Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,474 vulnerabilities · highest exploit probability first
- CVE-2012-5159High 7.5phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack.phpmyadmin · phpmyadminEPSS75%2 exploitsPublished Sep 25, 2012
- CVE-2012-0209High 7.5Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers…horde · groupwareEPSS72%2 exploitsPublished Sep 25, 2012
- CVE-2012-4869High 7.5The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action.sangoma · freepbxEPSS70%5 exploitsPublished Sep 6, 2012
- CVE-2012-3579High 7.9Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session.symantec · messaging gatewayEPSS40%2 exploitsPublished Aug 29, 2012
- CVE-2012-4361High 7.7lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter.hp · san\/iqEPSS48%5 exploitsPublished Aug 20, 2012
- CVE-2012-3951High 7.5The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session.sonicwall · scrutinizerEPSS52%2 exploitsPublished Jul 31, 2012
- CVE-2012-2957High 7.2The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows local users to gain privileges by modifying files, related to a "file inclusion" issue.symantec · web gatewayEPSS59%1 exploitPublished Jul 23, 2012
- CVE-2012-2763High 7.5Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.gimp · gimpEPSS82%3 exploitsPublished Jul 12, 2012
- CVE-2012-3399High 7.5Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.artis.imag · basilicEPSS65%3 exploitsPublished Jul 12, 2012
- CVE-2012-1493High 7.8F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers'…f5 · enterprise managerEPSS63%3 exploitsPublished Jul 9, 2012
- CVE-2009-0695High 7.5hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.dell · wyse device managerEPSS69%4 exploitsPublished Jun 19, 2012
- CVE-2012-0217High 7.2The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta…citrix · xenserverEPSS40%4 exploitsPublished Jun 12, 2012
- CVE-2012-1675High 7.5The TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.0.5, as used in Oracle Fusion Middleware, Enterprise Manager, E-Business Suite, and possibly other products, allows remote attackers to execute arbitrary…oracle · database serverEPSS77%·Published May 8, 2012
- CVE-2012-0549High 7.5Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confidentiality, integrity, and availability, related to Desktop API.oracle · supply chain products suiteEPSS59%2 exploitsPublished May 3, 2012
- CVE-2012-2311High 7.5php: incomplete CVE-2012-1823 fix - incorrect check for =php · phpEPSS69%4 exploitsPublished May 3, 2012
- CVE-2012-1195High 7.5Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a…landesk · lenovo thinkmanagement consoleEPSS69%3 exploitsPublished Feb 17, 2012
- CVE-2012-0003High 8.1Unspecified vulnerability in winmm.dll in Windows Multimedia Library in Windows Media Player (WMP) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows remote attackers to execute arbitrary code via a crafted MIDI file, aka "MIDI Remote…microsoft · windows xpEPSS70%2 exploitsPublished Jan 10, 2012
- CVE-2011-3414High 7.8The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions…microsoft · windows 7EPSS58%·Published Dec 29, 2011
- CVE-2011-4166High 7.5Directory traversal vulnerability in the MPAUploader.Uploader.1.UploadFiles method in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data.hp · managed printing administrationEPSS58%2 exploitsPublished Dec 27, 2011
- CVE-2011-4453High 7.5The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP create_function function.pmwiki · pmwikiEPSS52%5 exploitsPublished Dec 22, 2011
- CVE-2011-3658High 7.5Mozilla: Multiple security flaws fixed in v3.6.25 (Mac) and v9mozilla · firefoxEPSS70%2 exploitsPublished Dec 20, 2011
- CVE-2011-4828High 7.5Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/.autosectools · v-cmsEPSS65%2 exploitsPublished Dec 15, 2011
- CVE-2011-4825High 7.5Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into…phpletter · ajax file and image managerEPSS39%7 exploitsPublished Dec 15, 2011
- CVE-2011-4542High 7.5Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action to the default URI.hastymail · hastymail2EPSS24%2 exploitsPublished Nov 30, 2011
- CVE-2011-4075High 7.5The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.phpldapadmin project · phpldapadminEPSS52%4 exploitsPublished Nov 2, 2011
- CVE-2011-3556High 7.5OpenJDK: RMI DGC server remote code execution (RMI, 7077466)oracle · jrockitEPSS76%2 exploitsPublished Oct 18, 2011
- CVE-2011-2763High 7.5The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) and 4.7.18 allows remote attackers to execute arbitrary commands via a modified request to the LSRoom_Remoting.doCommand function in gateway.php.lifesize · lifesize room appliance softwareEPSS36%3 exploitsPublished Sep 2, 2011
- CVE-2011-3192High 7.8The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in…apache · http serverEPSS99%3 exploitsPublished Aug 29, 2011
- CVE-2011-2404High 7.5A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-4786 and…hp · easy printer care softwareEPSS74%2 exploitsPublished Aug 11, 2011
- CVE-2011-1774High 8.8WebKit in Apple Safari before 5.0.6 has improper libxslt security settings, which allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via a crafted web site.apple · safariEPSS43%2 exploitsPublished Jul 21, 2011
- CVE-2011-2039High 7.6The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to…cisco · anyconnect secure mobility clientEPSS70%2 exploitsPublished Jun 2, 2011
- CVE-2011-0997High 7.5dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is…isc · dhcpEPSS85%·Published Apr 8, 2011
- CVE-2010-4417High 7.5Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, and 2.0.1.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.oracle · beehiveEPSS76%2 exploitsPublished Jan 19, 2011
- CVE-2010-3600High 7.5Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager Grid Control 10.2.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.oracle · database serverEPSS77%2 exploitsPublished Jan 19, 2011
- CVE-2011-0404High 7.5Stack-based buffer overflow in NetSupport Manager Agent for Linux 11.00, for Solaris 9.50, and for Mac OS X 11.00 allows remote attackers to execute arbitrary code via a long control hostname to TCP port 5405, probably a different vulnerability than CVE-2007-5252.netsupport · netsupport manager agentEPSS65%4 exploitsPublished Jan 11, 2011
- CVE-2010-3964High 7.5Unrestricted file upload vulnerability in the Document Conversions Launcher Service in Microsoft Office SharePoint Server 2007 SP2, when the Document Conversions Load Balancer Service is enabled, allows remote attackers to execute arbitrary code via a crafted SOAP request to TCP…microsoft · sharepoint serverEPSS94%2 exploitsPublished Dec 16, 2010
- CVE-2010-3338High 7.2The Windows Task Scheduler in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly determine the security context of scheduled tasks, which allows local users to gain privileges via a crafted application, aka "Task Scheduler…microsoft · windows 7EPSS23%3 exploitsPublished Dec 16, 2010
- CVE-2010-3229High 7.1The Secure Channel (aka SChannel) security package in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when IIS 7.x is used, does not properly process client certificates during SSL and TLS handshakes, which allows remote attackers to…microsoft · windows 7EPSS50%·Published Oct 13, 2010
- CVE-2010-2551High 7.8The SMB Server in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate an internal variable in an SMB packet, which allows remote attackers to cause a denial of service (system hang) via a crafted (1) SMBv1 or (2)…microsoft · windows 7EPSS67%·Published Aug 11, 2010
- CVE-2010-1892High 7.8The TCP/IP stack in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly handle malformed IPv6 packets, which allows remote attackers to cause a denial of service (system hang) via multiple crafted packets, aka "IPv6 Memory…microsoft · windows 7EPSS62%·Published Aug 11, 2010
- CVE-2010-2063High 7.5Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in process.c in smbd in Samba 3.0.x before 3.3.13 allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted…samba · sambaEPSS79%2 exploitsPublished Jun 17, 2010
- CVE-2010-1964High 7.5Buffer overflow in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unspecified parameters to jovgraph.exe, aka ZDI-CAN-683.hp · openview network node managerEPSS66%4 exploitsPublished Jun 17, 2010
- CVE-2010-2309High 7.5Buffer overflow in the web server for EvoLogical EvoCam 3.6.6 and 3.6.7 allows remote attackers to execute arbitrary code via a long GET request.evological · evocamEPSS51%6 exploitsPublished Jun 16, 2010
- CVE-2010-2075High 7.5UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modification (Trojan Horse) in the DEBUG3_DOLOG_SYSTEM macro, which allows remote attackers to execute arbitrary commands.unrealircd · unrealircdEPSS84%3 exploitsPublished Jun 15, 2010
- CVE-2010-1681High 7.6Buffer overflow in VISIODWG.DLL before 10.0.6880.4 in Microsoft Office Visio allows user-assisted remote attackers to execute arbitrary code via a crafted DXF file, a different vulnerability than CVE-2010-0254 and CVE-2010-0256.microsoft · visioEPSS67%3 exploitsPublished May 6, 2010
- CVE-2009-2936High 7.5The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code…varnish.projects.linpro · varnishEPSS64%1 exploitPublished Apr 5, 2010
- CVE-2010-0842High 7.5Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.sun · jdkEPSS78%2 exploitsPublished Apr 1, 2010
- CVE-2010-0094High 7.5Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.sun · jdkEPSS81%2 exploitsPublished Apr 1, 2010
- CVE-2010-0258High 7.8Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly…microsoft · excelEPSS61%·Published Mar 10, 2010
- CVE-2010-0483High 7.6vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote attackers to execute arbitrary code by referencing a (1) local pathname, (2) UNC share pathname, or (3)…microsoft · windows 2000EPSS87%3 exploitsPublished Mar 3, 2010
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-5159 | phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack. phpmyadmin · phpmyadmin | High 7.5 | 75% | 2 exploits | |
| CVE-2012-0209 | Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers… horde · groupware | High 7.5 | 72% | 2 exploits | |
| CVE-2012-4869 | The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action. sangoma · freepbx | High 7.5 | 70% | 5 exploits | |
| CVE-2012-3579 | Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session. symantec · messaging gateway | High 7.9 | 40% | 2 exploits | |
| CVE-2012-4361 | lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter. hp · san\/iq | High 7.7 | 48% | 5 exploits | |
| CVE-2012-3951 | The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session. sonicwall · scrutinizer | High 7.5 | 52% | 2 exploits | |
| CVE-2012-2957 | The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows local users to gain privileges by modifying files, related to a "file inclusion" issue. symantec · web gateway | High 7.2 | 59% | 1 exploit | |
| CVE-2012-2763 | Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server. gimp · gimp | High 7.5 | 82% | 3 exploits | |
| CVE-2012-3399 | Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter. artis.imag · basilic | High 7.5 | 65% | 3 exploits | |
| CVE-2012-1493 | F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers'… f5 · enterprise manager | High 7.8 | 63% | 3 exploits | |
| CVE-2009-0695 | hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action. dell · wyse device manager | High 7.5 | 69% | 4 exploits | |
| CVE-2012-0217 | The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta… citrix · xenserver | High 7.2 | 40% | 4 exploits | |
| CVE-2012-1675 | The TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.0.5, as used in Oracle Fusion Middleware, Enterprise Manager, E-Business Suite, and possibly other products, allows remote attackers to execute arbitrary… oracle · database server | High 7.5 | 77% | · | |
| CVE-2012-0549 | Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confidentiality, integrity, and availability, related to Desktop API. oracle · supply chain products suite | High 7.5 | 59% | 2 exploits | |
| CVE-2012-2311 | php: incomplete CVE-2012-1823 fix - incorrect check for = php · php | High 7.5 | 69% | 4 exploits | |
| CVE-2012-1195 | Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a… landesk · lenovo thinkmanagement console | High 7.5 | 69% | 3 exploits | |
| CVE-2012-0003 | Unspecified vulnerability in winmm.dll in Windows Multimedia Library in Windows Media Player (WMP) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows remote attackers to execute arbitrary code via a crafted MIDI file, aka "MIDI Remote… microsoft · windows xp | High 8.1 | 70% | 2 exploits | |
| CVE-2011-3414 | The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions… microsoft · windows 7 | High 7.8 | 58% | · | |
| CVE-2011-4166 | Directory traversal vulnerability in the MPAUploader.Uploader.1.UploadFiles method in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data. hp · managed printing administration | High 7.5 | 58% | 2 exploits | |
| CVE-2011-4453 | The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP create_function function. pmwiki · pmwiki | High 7.5 | 52% | 5 exploits | |
| CVE-2011-3658 | Mozilla: Multiple security flaws fixed in v3.6.25 (Mac) and v9 mozilla · firefox | High 7.5 | 70% | 2 exploits | |
| CVE-2011-4828 | Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/. autosectools · v-cms | High 7.5 | 65% | 2 exploits | |
| CVE-2011-4825 | Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into… phpletter · ajax file and image manager | High 7.5 | 39% | 7 exploits | |
| CVE-2011-4542 | Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action to the default URI. hastymail · hastymail2 | High 7.5 | 24% | 2 exploits | |
| CVE-2011-4075 | The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011. phpldapadmin project · phpldapadmin | High 7.5 | 52% | 4 exploits | |
| CVE-2011-3556 | OpenJDK: RMI DGC server remote code execution (RMI, 7077466) oracle · jrockit | High 7.5 | 76% | 2 exploits | |
| CVE-2011-2763 | The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) and 4.7.18 allows remote attackers to execute arbitrary commands via a modified request to the LSRoom_Remoting.doCommand function in gateway.php. lifesize · lifesize room appliance software | High 7.5 | 36% | 3 exploits | |
| CVE-2011-3192 | The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in… apache · http server | High 7.8 | 99% | 3 exploits | |
| CVE-2011-2404 | A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-4786 and… hp · easy printer care software | High 7.5 | 74% | 2 exploits | |
| CVE-2011-1774 | WebKit in Apple Safari before 5.0.6 has improper libxslt security settings, which allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via a crafted web site. apple · safari | High 8.8 | 43% | 2 exploits | |
| CVE-2011-2039 | The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to… cisco · anyconnect secure mobility client | High 7.6 | 70% | 2 exploits | |
| CVE-2011-0997 | dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is… isc · dhcp | High 7.5 | 85% | · | |
| CVE-2010-4417 | Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, and 2.0.1.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. oracle · beehive | High 7.5 | 76% | 2 exploits | |
| CVE-2010-3600 | Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager Grid Control 10.2.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. oracle · database server | High 7.5 | 77% | 2 exploits | |
| CVE-2011-0404 | Stack-based buffer overflow in NetSupport Manager Agent for Linux 11.00, for Solaris 9.50, and for Mac OS X 11.00 allows remote attackers to execute arbitrary code via a long control hostname to TCP port 5405, probably a different vulnerability than CVE-2007-5252. netsupport · netsupport manager agent | High 7.5 | 65% | 4 exploits | |
| CVE-2010-3964 | Unrestricted file upload vulnerability in the Document Conversions Launcher Service in Microsoft Office SharePoint Server 2007 SP2, when the Document Conversions Load Balancer Service is enabled, allows remote attackers to execute arbitrary code via a crafted SOAP request to TCP… microsoft · sharepoint server | High 7.5 | 94% | 2 exploits | |
| CVE-2010-3338 | The Windows Task Scheduler in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly determine the security context of scheduled tasks, which allows local users to gain privileges via a crafted application, aka "Task Scheduler… microsoft · windows 7 | High 7.2 | 23% | 3 exploits | |
| CVE-2010-3229 | The Secure Channel (aka SChannel) security package in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when IIS 7.x is used, does not properly process client certificates during SSL and TLS handshakes, which allows remote attackers to… microsoft · windows 7 | High 7.1 | 50% | · | |
| CVE-2010-2551 | The SMB Server in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate an internal variable in an SMB packet, which allows remote attackers to cause a denial of service (system hang) via a crafted (1) SMBv1 or (2)… microsoft · windows 7 | High 7.8 | 67% | · | |
| CVE-2010-1892 | The TCP/IP stack in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly handle malformed IPv6 packets, which allows remote attackers to cause a denial of service (system hang) via multiple crafted packets, aka "IPv6 Memory… microsoft · windows 7 | High 7.8 | 62% | · | |
| CVE-2010-2063 | Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in process.c in smbd in Samba 3.0.x before 3.3.13 allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted… samba · samba | High 7.5 | 79% | 2 exploits | |
| CVE-2010-1964 | Buffer overflow in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unspecified parameters to jovgraph.exe, aka ZDI-CAN-683. hp · openview network node manager | High 7.5 | 66% | 4 exploits | |
| CVE-2010-2309 | Buffer overflow in the web server for EvoLogical EvoCam 3.6.6 and 3.6.7 allows remote attackers to execute arbitrary code via a long GET request. evological · evocam | High 7.5 | 51% | 6 exploits | |
| CVE-2010-2075 | UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modification (Trojan Horse) in the DEBUG3_DOLOG_SYSTEM macro, which allows remote attackers to execute arbitrary commands. unrealircd · unrealircd | High 7.5 | 84% | 3 exploits | |
| CVE-2010-1681 | Buffer overflow in VISIODWG.DLL before 10.0.6880.4 in Microsoft Office Visio allows user-assisted remote attackers to execute arbitrary code via a crafted DXF file, a different vulnerability than CVE-2010-0254 and CVE-2010-0256. microsoft · visio | High 7.6 | 67% | 3 exploits | |
| CVE-2009-2936 | The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code… varnish.projects.linpro · varnish | High 7.5 | 64% | 1 exploit | |
| CVE-2010-0842 | Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. sun · jdk | High 7.5 | 78% | 2 exploits | |
| CVE-2010-0094 | Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. sun · jdk | High 7.5 | 81% | 2 exploits | |
| CVE-2010-0258 | Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly… microsoft · excel | High 7.8 | 61% | · | |
| CVE-2010-0483 | vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote attackers to execute arbitrary code by referencing a (1) local pathname, (2) UNC share pathname, or (3)… microsoft · windows 2000 | High 7.6 | 87% | 3 exploits |
Showing 1,151–1,200 of 1,474
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.