Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2020-8654High 8.8An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.eyesofnetwork · eyesofnetworkEPSS92%6 exploitsPublished Feb 6, 2020
- CVE-2013-3568High 8.8Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.cisco · linksys wrt110 firmwareEPSS25%3 exploitsPublished Feb 6, 2020
- CVE-2020-8772Critical 9.8The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php.revmakx · infinitewp clientEPSS88%1 exploitPublished Feb 6, 2020
- CVE-2015-6000High 8.8Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an…vtiger · vtiger crmEPSS40%3 exploitsPublished Feb 6, 2020
- CVE-2020-6754Critical 9.8dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control.dotcms · dotcmsEPSS95%1 exploitPublished Feb 5, 2020
- CVE-2013-3215Critical 9.8vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.vtiger · vtiger crmEPSS69%2 exploitsPublished Jan 29, 2020
- CVE-2019-20215Critical 9.8D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled.dlink · dir-859 firmwareEPSS75%3 exploitsPublished Jan 29, 2020
- CVE-2013-3214Critical 9.8vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.vtiger · vtiger crmEPSS85%4 exploitsPublished Jan 28, 2020
- CVE-2014-8741Critical 9.8Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to arbitrary files via unspecified vectors.lexmark · markvision enterpriseEPSS77%2 exploitsPublished Jan 27, 2020
- CVE-2013-7390Critical 9.8Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the…zohocorp · manageengine desktop centralEPSS75%4 exploitsPublished Jan 27, 2020
- CVE-2012-1495Critical 9.8install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.webcalendar project · webcalendarEPSS80%5 exploitsPublished Jan 27, 2020
- CVE-2020-7980Critical 9.8Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI.intelliantech · aptus webEPSS83%3 exploitsPublished Jan 25, 2020
- CVE-2020-5398High 7.5RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Applicationvmware · spring frameworkEPSS89%·Published Jan 21, 2020
- CVE-2020-7246High 8.8A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier.qdpm · qdpmEPSS83%9 exploitsPublished Jan 21, 2020
- CVE-2019-19844Critical 9.3Django Potential account hijack via password reset formdjangoproject · djangoEPSS54%1 exploitPublished Jan 16, 2020
- CVE-2020-0610Critical 9.8A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution…microsoft · windows server 2012EPSS68%Ransomware2 exploits1 actorPublished Jan 14, 2020
- CVE-2020-0609Critical 9.8A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution…microsoft · windows server 2012EPSS78%Ransomware2 exploits1 actorPublished Jan 14, 2020
- CVE-2014-6039High 7.5ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability.zohocorp · manageengine eventlog analyzerEPSS69%2 exploitsPublished Jan 13, 2020
- CVE-2014-6038High 7.5Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability.zohocorp · manageengine eventlog analyzerEPSS73%2 exploitsPublished Jan 13, 2020
- CVE-2012-4284Critical 9.8A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary, which could let a remote malicious user execute arbitrary codesparklabs · viscosityEPSS70%5 exploitsPublished Jan 10, 2020
- CVE-2019-20361Critical 9.8There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability).icegram · email subscribers \& newslettersEPSS85%2 exploitsPublished Jan 8, 2020
- CVE-2019-17571Critical 9.8Deserialization of Untrusted Data in Log4japache · log4jEPSS70%·Published Jan 6, 2020
- CVE-2015-4553High 8.8A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.dedecms · dedecmsEPSS57%2 exploitsPublished Jan 6, 2020
- CVE-2019-19509High 8.8A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.rconfig · rconfigEPSS72%8 exploitsPublished Jan 6, 2020
- CVE-2019-15976Critical 9.8Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device.cisco · data center network managerEPSS93%2 exploitsPublished Jan 6, 2020
- CVE-2019-15975Critical 9.8Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device.cisco · data center network managerEPSS96%2 exploitsPublished Jan 6, 2020
- CVE-2014-8516Critical 9.8Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.cloudfastpath · netcharts serverEPSS82%3 exploitsPublished Jan 3, 2020
- CVE-2019-19985Medium 5.3The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.icegram · email subscribers \& newslettersEPSS71%1 exploitPublished Dec 26, 2019
- CVE-2013-5743Critical 9.8Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.zabbix · zabbixEPSS80%2 exploitsPublished Dec 11, 2019
- CVE-2019-17270Critical 9.8Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client.yachtcontrol · yachtcontrolEPSS59%2 exploitsPublished Dec 10, 2019
- CVE-2019-5096Critical 9.8An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5.embedthis · goaheadEPSS67%·Published Dec 3, 2019
- CVE-2019-18818Critical 9.8Strapi allows unauthenticated attacker to reset admin password without valid reset tokenstrapi · strapiEPSS98%2 exploitsPublished Dec 2, 2019
- CVE-2019-12518Critical 9.8Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability.anviz · crosschexEPSS51%2 exploitsPublished Dec 2, 2019
- CVE-2019-19492Critical 9.8FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.freeswitch · freeswitchEPSS29%2 exploitsPublished Dec 1, 2019
- CVE-2019-18610High 8.8A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.digium · asteriskEPSS50%·Published Nov 22, 2019
- CVE-2011-2921Critical 9.8ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can result in command execution with root privileges.ktsuss project · ktsussEPSS83%3 exploitsPublished Nov 19, 2019
- CVE-2019-5029Critical 9.8An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1.exhibitor project · exhibitorEPSS57%1 exploitPublished Nov 13, 2019
- CVE-2019-1439Medium 6.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'.microsoft · windows 10EPSS75%·Published Nov 12, 2019
- CVE-2019-1234High 7.5A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'.microsoft · azure stackEPSS75%·Published Nov 12, 2019
- CVE-2013-1391High 7.5Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration.hachi · hv-04rd pro firmwareEPSS76%1 exploitPublished Oct 30, 2019
- CVE-2012-0694Critical 9.8SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.sugarcrm · sugarcrmEPSS67%3 exploitsPublished Oct 29, 2019
- CVE-2019-17181Critical 9.8A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03).intrasrv project · intrasrvEPSS48%1 exploitPublished Oct 28, 2019
- CVE-2019-16663High 8.8An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution.rconfig · rconfigEPSS85%2 exploitsPublished Oct 28, 2019
- CVE-2019-16662Critical 9.8An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.rconfig · rconfigEPSS98%4 exploitsPublished Oct 28, 2019
- CVE-2019-18371High 7.5An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable.mi · millet router 3g firmwareEPSS56%1 exploitPublished Oct 23, 2019
- CVE-2019-14287High 8.8In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID.sudo project · sudoEPSS64%1 exploitPublished Oct 17, 2019
- CVE-2019-17662Critical 9.8ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server.cybelsoft · thinvncEPSS97%2 exploitsPublished Oct 16, 2019
- CVE-2019-17602Critical 9.8The OPMDeviceDetailsServlet servlet is prone to SQL injection.zohocorp · manageengine opmanagerEPSS81%·Published Oct 15, 2019
- CVE-2019-17506Critical 9.8There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers.dlink · dir-817lw a1 firmwareEPSS56%1 exploitPublished Oct 11, 2019
- CVE-2019-1358High 7.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'.microsoft · windows 10EPSS76%·Published Oct 10, 2019
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-8654 | An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field. eyesofnetwork · eyesofnetwork | High 8.8 | 92% | 6 exploits | |
| CVE-2013-3568 | Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors. cisco · linksys wrt110 firmware | High 8.8 | 25% | 3 exploits | |
| CVE-2020-8772 | The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. revmakx · infinitewp client | Critical 9.8 | 88% | 1 exploit | |
| CVE-2015-6000 | Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an… vtiger · vtiger crm | High 8.8 | 40% | 3 exploits | |
| CVE-2020-6754 | dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. dotcms · dotcms | Critical 9.8 | 95% | 1 exploit | |
| CVE-2013-3215 | vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function. vtiger · vtiger crm | Critical 9.8 | 69% | 2 exploits | |
| CVE-2019-20215 | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled. dlink · dir-859 firmware | Critical 9.8 | 75% | 3 exploits | |
| CVE-2013-3214 | vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'. vtiger · vtiger crm | Critical 9.8 | 85% | 4 exploits | |
| CVE-2014-8741 | Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to arbitrary files via unspecified vectors. lexmark · markvision enterprise | Critical 9.8 | 77% | 2 exploits | |
| CVE-2013-7390 | Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the… zohocorp · manageengine desktop central | Critical 9.8 | 75% | 4 exploits | |
| CVE-2012-1495 | install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter. webcalendar project · webcalendar | Critical 9.8 | 80% | 5 exploits | |
| CVE-2020-7980 | Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. intelliantech · aptus web | Critical 9.8 | 83% | 3 exploits | |
| CVE-2020-5398 | RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application vmware · spring framework | High 7.5 | 89% | · | |
| CVE-2020-7246 | A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. qdpm · qdpm | High 8.8 | 83% | 9 exploits | |
| CVE-2019-19844 | Django Potential account hijack via password reset form djangoproject · django | Critical 9.3 | 54% | 1 exploit | |
| CVE-2020-0610 | A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution… microsoft · windows server 2012 | Critical 9.8 | 68% | Ransomware2 exploits1 actor | |
| CVE-2020-0609 | A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution… microsoft · windows server 2012 | Critical 9.8 | 78% | Ransomware2 exploits1 actor | |
| CVE-2014-6039 | ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. zohocorp · manageengine eventlog analyzer | High 7.5 | 69% | 2 exploits | |
| CVE-2014-6038 | Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. zohocorp · manageengine eventlog analyzer | High 7.5 | 73% | 2 exploits | |
| CVE-2012-4284 | A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary, which could let a remote malicious user execute arbitrary code sparklabs · viscosity | Critical 9.8 | 70% | 5 exploits | |
| CVE-2019-20361 | There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability). icegram · email subscribers \& newsletters | Critical 9.8 | 85% | 2 exploits | |
| CVE-2019-17571 | Deserialization of Untrusted Data in Log4j apache · log4j | Critical 9.8 | 70% | · | |
| CVE-2015-4553 | A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell. dedecms · dedecms | High 8.8 | 57% | 2 exploits | |
| CVE-2019-19509 | A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution. rconfig · rconfig | High 8.8 | 72% | 8 exploits | |
| CVE-2019-15976 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. cisco · data center network manager | Critical 9.8 | 93% | 2 exploits | |
| CVE-2019-15975 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. cisco · data center network manager | Critical 9.8 | 96% | 2 exploits | |
| CVE-2014-8516 | Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors. cloudfastpath · netcharts server | Critical 9.8 | 82% | 3 exploits | |
| CVE-2019-19985 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure. icegram · email subscribers \& newsletters | Medium 5.3 | 71% | 1 exploit | |
| CVE-2013-5743 | Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7. zabbix · zabbix | Critical 9.8 | 80% | 2 exploits | |
| CVE-2019-17270 | Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client. yachtcontrol · yachtcontrol | Critical 9.8 | 59% | 2 exploits | |
| CVE-2019-5096 | An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. embedthis · goahead | Critical 9.8 | 67% | · | |
| CVE-2019-18818 | Strapi allows unauthenticated attacker to reset admin password without valid reset token strapi · strapi | Critical 9.8 | 98% | 2 exploits | |
| CVE-2019-12518 | Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability. anviz · crosschex | Critical 9.8 | 51% | 2 exploits | |
| CVE-2019-19492 | FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml. freeswitch · freeswitch | Critical 9.8 | 29% | 2 exploits | |
| CVE-2019-18610 | A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands. digium · asterisk | High 8.8 | 50% | · | |
| CVE-2011-2921 | ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can result in command execution with root privileges. ktsuss project · ktsuss | Critical 9.8 | 83% | 3 exploits | |
| CVE-2019-5029 | An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. exhibitor project · exhibitor | Critical 9.8 | 57% | 1 exploit | |
| CVE-2019-1439 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. microsoft · windows 10 | Medium 6.5 | 75% | · | |
| CVE-2019-1234 | A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'. microsoft · azure stack | High 7.5 | 75% | · | |
| CVE-2013-1391 | Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration. hachi · hv-04rd pro firmware | High 7.5 | 76% | 1 exploit | |
| CVE-2012-0694 | SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code. sugarcrm · sugarcrm | Critical 9.8 | 67% | 3 exploits | |
| CVE-2019-17181 | A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). intrasrv project · intrasrv | Critical 9.8 | 48% | 1 exploit | |
| CVE-2019-16663 | An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution. rconfig · rconfig | High 8.8 | 85% | 2 exploits | |
| CVE-2019-16662 | An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution. rconfig · rconfig | Critical 9.8 | 98% | 4 exploits | |
| CVE-2019-18371 | An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. mi · millet router 3g firmware | High 7.5 | 56% | 1 exploit | |
| CVE-2019-14287 | In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. sudo project · sudo | High 8.8 | 64% | 1 exploit | |
| CVE-2019-17662 | ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. cybelsoft · thinvnc | Critical 9.8 | 97% | 2 exploits | |
| CVE-2019-17602 | The OPMDeviceDetailsServlet servlet is prone to SQL injection. zohocorp · manageengine opmanager | Critical 9.8 | 81% | · | |
| CVE-2019-17506 | There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. dlink · dir-817lw a1 firmware | Critical 9.8 | 56% | 1 exploit | |
| CVE-2019-1358 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. microsoft · windows 10 | High 7.8 | 76% | · |
Showing 1,701–1,750 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.