Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,474 vulnerabilities · highest exploit probability first
- CVE-2006-5780High 7.5Stack-based buffer overflow in nfsd.exe in XLink Omni-NFS Server 5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet to port 2049 (nfsd), as demonstrated by vd_xlink.pm.xlink technology · omni-nfs serverEPSS63%2 exploitsPublished Nov 7, 2006
- CVE-2006-5745High 7.6Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote attackers to execute arbitrary code via crafted arguments that lead to memory…microsoft · xml core servicesEPSS78%4 exploitsPublished Nov 6, 2006
- CVE-2006-5478High 7.5Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow remote attackers to execute arbitrary code via (1) a long HTTP Host header, which triggers an overflow in the BuildRedirectURL…novell · edirectoryEPSS85%5 exploitsPublished Oct 24, 2006
- CVE-2006-5444High 7.5Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer…digium · asteriskEPSS86%1 exploitPublished Oct 23, 2006
- CVE-2006-5143High 7.5Multiple buffer overflows in CA BrightStor ARCserve Backup r11.5 SP1 and earlier, r11.1, and 9.01; BrightStor ARCserve Backup for Windows r11; BrightStor Enterprise Backup 10.5; Server Protection Suite r2; and Business Protection Suite r2 allow remote attackers to execute…broadcom · brightstor arcserve backupEPSS80%5 exploitsPublished Oct 10, 2006
- CVE-2006-5216High 7.5Stack-based buffer overflow in Sergey Lyubka Simple HTTPD (shttpd) 1.34 allows remote attackers to execute arbitrary code via a long URI.sergey lyubka · simple httpdEPSS64%2 exploitsPublished Oct 10, 2006
- CVE-2006-5112High 7.5Buffer overflow in InterVations NaviCOPA Web Server 2.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.intervations · navicopa web serverEPSS67%3 exploitsPublished Oct 3, 2006
- CVE-2006-4948High 7.5Stack-based buffer overflow in tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a long file name.prosysinfo · tftp server tftpdwinEPSS55%4 exploitsPublished Sep 22, 2006
- CVE-2006-4777High 7.6Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer 6.0 SP1, on Chinese and possibly other Windows distributions, allows remote attackers to execute arbitrary code via unknown manipulations…microsoft · ieEPSS80%3 exploitsPublished Sep 13, 2006
- CVE-2006-4379High 7.5Stack-based buffer overflow in the SMTP Daemon in Ipswitch Collaboration 2006 Suite Premium and Standard Editions, IMail, IMail Plus, and IMail Secure allows remote attackers to execute arbitrary code via a long string located after an '@' character and before a ':' character.ipswitch · imail plusEPSS61%3 exploitsPublished Sep 8, 2006
- CVE-2006-4602High 7.5Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP code via a filepath parameter that contains a filename with a .php extension, which is uploaded to the img/wiki/ directory.tiki · tikiwiki cms\/groupwareEPSS44%2 exploitsPublished Sep 6, 2006
- CVE-2006-3459High 7.5Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count…libtiff · libtiffEPSS54%8 exploitsPublished Aug 3, 2006
- CVE-2006-3952High 7.5Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrary code via a long argument to the PASS command.efs software · efs ftp serverEPSS67%5 exploitsPublished Aug 1, 2006
- CVE-2006-3942High 7.8The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL…microsoft · windows 2000EPSS75%1 exploitPublished Jul 31, 2006
- CVE-2006-3747High 7.6Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly…apache · http serverEPSS97%5 exploitsPublished Jul 28, 2006
- CVE-2006-3677High 7.5Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (window.navigator) that are accessed when Java starts up, which causes a crash that leads to code…mozilla · firefoxEPSS79%4 exploitsPublished Jul 26, 2006
- CVE-2006-3730High 8.8Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, which leads to an invalid memory…microsoft · internet explorerEPSS64%5 exploitsPublished Jul 21, 2006
- CVE-2006-3524High 7.5Buffer overflow in SIPfoundry sipXtapi released before 20060324 allows remote attackers to execute arbitrary code via a long CSeq field value in an INVITE message.sipfoundry · sipxtapiEPSS68%7 exploitsPublished Jul 11, 2006
- CVE-2006-1314High 7.5Heap-based buffer overflow in the Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to execute arbitrary code via crafted first-class Mailslot messages that triggers memory corruption…microsoft · windows 2000EPSS61%1 exploitPublished Jul 11, 2006
- CVE-2006-3280High 7.5Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that…microsoft · internet explorerEPSS56%1 exploitPublished Jun 28, 2006
- CVE-2006-3252High 7.5Buffer overflow in the Online Registration Facility for Algorithmic Research PrivateWire VPN software up to 3.7 allows remote attackers to execute arbitrary code via a long GET request.algorithmic research · privatewire gatewayEPSS62%3 exploitsPublished Jun 27, 2006
- CVE-2006-2370High 7.5Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the…microsoft · windows 2000EPSS70%6 exploitsPublished Jun 13, 2006
- CVE-2006-2961High 7.5Stack-based buffer overflow in CesarFTP 0.99g and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long MKD command.aclogic · cesarftpEPSS62%4 exploitsPublished Jun 12, 2006
- CVE-2006-2926High 7.5Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long URL HTTP request.qbik · wingateEPSS71%3 exploitsPublished Jun 9, 2006
- CVE-2006-2407High 7.5Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in other products including (2) FreeSSHd 1.0.9 and (3) freeFTPd 1.0.10, allows remote attackers to execute arbitrary code via a long key exchange algorithm string.freeftpd · freeftpdEPSS71%5 exploitsPublished May 16, 2006
- CVE-2006-2369High 7.5RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not…vnc · realvncEPSS92%4 exploitsPublished May 15, 2006
- CVE-2006-0027High 7.5Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties.microsoft · exchange serverEPSS79%·Published May 9, 2006
- CVE-2006-2086High 7.5Buffer overflow in JuniperSetupDLL.dll, loaded from JuniperSetup.ocx by the Juniper SSL-VPN Client when accessing a Juniper NetScreen IVE device running IVE OS before 4.2r8.1, 5.0 before 5.0r6.1, 5.1 before 5.1r8, 5.2 before 5.2r4.1, or 5.3 before 5.3r2.1, allows remote…juniper · junipersetup controlEPSS68%2 exploitsPublished Apr 29, 2006
- CVE-2006-1551High 7.5Eval injection vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via the (1) $method and (2) $args parameters.georges auberger · pajaxEPSS51%2 exploitsPublished Apr 13, 2006
- CVE-2006-1185High 7.5Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption.microsoft · internet explorerEPSS70%1 exploitPublished Apr 11, 2006
- CVE-2006-1188High 7.5Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption.microsoft · internet explorerEPSS58%1 exploitPublished Apr 11, 2006
- CVE-2006-1388High 7.5Unspecified vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to execute HTA files via unknown vectors.microsoft · internet explorerEPSS55%1 exploitPublished Mar 24, 2006
- CVE-2006-1364High 7.5Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several…microsoft · asp.netEPSS59%1 exploitPublished Mar 23, 2006
- CVE-2006-1245High 7.5Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via an HTML tag with a large number of script action handlers such as onload and onmouseover, as demonstrated using onclick,…microsoft · ieEPSS62%2 exploitsPublished Mar 16, 2006
- CVE-2006-1148High 7.5Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbitrary code via an HTTP GET request with a long (1) parameter name or (2) value in a URL, which triggers the overflow in the…peercast · peercastEPSS73%5 exploitsPublished Mar 10, 2006
- CVE-2006-1016High 7.5Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0, when used on Windows 2000 before SP4 or Windows XP before SP1, allows remote attackers to execute arbitrary code via JavaScript that calls IsComponentInstalled with a long first argument.microsoft · internet explorerEPSS67%2 exploitsPublished Mar 6, 2006
- CVE-2006-0988High 7.8The default configuration of the DNS Server service on Windows Server 2003 and Windows 2000, and the Microsoft DNS Server service on Windows NT 4.0, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers…microsoft · windows 2000EPSS60%·Published Mar 3, 2006
- CVE-2006-0900High 7.8nfsd in FreeBSD 6.0 kernel allows remote attackers to cause a denial of service via a crafted NFS mount request, as demonstrated by the ProtoVer NFS test suite.freebsd · freebsdEPSS65%1 exploitPublished Feb 27, 2006
- CVE-2006-0460High 7.5Multiple buffer overflows in BomberClone before 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages.bomberclone · bombercloneEPSS68%3 exploitsPublished Feb 17, 2006
- CVE-2006-0021High 7.8Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability."microsoft · windows xpEPSS63%1 exploitPublished Feb 14, 2006
- CVE-2006-0564High 7.5Stack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0, and possibly earlier versions, and as included in the Microsoft HTML Help 1.4 SDK, allows context-dependent attackers to execute arbitrary code via a .hhp file with a long Contents file field.microsoft · html helpEPSS72%10 exploitsPublished Feb 6, 2006
- CVE-2006-0476High 7.6Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field).nullsoft · winampEPSS75%4 exploitsPublished Jan 31, 2006
- CVE-2006-0441High 7.5Stack-based buffer overflow in Sami FTP Server 2.0.1 allows remote attackers to execute arbitrary code via a long USER command, which triggers the overflow when the log is viewed.karjasoft · sami ftp serverEPSS71%8 exploitsPublished Jan 26, 2006
- CVE-2005-4085High 7.5Buffer overflow in BlueCoat (a) WinProxy before 6.1a and (b) the web console access functionality in ProxyAV before 2.4.2.3 allows remote attackers to execute arbitrary code via a long Host: header.bluecoat · proxyavEPSS66%3 exploitsPublished Dec 31, 2005
- CVE-2005-4560High 7.5The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer…microsoft · windows 2003 serverEPSS86%2 exploitsPublished Dec 28, 2005
- CVE-2005-4267High 7.5Stack-based buffer overflow in Qualcomm WorldMail 3.0 allows remote attackers to execute arbitrary code via a long IMAP command that ends with a "}" character, as demonstrated using long (1) LIST, (2) LSUB, (3) SEARCH TEXT, (4) STATUS INBOX, (5) AUTHENTICATE, (6) FETCH, (7)…qualcomm · worldmailEPSS67%3 exploitsPublished Dec 21, 2005
- CVE-2005-4411High 7.5Buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long request to TCP port 105.david harris · mercury mail transport systemEPSS65%2 exploitsPublished Dec 20, 2005
- CVE-2005-4360High 7.8The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value…microsoft · internet information servicesEPSS87%2 exploitsPublished Dec 19, 2005
- CVE-2005-2123High 7.5Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based…microsoft · windows 2000EPSS61%1 exploitPublished Nov 29, 2005
- CVE-2005-2124High 7.6Unspecified vulnerability in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1, related to "An unchecked buffer" and possibly buffer overflows, allows remote attackers to execute arbitrary code via a crafted Windows Metafile (WMF)…microsoft · windows 2000EPSS56%2 exploitsPublished Nov 29, 2005
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2006-5780 | Stack-based buffer overflow in nfsd.exe in XLink Omni-NFS Server 5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet to port 2049 (nfsd), as demonstrated by vd_xlink.pm. xlink technology · omni-nfs server | High 7.5 | 63% | 2 exploits | |
| CVE-2006-5745 | Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote attackers to execute arbitrary code via crafted arguments that lead to memory… microsoft · xml core services | High 7.6 | 78% | 4 exploits | |
| CVE-2006-5478 | Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow remote attackers to execute arbitrary code via (1) a long HTTP Host header, which triggers an overflow in the BuildRedirectURL… novell · edirectory | High 7.5 | 85% | 5 exploits | |
| CVE-2006-5444 | Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer… digium · asterisk | High 7.5 | 86% | 1 exploit | |
| CVE-2006-5143 | Multiple buffer overflows in CA BrightStor ARCserve Backup r11.5 SP1 and earlier, r11.1, and 9.01; BrightStor ARCserve Backup for Windows r11; BrightStor Enterprise Backup 10.5; Server Protection Suite r2; and Business Protection Suite r2 allow remote attackers to execute… broadcom · brightstor arcserve backup | High 7.5 | 80% | 5 exploits | |
| CVE-2006-5216 | Stack-based buffer overflow in Sergey Lyubka Simple HTTPD (shttpd) 1.34 allows remote attackers to execute arbitrary code via a long URI. sergey lyubka · simple httpd | High 7.5 | 64% | 2 exploits | |
| CVE-2006-5112 | Buffer overflow in InterVations NaviCOPA Web Server 2.01 allows remote attackers to execute arbitrary code via a long HTTP GET request. intervations · navicopa web server | High 7.5 | 67% | 3 exploits | |
| CVE-2006-4948 | Stack-based buffer overflow in tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a long file name. prosysinfo · tftp server tftpdwin | High 7.5 | 55% | 4 exploits | |
| CVE-2006-4777 | Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer 6.0 SP1, on Chinese and possibly other Windows distributions, allows remote attackers to execute arbitrary code via unknown manipulations… microsoft · ie | High 7.6 | 80% | 3 exploits | |
| CVE-2006-4379 | Stack-based buffer overflow in the SMTP Daemon in Ipswitch Collaboration 2006 Suite Premium and Standard Editions, IMail, IMail Plus, and IMail Secure allows remote attackers to execute arbitrary code via a long string located after an '@' character and before a ':' character. ipswitch · imail plus | High 7.5 | 61% | 3 exploits | |
| CVE-2006-4602 | Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP code via a filepath parameter that contains a filename with a .php extension, which is uploaded to the img/wiki/ directory. tiki · tikiwiki cms\/groupware | High 7.5 | 44% | 2 exploits | |
| CVE-2006-3459 | Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count… libtiff · libtiff | High 7.5 | 54% | 8 exploits | |
| CVE-2006-3952 | Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrary code via a long argument to the PASS command. efs software · efs ftp server | High 7.5 | 67% | 5 exploits | |
| CVE-2006-3942 | The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL… microsoft · windows 2000 | High 7.8 | 75% | 1 exploit | |
| CVE-2006-3747 | Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly… apache · http server | High 7.6 | 97% | 5 exploits | |
| CVE-2006-3677 | Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (window.navigator) that are accessed when Java starts up, which causes a crash that leads to code… mozilla · firefox | High 7.5 | 79% | 4 exploits | |
| CVE-2006-3730 | Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, which leads to an invalid memory… microsoft · internet explorer | High 8.8 | 64% | 5 exploits | |
| CVE-2006-3524 | Buffer overflow in SIPfoundry sipXtapi released before 20060324 allows remote attackers to execute arbitrary code via a long CSeq field value in an INVITE message. sipfoundry · sipxtapi | High 7.5 | 68% | 7 exploits | |
| CVE-2006-1314 | Heap-based buffer overflow in the Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to execute arbitrary code via crafted first-class Mailslot messages that triggers memory corruption… microsoft · windows 2000 | High 7.5 | 61% | 1 exploit | |
| CVE-2006-3280 | Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that… microsoft · internet explorer | High 7.5 | 56% | 1 exploit | |
| CVE-2006-3252 | Buffer overflow in the Online Registration Facility for Algorithmic Research PrivateWire VPN software up to 3.7 allows remote attackers to execute arbitrary code via a long GET request. algorithmic research · privatewire gateway | High 7.5 | 62% | 3 exploits | |
| CVE-2006-2370 | Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the… microsoft · windows 2000 | High 7.5 | 70% | 6 exploits | |
| CVE-2006-2961 | Stack-based buffer overflow in CesarFTP 0.99g and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long MKD command. aclogic · cesarftp | High 7.5 | 62% | 4 exploits | |
| CVE-2006-2926 | Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long URL HTTP request. qbik · wingate | High 7.5 | 71% | 3 exploits | |
| CVE-2006-2407 | Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in other products including (2) FreeSSHd 1.0.9 and (3) freeFTPd 1.0.10, allows remote attackers to execute arbitrary code via a long key exchange algorithm string. freeftpd · freeftpd | High 7.5 | 71% | 5 exploits | |
| CVE-2006-2369 | RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not… vnc · realvnc | High 7.5 | 92% | 4 exploits | |
| CVE-2006-0027 | Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties. microsoft · exchange server | High 7.5 | 79% | · | |
| CVE-2006-2086 | Buffer overflow in JuniperSetupDLL.dll, loaded from JuniperSetup.ocx by the Juniper SSL-VPN Client when accessing a Juniper NetScreen IVE device running IVE OS before 4.2r8.1, 5.0 before 5.0r6.1, 5.1 before 5.1r8, 5.2 before 5.2r4.1, or 5.3 before 5.3r2.1, allows remote… juniper · junipersetup control | High 7.5 | 68% | 2 exploits | |
| CVE-2006-1551 | Eval injection vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via the (1) $method and (2) $args parameters. georges auberger · pajax | High 7.5 | 51% | 2 exploits | |
| CVE-2006-1185 | Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption. microsoft · internet explorer | High 7.5 | 70% | 1 exploit | |
| CVE-2006-1188 | Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption. microsoft · internet explorer | High 7.5 | 58% | 1 exploit | |
| CVE-2006-1388 | Unspecified vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to execute HTA files via unknown vectors. microsoft · internet explorer | High 7.5 | 55% | 1 exploit | |
| CVE-2006-1364 | Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several… microsoft · asp.net | High 7.5 | 59% | 1 exploit | |
| CVE-2006-1245 | Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via an HTML tag with a large number of script action handlers such as onload and onmouseover, as demonstrated using onclick,… microsoft · ie | High 7.5 | 62% | 2 exploits | |
| CVE-2006-1148 | Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbitrary code via an HTTP GET request with a long (1) parameter name or (2) value in a URL, which triggers the overflow in the… peercast · peercast | High 7.5 | 73% | 5 exploits | |
| CVE-2006-1016 | Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0, when used on Windows 2000 before SP4 or Windows XP before SP1, allows remote attackers to execute arbitrary code via JavaScript that calls IsComponentInstalled with a long first argument. microsoft · internet explorer | High 7.5 | 67% | 2 exploits | |
| CVE-2006-0988 | The default configuration of the DNS Server service on Windows Server 2003 and Windows 2000, and the Microsoft DNS Server service on Windows NT 4.0, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers… microsoft · windows 2000 | High 7.8 | 60% | · | |
| CVE-2006-0900 | nfsd in FreeBSD 6.0 kernel allows remote attackers to cause a denial of service via a crafted NFS mount request, as demonstrated by the ProtoVer NFS test suite. freebsd · freebsd | High 7.8 | 65% | 1 exploit | |
| CVE-2006-0460 | Multiple buffer overflows in BomberClone before 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages. bomberclone · bomberclone | High 7.5 | 68% | 3 exploits | |
| CVE-2006-0021 | Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability." microsoft · windows xp | High 7.8 | 63% | 1 exploit | |
| CVE-2006-0564 | Stack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0, and possibly earlier versions, and as included in the Microsoft HTML Help 1.4 SDK, allows context-dependent attackers to execute arbitrary code via a .hhp file with a long Contents file field. microsoft · html help | High 7.5 | 72% | 10 exploits | |
| CVE-2006-0476 | Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field). nullsoft · winamp | High 7.6 | 75% | 4 exploits | |
| CVE-2006-0441 | Stack-based buffer overflow in Sami FTP Server 2.0.1 allows remote attackers to execute arbitrary code via a long USER command, which triggers the overflow when the log is viewed. karjasoft · sami ftp server | High 7.5 | 71% | 8 exploits | |
| CVE-2005-4085 | Buffer overflow in BlueCoat (a) WinProxy before 6.1a and (b) the web console access functionality in ProxyAV before 2.4.2.3 allows remote attackers to execute arbitrary code via a long Host: header. bluecoat · proxyav | High 7.5 | 66% | 3 exploits | |
| CVE-2005-4560 | The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer… microsoft · windows 2003 server | High 7.5 | 86% | 2 exploits | |
| CVE-2005-4267 | Stack-based buffer overflow in Qualcomm WorldMail 3.0 allows remote attackers to execute arbitrary code via a long IMAP command that ends with a "}" character, as demonstrated using long (1) LIST, (2) LSUB, (3) SEARCH TEXT, (4) STATUS INBOX, (5) AUTHENTICATE, (6) FETCH, (7)… qualcomm · worldmail | High 7.5 | 67% | 3 exploits | |
| CVE-2005-4411 | Buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long request to TCP port 105. david harris · mercury mail transport system | High 7.5 | 65% | 2 exploits | |
| CVE-2005-4360 | The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value… microsoft · internet information services | High 7.8 | 87% | 2 exploits | |
| CVE-2005-2123 | Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based… microsoft · windows 2000 | High 7.5 | 61% | 1 exploit | |
| CVE-2005-2124 | Unspecified vulnerability in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1, related to "An unchecked buffer" and possibly buffer overflows, allows remote attackers to execute arbitrary code via a crafted Windows Metafile (WMF)… microsoft · windows 2000 | High 7.6 | 56% | 2 exploits |
Showing 1,301–1,350 of 1,474
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.