Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2007-2815Critical 10.0The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the…microsoft · internet information servicesEPSS73%1 exploitPublished May 22, 2007
- CVE-2007-1689Critical 10.0Buffer overflow in the ISAlertDataCOM ActiveX control in ISLALERT.DLL for Norton Personal Firewall 2004 and Internet Security 2004 allows remote attackers to execute arbitrary code via long arguments to the (1) Get and (2) Set functions.symantec · norton personal firewallEPSS65%2 exploitsPublished May 16, 2007
- CVE-2007-2711Critical 10.0Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long string to TCP port 113.tinyirc · tinyidentdEPSS63%2 exploitsPublished May 16, 2007
- CVE-2007-2446Critical 10.0Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3)…samba · sambaEPSS78%7 exploitsPublished May 14, 2007
- CVE-2007-2508Critical 10.0Multiple stack-based buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2 Build 1174 allow remote attackers to execute arbitrary code via crafted data to (1) TCP port 5168, which triggers an overflow in the CAgRpcClient::CreateBinding function in the…trend micro · serverprotectEPSS77%5 exploitsPublished May 8, 2007
- CVE-2007-0940Critical 9.3Unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control (CAPICOM.dll) in Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2 allows remote attackers to execute arbitrary code via unspecified vectors, aka the "CAPICOM.Certificates…microsoft · biztalk serverEPSS76%·Published May 8, 2007
- CVE-2007-0213Critical 10.0Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to execute arbitrary code via a crafted base64-encoded MIME e-mail message.microsoft · exchange serverEPSS66%1 exploitPublished May 8, 2007
- CVE-2007-2485Critical 9.8Myflash < 1.11 - Remote File Inclusionruben boelinger · myflashEPSS55%·Published Apr 30, 2007
- CVE-2007-2426Critical 9.8MySliderGallery <= 1.2.1 - Remote File Inclusionwildbits · mygalleryEPSS63%·Published Apr 28, 2007
- CVE-2007-2139Critical 10.0Multiple stack-based buffer overflows in the SUN RPC service in CA (formerly Computer Associates) BrightStor ARCserve Media Server, as used in BrightStor ARCserve Backup 9.01 through 11.5 SP2, BrightStor Enterprise Backup 10.5, Server Protection Suite 2, and Business Protection…broadcom · brightstor arcserve backupEPSS78%2 exploitsPublished Apr 25, 2007
- CVE-2007-2193Critical 9.3Stack-based buffer overflow in the ID_X.apl plugin in ACDSee 9.0 Build 108, Pro 8.1 Build 99, and Photo Editor 4.0 Build 195 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long section string.acd systems · acdseeEPSS37%2 exploitsPublished Apr 24, 2007
- CVE-2007-1674Critical 10.0Stack-based buffer overflow in the Alert Service (aolnsrvr.exe) in LANDesk Management Suite 8.7 allows remote attackers to execute arbitrary code via a crafted packet to port 65535/UDP.landesk · landesk management suiteEPSS73%3 exploitsPublished Apr 18, 2007
- CVE-2007-1748Critical 10.0Stack-based buffer overflow in the RPC interface in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server SP 4, Server 2003 SP 1, and Server 2003 SP 2 allows remote attackers to execute arbitrary code via a long zone name containing character constants…microsoft · windows 2000EPSS78%7 exploitsPublished Apr 13, 2007
- CVE-2007-1559Critical 9.3Multiple stack-based buffer overflows in SonicDVDDashVRNav.dll in Roxio CinePlayer 3.2 allow remote attackers to execute arbitrary code via (1) unspecified long property values to SonicMediaPlayer.dll or (2) long arguments to unspecified methods in SonicMediaPlayer.dll.roxio · cineplayerEPSS32%3 exploitsPublished Apr 11, 2007
- CVE-2007-1868Critical 10.0The management service in IBM Tivoli Provisioning Manager for OS Deployment before 5.1 Fix Pack 2 does not properly handle multipart/form-data in HTTP POST requests, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via crafted…ibm · tivoli provisioning manager os deploymentEPSS59%2 exploitsPublished Apr 4, 2007
- CVE-2007-1819Critical 9.3Stack-based buffer overflow in the SPIDERLib.Loader ActiveX control (Spider90.ocx) 9.1.0.4353 in TestDirector (TD) for Mercury Quality Center 9.0 before Patch 12.1, and 8.2 SP1 before Patch 32, allows remote attackers to execute arbitrary code via a long ProgColor property.hp · mercury quality centerEPSS40%3 exploitsPublished Apr 2, 2007
- CVE-2007-0038Critical 9.3Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI,…microsoft · windows 2000EPSS73%17 exploitsPublished Mar 30, 2007
- CVE-2007-1765Critical 9.3Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and…microsoft · internet explorerEPSS55%12 exploitsPublished Mar 29, 2007
- CVE-2007-1675Critical 10.0Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a denial of service via a long username.ibm · lotus dominoEPSS61%3 exploitsPublished Mar 28, 2007
- CVE-2007-1697Critical 10.0PHP remote file inclusion vulnerability in header.inc.php in Philex 0.2.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CssFile parameter.philex · philexEPSS73%·Published Mar 26, 2007
- CVE-2007-1579Critical 10.0Stack-based buffer overflow in Atrium MERCUR IMAPD allows remote attackers to have an unknown impact via a certain SUBSCRIBE command.atrium software · mercur imapdEPSS57%·Published Mar 21, 2007
- CVE-2007-1567Critical 10.0Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors, as demonstrated by warftp_165.tar by Immunity.war ftp daemon · war ftp daemonEPSS51%3 exploitsPublished Mar 21, 2007
- CVE-2007-0348Critical 9.3Stack-based buffer overflow in the IASystemInfo.dll ActiveX control in (1) InterActual Player 2.60.12.0717, (2) Roxio CinePlayer 3.2, (3) WinDVD 7.0.27.172, and possibly other products, allows remote attackers to execute arbitrary code via a long ApplicationType property.interactual technologies · interactual playerEPSS37%2 exploitsPublished Mar 21, 2007
- CVE-2007-1435Critical 10.0Buffer overflow in D-Link TFTP Server 1.0 allows remote attackers to cause a denial of service (crash) via a long (1) GET or (2) PUT request, which triggers memory corruption.d-link · tftp serverEPSS46%3 exploitsPublished Mar 13, 2007
- CVE-2007-1373Critical 10.0Stack-based buffer overflow in Mercury/32 (aka Mercury Mail Transport System) 4.01b and earlier allows remote attackers to execute arbitrary code via a long LOGIN command.pmail · mercury mail transport systemEPSS60%4 exploitsPublished Mar 9, 2007
- CVE-2007-1070Critical 10.0Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance Filer 5.61 and 5.62, allow remote attackers to execute arbitrary code via crafted RPC requests to TmRpcSrv.dll that trigger overflows when calling the (1)…trend micro · serverprotectEPSS73%3 exploitsPublished Feb 21, 2007
- CVE-2007-0325Critical 9.3Multiple buffer overflows in the Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control in OfficeScanSetupINI.dll, as used in OfficeScan 7.0 before Build 1344, OfficeScan 7.3 before Build 1241, and Client / Server / Messaging Security 3.0 before Build 1197, allow…trend micro · client-server-messaging securityEPSS35%2 exploitsPublished Feb 20, 2007
- CVE-2006-5276Critical 10.0Stack-based buffer overflow in the DCE/RPC preprocessor in Snort before 2.6.1.3, and 2.7 before beta 2; and Sourcefire Intrusion Sensor; allows remote attackers to execute arbitrary code via crafted SMB traffic.snort · snortEPSS79%4 exploitsPublished Feb 19, 2007
- CVE-2007-0217Critical 10.0The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow remote attackers to execute arbitrary code via an FTP server response of a specific length that causes a terminating null byte to be written outside of a buffer, which causes heap corruption.microsoft · internet explorerEPSS58%1 exploitPublished Feb 13, 2007
- CVE-2007-0882Critical 10.0Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts,…oracle · solarisEPSS98%4 exploitsPublished Feb 12, 2007
- CVE-2007-0018Critical 9.3Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll), as used by multiple products, allows remote attackers to execute arbitrary code via a long argument to the SetFormatLikeSample function.americanshareware · mp3 wav converterEPSS36%4 exploitsPublished Jan 24, 2007
- CVE-2007-0449Critical 10.0Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r4.0, Desktop and Business Protection Suite r2, and Desktop Management Suite (DMS) r11.0 and r11.1 allow remote attackers to execute…broadcom · business protection suiteEPSS79%5 exploitsPublished Jan 23, 2007
- CVE-2006-6424Critical 9.0Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IMAP verbs when specifying command continuation requests to IMAPD, resulting in a heap overflow; and (2) via crafted arguments to…novell · netmailEPSS60%2 exploitsPublished Dec 26, 2006
- CVE-2006-6425Critical 9.0Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via unspecified vectors involving the APPEND command.novell · netmailEPSS58%2 exploitsPublished Dec 26, 2006
- CVE-2006-5583Critical 10.0Buffer overflow in the SNMP Service in Microsoft Windows 2000 SP4, XP SP2, Server 2003, Server 2003 SP1, and possibly other versions allows remote attackers to execute arbitrary code via a crafted SNMP packet, aka "SNMP Memory Corruption Vulnerability."microsoft · windows 2003 serverEPSS54%·Published Dec 12, 2006
- CVE-2006-6423Critical 10.0Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command…mailenable · mailenable professionalEPSS71%4 exploitsPublished Dec 12, 2006
- CVE-2006-6183Critical 10.0Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long mode field (aka transporting mode) in a (1) GET or (2) PUT command.3com · 3ctftpsvcEPSS70%6 exploitsPublished Nov 30, 2006
- CVE-2006-6184Critical 10.0Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long filename in a (1) GET or (2) PUT command.alliedtelesyn · at-tftpEPSS66%5 exploitsPublished Nov 30, 2006
- CVE-2006-6076Critical 10.0Buffer overflow in the Tape Engine (tapeeng.exe) in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to execute arbitrary code via certain RPC requests to TCP port 6502.broadcom · brightstor arcserve backupEPSS71%3 exploitsPublished Nov 24, 2006
- CVE-2006-4691Critical 10.0Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to execute arbitrary code via NetrJoinDomain2 RPC messages with a long hostname.microsoft · windows 2000EPSS80%5 exploitsPublished Nov 14, 2006
- CVE-2006-5815Critical 10.0Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit."proftpd project · proftpdEPSS75%3 exploitsPublished Nov 8, 2006
- CVE-2006-5156Critical 10.0Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attackers to execute arbitrary code via a request to /spipe/pkg/ with a long source header.mcafee · epolicy orchestratorEPSS74%3 exploitsPublished Oct 5, 2006
- CVE-2006-4868Critical 9.3Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a…microsoft · internet explorerEPSS61%4 exploitsPublished Sep 19, 2006
- CVE-2006-4305Critical 10.0Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long database name when connecting via a WebDBM client.mysql · maxdbEPSS72%2 exploitsPublished Aug 29, 2006
- CVE-2006-3439Critical 10.0Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including anonymous users, to execute arbitrary code via a crafted RPC message, a different vulnerability than CVE-2006-1314.microsoft · windows 2000EPSS85%6 exploitsPublished Aug 8, 2006
- CVE-2006-3441Critical 10.0Buffer overflow in the DNS Client service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted record response.microsoft · windows 2000EPSS62%1 exploitPublished Aug 8, 2006
- CVE-2006-3440Critical 10.0Buffer overflow in the Winsock API in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka "Winsock Hostname Vulnerability."microsoft · windows 2000EPSS57%1 exploitPublished Aug 8, 2006
- CVE-2006-3838Critical 10.0Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in products including (a) Sidewinder, (b) iPolicy Security Manager, (c) Astaro Report Manager, (d) Fortinet FortiReporter, (e) Top Layer Network Security Analyzer, and…eiqnetworks · enterprise security analyzerEPSS74%8 exploitsPublished Jul 26, 2006
- CVE-2006-2372Critical 10.0Buffer overflow in the DHCP Client service for Microsoft Windows 2000 SP4, Windows XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via a crafted DHCP response.microsoft · dhcp client serviceEPSS90%·Published Jul 11, 2006
- CVE-2006-3086Critical 9.3Stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function in Microsoft Hyperlink Object Library (hlink.dll) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hyperlink, as demonstrated using an Excel…microsoft · hyperlink object libraryEPSS56%1 exploitPublished Jun 19, 2006
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2007-2815 | The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the… microsoft · internet information services | Critical 10.0 | 73% | 1 exploit | |
| CVE-2007-1689 | Buffer overflow in the ISAlertDataCOM ActiveX control in ISLALERT.DLL for Norton Personal Firewall 2004 and Internet Security 2004 allows remote attackers to execute arbitrary code via long arguments to the (1) Get and (2) Set functions. symantec · norton personal firewall | Critical 10.0 | 65% | 2 exploits | |
| CVE-2007-2711 | Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long string to TCP port 113. tinyirc · tinyidentd | Critical 10.0 | 63% | 2 exploits | |
| CVE-2007-2446 | Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3)… samba · samba | Critical 10.0 | 78% | 7 exploits | |
| CVE-2007-2508 | Multiple stack-based buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2 Build 1174 allow remote attackers to execute arbitrary code via crafted data to (1) TCP port 5168, which triggers an overflow in the CAgRpcClient::CreateBinding function in the… trend micro · serverprotect | Critical 10.0 | 77% | 5 exploits | |
| CVE-2007-0940 | Unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control (CAPICOM.dll) in Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2 allows remote attackers to execute arbitrary code via unspecified vectors, aka the "CAPICOM.Certificates… microsoft · biztalk server | Critical 9.3 | 76% | · | |
| CVE-2007-0213 | Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to execute arbitrary code via a crafted base64-encoded MIME e-mail message. microsoft · exchange server | Critical 10.0 | 66% | 1 exploit | |
| CVE-2007-2485 | Myflash < 1.11 - Remote File Inclusion ruben boelinger · myflash | Critical 9.8 | 55% | · | |
| CVE-2007-2426 | MySliderGallery <= 1.2.1 - Remote File Inclusion wildbits · mygallery | Critical 9.8 | 63% | · | |
| CVE-2007-2139 | Multiple stack-based buffer overflows in the SUN RPC service in CA (formerly Computer Associates) BrightStor ARCserve Media Server, as used in BrightStor ARCserve Backup 9.01 through 11.5 SP2, BrightStor Enterprise Backup 10.5, Server Protection Suite 2, and Business Protection… broadcom · brightstor arcserve backup | Critical 10.0 | 78% | 2 exploits | |
| CVE-2007-2193 | Stack-based buffer overflow in the ID_X.apl plugin in ACDSee 9.0 Build 108, Pro 8.1 Build 99, and Photo Editor 4.0 Build 195 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long section string. acd systems · acdsee | Critical 9.3 | 37% | 2 exploits | |
| CVE-2007-1674 | Stack-based buffer overflow in the Alert Service (aolnsrvr.exe) in LANDesk Management Suite 8.7 allows remote attackers to execute arbitrary code via a crafted packet to port 65535/UDP. landesk · landesk management suite | Critical 10.0 | 73% | 3 exploits | |
| CVE-2007-1748 | Stack-based buffer overflow in the RPC interface in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server SP 4, Server 2003 SP 1, and Server 2003 SP 2 allows remote attackers to execute arbitrary code via a long zone name containing character constants… microsoft · windows 2000 | Critical 10.0 | 78% | 7 exploits | |
| CVE-2007-1559 | Multiple stack-based buffer overflows in SonicDVDDashVRNav.dll in Roxio CinePlayer 3.2 allow remote attackers to execute arbitrary code via (1) unspecified long property values to SonicMediaPlayer.dll or (2) long arguments to unspecified methods in SonicMediaPlayer.dll. roxio · cineplayer | Critical 9.3 | 32% | 3 exploits | |
| CVE-2007-1868 | The management service in IBM Tivoli Provisioning Manager for OS Deployment before 5.1 Fix Pack 2 does not properly handle multipart/form-data in HTTP POST requests, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via crafted… ibm · tivoli provisioning manager os deployment | Critical 10.0 | 59% | 2 exploits | |
| CVE-2007-1819 | Stack-based buffer overflow in the SPIDERLib.Loader ActiveX control (Spider90.ocx) 9.1.0.4353 in TestDirector (TD) for Mercury Quality Center 9.0 before Patch 12.1, and 8.2 SP1 before Patch 32, allows remote attackers to execute arbitrary code via a long ProgColor property. hp · mercury quality center | Critical 9.3 | 40% | 3 exploits | |
| CVE-2007-0038 | Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI,… microsoft · windows 2000 | Critical 9.3 | 73% | 17 exploits | |
| CVE-2007-1765 | Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and… microsoft · internet explorer | Critical 9.3 | 55% | 12 exploits | |
| CVE-2007-1675 | Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a denial of service via a long username. ibm · lotus domino | Critical 10.0 | 61% | 3 exploits | |
| CVE-2007-1697 | PHP remote file inclusion vulnerability in header.inc.php in Philex 0.2.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CssFile parameter. philex · philex | Critical 10.0 | 73% | · | |
| CVE-2007-1579 | Stack-based buffer overflow in Atrium MERCUR IMAPD allows remote attackers to have an unknown impact via a certain SUBSCRIBE command. atrium software · mercur imapd | Critical 10.0 | 57% | · | |
| CVE-2007-1567 | Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors, as demonstrated by warftp_165.tar by Immunity. war ftp daemon · war ftp daemon | Critical 10.0 | 51% | 3 exploits | |
| CVE-2007-0348 | Stack-based buffer overflow in the IASystemInfo.dll ActiveX control in (1) InterActual Player 2.60.12.0717, (2) Roxio CinePlayer 3.2, (3) WinDVD 7.0.27.172, and possibly other products, allows remote attackers to execute arbitrary code via a long ApplicationType property. interactual technologies · interactual player | Critical 9.3 | 37% | 2 exploits | |
| CVE-2007-1435 | Buffer overflow in D-Link TFTP Server 1.0 allows remote attackers to cause a denial of service (crash) via a long (1) GET or (2) PUT request, which triggers memory corruption. d-link · tftp server | Critical 10.0 | 46% | 3 exploits | |
| CVE-2007-1373 | Stack-based buffer overflow in Mercury/32 (aka Mercury Mail Transport System) 4.01b and earlier allows remote attackers to execute arbitrary code via a long LOGIN command. pmail · mercury mail transport system | Critical 10.0 | 60% | 4 exploits | |
| CVE-2007-1070 | Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance Filer 5.61 and 5.62, allow remote attackers to execute arbitrary code via crafted RPC requests to TmRpcSrv.dll that trigger overflows when calling the (1)… trend micro · serverprotect | Critical 10.0 | 73% | 3 exploits | |
| CVE-2007-0325 | Multiple buffer overflows in the Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control in OfficeScanSetupINI.dll, as used in OfficeScan 7.0 before Build 1344, OfficeScan 7.3 before Build 1241, and Client / Server / Messaging Security 3.0 before Build 1197, allow… trend micro · client-server-messaging security | Critical 9.3 | 35% | 2 exploits | |
| CVE-2006-5276 | Stack-based buffer overflow in the DCE/RPC preprocessor in Snort before 2.6.1.3, and 2.7 before beta 2; and Sourcefire Intrusion Sensor; allows remote attackers to execute arbitrary code via crafted SMB traffic. snort · snort | Critical 10.0 | 79% | 4 exploits | |
| CVE-2007-0217 | The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow remote attackers to execute arbitrary code via an FTP server response of a specific length that causes a terminating null byte to be written outside of a buffer, which causes heap corruption. microsoft · internet explorer | Critical 10.0 | 58% | 1 exploit | |
| CVE-2007-0882 | Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts,… oracle · solaris | Critical 10.0 | 98% | 4 exploits | |
| CVE-2007-0018 | Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll), as used by multiple products, allows remote attackers to execute arbitrary code via a long argument to the SetFormatLikeSample function. americanshareware · mp3 wav converter | Critical 9.3 | 36% | 4 exploits | |
| CVE-2007-0449 | Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r4.0, Desktop and Business Protection Suite r2, and Desktop Management Suite (DMS) r11.0 and r11.1 allow remote attackers to execute… broadcom · business protection suite | Critical 10.0 | 79% | 5 exploits | |
| CVE-2006-6424 | Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IMAP verbs when specifying command continuation requests to IMAPD, resulting in a heap overflow; and (2) via crafted arguments to… novell · netmail | Critical 9.0 | 60% | 2 exploits | |
| CVE-2006-6425 | Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via unspecified vectors involving the APPEND command. novell · netmail | Critical 9.0 | 58% | 2 exploits | |
| CVE-2006-5583 | Buffer overflow in the SNMP Service in Microsoft Windows 2000 SP4, XP SP2, Server 2003, Server 2003 SP1, and possibly other versions allows remote attackers to execute arbitrary code via a crafted SNMP packet, aka "SNMP Memory Corruption Vulnerability." microsoft · windows 2003 server | Critical 10.0 | 54% | · | |
| CVE-2006-6423 | Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command… mailenable · mailenable professional | Critical 10.0 | 71% | 4 exploits | |
| CVE-2006-6183 | Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long mode field (aka transporting mode) in a (1) GET or (2) PUT command. 3com · 3ctftpsvc | Critical 10.0 | 70% | 6 exploits | |
| CVE-2006-6184 | Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long filename in a (1) GET or (2) PUT command. alliedtelesyn · at-tftp | Critical 10.0 | 66% | 5 exploits | |
| CVE-2006-6076 | Buffer overflow in the Tape Engine (tapeeng.exe) in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to execute arbitrary code via certain RPC requests to TCP port 6502. broadcom · brightstor arcserve backup | Critical 10.0 | 71% | 3 exploits | |
| CVE-2006-4691 | Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to execute arbitrary code via NetrJoinDomain2 RPC messages with a long hostname. microsoft · windows 2000 | Critical 10.0 | 80% | 5 exploits | |
| CVE-2006-5815 | Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit." proftpd project · proftpd | Critical 10.0 | 75% | 3 exploits | |
| CVE-2006-5156 | Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attackers to execute arbitrary code via a request to /spipe/pkg/ with a long source header. mcafee · epolicy orchestrator | Critical 10.0 | 74% | 3 exploits | |
| CVE-2006-4868 | Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a… microsoft · internet explorer | Critical 9.3 | 61% | 4 exploits | |
| CVE-2006-4305 | Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long database name when connecting via a WebDBM client. mysql · maxdb | Critical 10.0 | 72% | 2 exploits | |
| CVE-2006-3439 | Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including anonymous users, to execute arbitrary code via a crafted RPC message, a different vulnerability than CVE-2006-1314. microsoft · windows 2000 | Critical 10.0 | 85% | 6 exploits | |
| CVE-2006-3441 | Buffer overflow in the DNS Client service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted record response. microsoft · windows 2000 | Critical 10.0 | 62% | 1 exploit | |
| CVE-2006-3440 | Buffer overflow in the Winsock API in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka "Winsock Hostname Vulnerability." microsoft · windows 2000 | Critical 10.0 | 57% | 1 exploit | |
| CVE-2006-3838 | Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in products including (a) Sidewinder, (b) iPolicy Security Manager, (c) Astaro Report Manager, (d) Fortinet FortiReporter, (e) Top Layer Network Security Analyzer, and… eiqnetworks · enterprise security analyzer | Critical 10.0 | 74% | 8 exploits | |
| CVE-2006-2372 | Buffer overflow in the DHCP Client service for Microsoft Windows 2000 SP4, Windows XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via a crafted DHCP response. microsoft · dhcp client service | Critical 10.0 | 90% | · | |
| CVE-2006-3086 | Stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function in Microsoft Hyperlink Object Library (hlink.dll) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hyperlink, as demonstrated using an Excel… microsoft · hyperlink object library | Critical 9.3 | 56% | 1 exploit |
Showing 1,501–1,550 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.