Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2017-8895Critical 9.8In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution.veritas · backup execEPSS71%2 exploitsPublished May 10, 2017
- CVE-2017-7925Critical 9.8A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3,…dahuasecurity · dh-hcvr4xxx firmwareEPSS51%·Published May 5, 2017
- CVE-2017-6553Critical 9.8Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the policy server via an ACT_ALERT_EVENT request that causes memory corruption in the pmmasterd daemon.quest · privilege manager for unixEPSS42%2 exploitsPublished Apr 29, 2017
- CVE-2016-1560Critical 9.8ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session.exagrid · ex10000e firmwareEPSS72%3 exploitsPublished Apr 21, 2017
- CVE-2016-2555Critical 9.8SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.atutor · atutorEPSS80%3 exploitsPublished Apr 13, 2017
- CVE-2016-7552Critical 9.8On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root.trendmicro · threat discovery applianceEPSS93%2 exploitsPublished Apr 12, 2017
- CVE-2016-7547Critical 9.8A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.cgi interface.trendmicro · threat discovery applianceEPSS93%2 exploitsPublished Apr 12, 2017
- CVE-2017-6361Critical 9.8QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.qnap · qtsEPSS57%1 exploitPublished Mar 23, 2017
- CVE-2017-6360Critical 9.8QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors.qnap · qtsEPSS66%1 exploitPublished Mar 23, 2017
- CVE-2017-6465Critical 9.8Remote Code Execution was discovered in FTPShell Client 6.53.ftpshell · ftpshell clientEPSS50%4 exploitsPublished Mar 9, 2017
- CVE-2017-6526Critical 9.8dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests).dnatools · dnalimsEPSS57%2 exploitsPublished Mar 9, 2017
- CVE-2017-6187Critical 9.8Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary code via a long URI in a GET request.disksavvy · disksavvy enterpriseEPSS33%3 exploitsPublished Feb 22, 2017
- CVE-2016-10134Critical 9.8SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.zabbix · zabbixEPSS83%·Published Feb 17, 2017
- CVE-2016-10176Critical 9.8The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device.netgear · wnr2000v5 firmwareEPSS77%1 exploitPublished Jan 30, 2017
- CVE-2016-10175Critical 9.8The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI.netgear · wnr2000v5 firmwareEPSS66%1 exploitPublished Jan 30, 2017
- CVE-2017-3248Critical 9.8Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS97%2 exploitsPublished Jan 27, 2017
- CVE-2016-6603Critical 9.8ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.zohocorp · webnms frameworkEPSS87%4 exploitsPublished Jan 23, 2017
- CVE-2016-6602Critical 9.8ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml.zohocorp · webnms frameworkEPSS56%4 exploitsPublished Jan 23, 2017
- CVE-2016-6600Critical 9.8Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a ..zohocorp · webnms frameworkEPSS91%5 exploitsPublished Jan 23, 2017
- CVE-2016-4010Critical 9.8Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.magento · magentoEPSS93%4 exploitsPublished Jan 23, 2017
- CVE-2016-10108Critical 9.8Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.western digital · mycloud nasEPSS98%1 exploitPublished Jan 3, 2017
- CVE-2016-7456Critical 9.8VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attackers to obtain login access via an SSH session.vmware · vsphere data protectionEPSS33%1 exploitPublished Dec 29, 2016
- CVE-2016-8869Critical 9.8The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla!joomla · joomla\!EPSS97%2 exploitsPublished Nov 4, 2016
- CVE-2016-8582Critical 9.8A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.alienvault · open source security information and event managementEPSS57%2 exploitsPublished Oct 28, 2016
- CVE-2016-6309Critical 9.8statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session.openssl · opensslEPSS70%·Published Sep 26, 2016
- CVE-2016-6662Critical 9.8mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)mariadb · mariadbEPSS68%2 exploitsPublished Sep 20, 2016
- CVE-2016-5675Critical 9.8handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.netgear · readynas surveillanceEPSS71%2 exploitsPublished Aug 31, 2016
- CVE-2016-5674Critical 9.8debugging_center_utils_.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.netgear · readynas surveillanceEPSS95%2 exploitsPublished Aug 31, 2016
- CVE-2016-6195Critical 9.8SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via the postids parameter to forumrunner/request.php, as exploited in the wild in…vbulletin · vbulletinEPSS68%1 exploitPublished Aug 30, 2016
- CVE-2016-3510Critical 9.8Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability…oracle · weblogic serverEPSS91%1 exploitPublished Jul 21, 2016
- CVE-2016-3236Critical 9.8The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles proxy discovery, which allows…microsoft · windows 10EPSS77%·Published Jun 15, 2016
- CVE-2016-2296Critical 9.4Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.meteocontrol · web\'log basic 100EPSS64%1 exploitPublished May 14, 2016
- CVE-2016-4350Critical 9.8Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storage Manager (STM)) before 6.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) ScriptSchedule parameter in the…solarwinds · storage resource monitorEPSS70%·Published May 9, 2016
- CVE-2016-2108Critical 9.8The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.openssl · opensslEPSS78%·Published May 5, 2016
- CVE-2016-3078Critical 9.8php: Heap overflow caused by integer overflow when reading zip files in ZipArchivephp · phpEPSS56%2 exploitsPublished Apr 28, 2016
- CVE-2016-2004Critical 9.8HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication.hp · data protectorEPSS94%6 exploitsPublished Apr 21, 2016
- CVE-2016-0638Critical 9.8Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.oracle · weblogic serverEPSS63%·Published Apr 21, 2016
- CVE-2016-2345Critical 9.8Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code via a crafted string.dameware · mini remote controlEPSS51%1 exploitPublished Mar 17, 2016
- CVE-2016-1524Critical 9.6Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via…netgear · prosafe network management software 300EPSS94%1 exploitPublished Feb 13, 2016
- CVE-2016-1287Critical 9.8Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA 5500 devices, ASA 5500-X…cisco · adaptive security appliance softwareEPSS74%3 exploitsPublished Feb 11, 2016
- CVE-2016-1909Critical 9.8Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access…fortinet · fortiosEPSS71%3 exploitsPublished Jan 15, 2016
- CVE-2016-0854Critical 9.8Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.advantech · webaccessEPSS77%3 exploitsPublished Jan 15, 2016
- CVE-2015-6172Critical 9.3Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted email message processed by Outlook, aka "Microsoft Office RCE Vulnerability."microsoft · officeEPSS54%·Published Dec 9, 2015
- CVE-2015-3628Critical 9.0The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0…f5 · big-ip edge gatewayEPSS69%3 exploitsPublished Dec 7, 2015
- CVE-2015-2342Critical 10.0The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.vmware · vcenter serverEPSS89%2 exploitsPublished Oct 12, 2015
- CVE-2015-7766Critical 9.0PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT//INTO."zohocorp · manageengine opmanagerEPSS81%4 exploitsPublished Oct 9, 2015
- CVE-2015-7765Critical 9.0ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.zohocorp · manageengine opmanagerEPSS67%4 exploitsPublished Oct 9, 2015
- CVE-2015-7709Critical 10.0The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation.arkeia · western digital arkeiaEPSS79%4 exploitsPublished Oct 5, 2015
- CVE-2015-1538Critical 10.0Stagefright — Android libstagefright remote code executiongoogle · androidEPSS99%1 exploitPublished Oct 1, 2015
- CVE-2015-3864Critical 10.0Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759.google · androidEPSS87%4 exploitsPublished Sep 30, 2015
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-8895 | In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution. veritas · backup exec | Critical 9.8 | 71% | 2 exploits | |
| CVE-2017-7925 | A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3,… dahuasecurity · dh-hcvr4xxx firmware | Critical 9.8 | 51% | · | |
| CVE-2017-6553 | Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the policy server via an ACT_ALERT_EVENT request that causes memory corruption in the pmmasterd daemon. quest · privilege manager for unix | Critical 9.8 | 42% | 2 exploits | |
| CVE-2016-1560 | ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session. exagrid · ex10000e firmware | Critical 9.8 | 72% | 3 exploits | |
| CVE-2016-2555 | SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php. atutor · atutor | Critical 9.8 | 80% | 3 exploits | |
| CVE-2016-7552 | On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. trendmicro · threat discovery appliance | Critical 9.8 | 93% | 2 exploits | |
| CVE-2016-7547 | A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.cgi interface. trendmicro · threat discovery appliance | Critical 9.8 | 93% | 2 exploits | |
| CVE-2017-6361 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. qnap · qts | Critical 9.8 | 57% | 1 exploit | |
| CVE-2017-6360 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors. qnap · qts | Critical 9.8 | 66% | 1 exploit | |
| CVE-2017-6465 | Remote Code Execution was discovered in FTPShell Client 6.53. ftpshell · ftpshell client | Critical 9.8 | 50% | 4 exploits | |
| CVE-2017-6526 | dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests). dnatools · dnalims | Critical 9.8 | 57% | 2 exploits | |
| CVE-2017-6187 | Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary code via a long URI in a GET request. disksavvy · disksavvy enterprise | Critical 9.8 | 33% | 3 exploits | |
| CVE-2016-10134 | SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php. zabbix · zabbix | Critical 9.8 | 83% | · | |
| CVE-2016-10176 | The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. netgear · wnr2000v5 firmware | Critical 9.8 | 77% | 1 exploit | |
| CVE-2016-10175 | The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. netgear · wnr2000v5 firmware | Critical 9.8 | 66% | 1 exploit | |
| CVE-2017-3248 | Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. oracle · weblogic server | Critical 9.8 | 97% | 2 exploits | |
| CVE-2016-6603 | ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header. zohocorp · webnms framework | Critical 9.8 | 87% | 4 exploits | |
| CVE-2016-6602 | ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. zohocorp · webnms framework | Critical 9.8 | 56% | 4 exploits | |
| CVE-2016-6600 | Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. zohocorp · webnms framework | Critical 9.8 | 91% | 5 exploits | |
| CVE-2016-4010 | Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data. magento · magento | Critical 9.8 | 93% | 4 exploits | |
| CVE-2016-10108 | Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data. western digital · mycloud nas | Critical 9.8 | 98% | 1 exploit | |
| CVE-2016-7456 | VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attackers to obtain login access via an SSH session. vmware · vsphere data protection | Critical 9.8 | 33% | 1 exploit | |
| CVE-2016-8869 | The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! joomla · joomla\! | Critical 9.8 | 97% | 2 exploits | |
| CVE-2016-8582 | A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE. alienvault · open source security information and event management | Critical 9.8 | 57% | 2 exploits | |
| CVE-2016-6309 | statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session. openssl · openssl | Critical 9.8 | 70% | · | |
| CVE-2016-6662 | mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016) mariadb · mariadb | Critical 9.8 | 68% | 2 exploits | |
| CVE-2016-5675 | handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter. netgear · readynas surveillance | Critical 9.8 | 71% | 2 exploits | |
| CVE-2016-5674 | debugging_center_utils_.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter. netgear · readynas surveillance | Critical 9.8 | 95% | 2 exploits | |
| CVE-2016-6195 | SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via the postids parameter to forumrunner/request.php, as exploited in the wild in… vbulletin · vbulletin | Critical 9.8 | 68% | 1 exploit | |
| CVE-2016-3510 | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability… oracle · weblogic server | Critical 9.8 | 91% | 1 exploit | |
| CVE-2016-3236 | The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles proxy discovery, which allows… microsoft · windows 10 | Critical 9.8 | 77% | · | |
| CVE-2016-2296 | Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors. meteocontrol · web\'log basic 100 | Critical 9.4 | 64% | 1 exploit | |
| CVE-2016-4350 | Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storage Manager (STM)) before 6.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) ScriptSchedule parameter in the… solarwinds · storage resource monitor | Critical 9.8 | 70% | · | |
| CVE-2016-2108 | The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. openssl · openssl | Critical 9.8 | 78% | · | |
| CVE-2016-3078 | php: Heap overflow caused by integer overflow when reading zip files in ZipArchive php · php | Critical 9.8 | 56% | 2 exploits | |
| CVE-2016-2004 | HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. hp · data protector | Critical 9.8 | 94% | 6 exploits | |
| CVE-2016-0638 | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service. oracle · weblogic server | Critical 9.8 | 63% | · | |
| CVE-2016-2345 | Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code via a crafted string. dameware · mini remote control | Critical 9.8 | 51% | 1 exploit | |
| CVE-2016-1524 | Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via… netgear · prosafe network management software 300 | Critical 9.6 | 94% | 1 exploit | |
| CVE-2016-1287 | Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA 5500 devices, ASA 5500-X… cisco · adaptive security appliance software | Critical 9.8 | 74% | 3 exploits | |
| CVE-2016-1909 | Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access… fortinet · fortios | Critical 9.8 | 71% | 3 exploits | |
| CVE-2016-0854 | Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors. advantech · webaccess | Critical 9.8 | 77% | 3 exploits | |
| CVE-2015-6172 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted email message processed by Outlook, aka "Microsoft Office RCE Vulnerability." microsoft · office | Critical 9.3 | 54% | · | |
| CVE-2015-3628 | The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0… f5 · big-ip edge gateway | Critical 9.0 | 69% | 3 exploits | |
| CVE-2015-2342 | The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol. vmware · vcenter server | Critical 10.0 | 89% | 2 exploits | |
| CVE-2015-7766 | PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT//INTO." zohocorp · manageengine opmanager | Critical 9.0 | 81% | 4 exploits | |
| CVE-2015-7765 | ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password. zohocorp · manageengine opmanager | Critical 9.0 | 67% | 4 exploits | |
| CVE-2015-7709 | The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation. arkeia · western digital arkeia | Critical 10.0 | 79% | 4 exploits | |
| CVE-2015-1538 | Stagefright — Android libstagefright remote code execution google · android | Critical 10.0 | 99% | 1 exploit | |
| CVE-2015-3864 | Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. google · android | Critical 10.0 | 87% | 4 exploits |
Showing 901–950 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.