecutionChamilo
- CVE-2024-36404GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressionsgeotools · org.geotools:gt-app-schema +2
- CVE-2014-7141The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds…
- CVE-2021-41653The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code…
- CVE-2020-14179Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom…Atlassian Jira Server
- CVE-2023-38836File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type…
- CVE-2021-21668Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability…Jenkins project Jenkins Scriptler Plugin · org.jenkins-ci.p…
- CVE-2002-1142Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and…
- CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-30860An integer overflow was addressed with improved input validation.Apple macOS · Apple watchOS +1
- CVE-2021-21344XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · activemq +1
- CVE-2020-2140Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a…Jenkins project Jenkins Audit Trail Plugin · org.jenkins-ci…
- CVE-2022-26937Windows Network File System Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2013-5486Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before…
- CVE-2023-32007Apache Spark: Shell command injection via Spark UIApache Software Foundation Apache Spark · pyspark +1
- CVE-2007-4880Buffer overflow in the Client Acceptor Daemon (CAD), dsmcad.exe, in certain IBM Tivoli Storage Manager (TSM) clients 5.1 before 5.1.8.1…
- CVE-2019-1358A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database…Microsoft Windows
- CVE-2007-6388Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2…
- CVE-2018-8065An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24.
- CVE-2024-41730Missing Authentication check in SAP BusinessObjects Business Intelligence PlatformSAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2008-1232Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows…org.apache.tomcat:tomcat
- CVE-2019-1937Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass…Cisco Unified Computing System Director
- CVE-2020-13563A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7.phpGACL
- CVE-2020-13564A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7.phpGACL
- CVE-2022-32429An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch…
- CVE-2023-48085Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.
- CVE-2009-4140Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik…
- CVE-2006-2447SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands…
- CVE-2012-5959Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP…