Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,918 vulnerabilities · highest exploit probability first
- CVE-2017-5174Critical 9.8An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12.geutebruck · ip camera g-cam efd-2250 firmwareEPSS52%1 exploitPublished May 19, 2017
- CVE-2017-6622Critical 9.8A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges.cisco · prime collaboration provisioningEPSS62%1 exploitPublished May 18, 2017
- CVE-2017-8917Critical 9.8SQL injection vulnerability in Joomla!joomla · joomla\!EPSS100%5 exploitsPublished May 17, 2017
- CVE-2016-10372Critical 9.8The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and…eir · d1000 modem firmwareEPSS82%1 exploitPublished May 16, 2017
- CVE-2017-8895Critical 9.8In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution.veritas · backup execEPSS71%2 exploitsPublished May 10, 2017
- CVE-2017-0290High 7.8The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server…microsoft · malware protection engineEPSS81%1 exploitPublished May 9, 2017
- CVE-2017-7925Critical 9.8A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3,…dahuasecurity · dh-hcvr4xxx firmwareEPSS51%·Published May 5, 2017
- CVE-2017-3731High 7.5If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash.openssl · opensslEPSS57%·Published May 4, 2017
- CVE-2017-3730High 7.5In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash.openssl · opensslEPSS55%2 exploitsPublished May 4, 2017
- CVE-2017-8779High 7.5rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no…libtirpc project · libtirpcEPSS81%1 exploitPublished May 4, 2017
- CVE-2017-6553Critical 9.8Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the policy server via an ACT_ALERT_EVENT request that causes memory corruption in the pmmasterd daemon.quest · privilege manager for unixEPSS42%2 exploitsPublished Apr 29, 2017
- CVE-2017-3548Medium 6.5Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.oracle · peoplesoft enterprise peopletoolsEPSS51%2 exploitsPublished Apr 24, 2017
- CVE-2016-1561High 7.5ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image.exagrid · ex10000e firmwareEPSS74%3 exploitsPublished Apr 21, 2017
- CVE-2016-1560Critical 9.8ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session.exagrid · ex10000e firmwareEPSS72%3 exploitsPublished Apr 21, 2017
- CVE-2017-3599High 7.5mysql: integer underflow in get_56_lenc_string() leading to DoS (CPU Apr 2017)oracle · mysqlEPSS90%1 exploitPublished Apr 19, 2017
- CVE-2015-8256Medium 6.1Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras.axis · network camera firmwareEPSS51%3 exploitsPublished Apr 17, 2017
- CVE-2016-5312Medium 6.5Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary files via a ..symantec · messaging gatewayEPSS54%3 exploitsPublished Apr 14, 2017
- CVE-2016-2555Critical 9.8SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.atutor · atutorEPSS80%3 exploitsPublished Apr 13, 2017
- CVE-2016-7552Critical 9.8On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root.trendmicro · threat discovery applianceEPSS93%2 exploitsPublished Apr 12, 2017
- CVE-2016-7547Critical 9.8A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.cgi interface.trendmicro · threat discovery applianceEPSS93%2 exploitsPublished Apr 12, 2017
- CVE-2017-1001000High 7.5The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts…wordpress · wordpressEPSS85%·Published Apr 3, 2017
- CVE-2015-4624High 7.5Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.hak5 · wi-fi pineapple firmwareEPSS37%6 exploitsPublished Mar 31, 2017
- CVE-2017-7310High 7.8A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskSavvy before 10.6, DupScout before 10.6, and VX Search before 10.6 allows attackers to execute arbitrary code via a crafted XML…flexense · diskbossEPSS54%8 exploitsPublished Mar 29, 2017
- CVE-2017-6361Critical 9.8QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.qnap · qtsEPSS57%1 exploitPublished Mar 23, 2017
- CVE-2017-6360Critical 9.8QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors.qnap · qtsEPSS66%1 exploitPublished Mar 23, 2017
- CVE-2017-0108High 7.8The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Live Meeting 2007; Silverlight 5; Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1 allows remote attackers to…microsoft · live meetingEPSS50%1 exploitPublished Mar 16, 2017
- CVE-2017-0089High 8.8Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Uniscribe Remote Code Execution Vulnerability." This vulnerability is different from those described in…microsoft · windows 7EPSS57%1 exploitPublished Mar 16, 2017
- CVE-2017-0070High 7.5A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers.microsoft · edgeEPSS79%1 exploitPublished Mar 16, 2017
- CVE-2017-6398High 8.8An authenticated user can execute a terminal command in the context of the web server user (which is root).trendmicro · interscan messaging security virtual applianceEPSS54%1 exploitPublished Mar 14, 2017
- CVE-2017-6465Critical 9.8Remote Code Execution was discovered in FTPShell Client 6.53.ftpshell · ftpshell clientEPSS50%4 exploitsPublished Mar 9, 2017
- CVE-2017-6527High 7.5dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user (by using the viewAppletFsa.cgi seqID parameter).dnatools · dnalimsEPSS57%1 exploitPublished Mar 9, 2017
- CVE-2017-6526Critical 9.8dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests).dnatools · dnalimsEPSS57%2 exploitsPublished Mar 9, 2017
- CVE-2017-5982High 7.5Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd.kodi · kodiEPSS78%2 exploitsPublished Feb 28, 2017
- CVE-2017-6343High 8.1The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash…dahuasecurity · camera firmwareEPSS60%·Published Feb 27, 2017
- CVE-2017-6187Critical 9.8Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary code via a long URI in a GET request.disksavvy · disksavvy enterpriseEPSS33%3 exploitsPublished Feb 22, 2017
- CVE-2017-0038Medium 5.5gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive…microsoft · windows 10EPSS82%1 exploitPublished Feb 20, 2017
- CVE-2016-10134Critical 9.8SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.zabbix · zabbixEPSS83%·Published Feb 17, 2017
- CVE-2016-6210Medium 5.9sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large…openbsd · opensshEPSS89%2 exploitsPublished Feb 13, 2017
- CVE-2016-9244High 7.5A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory.f5 · big-ip access policy managerEPSS74%2 exploitsPublished Feb 9, 2017
- CVE-2017-3823High 8.8A vulnerability in these Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system.cisco · activetouch general plugin containerEPSS27%1 exploitPublished Feb 1, 2017
- CVE-2016-6267High 8.8SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community, (2) spare_AllowGroupIP, or (3)…trendmicro · smart protection serverEPSS55%1 exploitPublished Jan 30, 2017
- CVE-2016-10176Critical 9.8The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device.netgear · wnr2000v5 firmwareEPSS77%1 exploitPublished Jan 30, 2017
- CVE-2016-10175Critical 9.8The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI.netgear · wnr2000v5 firmwareEPSS66%1 exploitPublished Jan 30, 2017
- CVE-2017-3248Critical 9.8Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS97%2 exploitsPublished Jan 27, 2017
- CVE-2016-6603Critical 9.8ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.zohocorp · webnms frameworkEPSS87%4 exploitsPublished Jan 23, 2017
- CVE-2016-6602Critical 9.8ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml.zohocorp · webnms frameworkEPSS56%4 exploitsPublished Jan 23, 2017
- CVE-2016-6601High 7.5Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a ..zohocorp · webnms frameworkEPSS98%4 exploitsPublished Jan 23, 2017
- CVE-2016-6600Critical 9.8Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a ..zohocorp · webnms frameworkEPSS91%5 exploitsPublished Jan 23, 2017
- CVE-2016-4010Critical 9.8Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.magento · magentoEPSS93%4 exploitsPublished Jan 23, 2017
- CVE-2017-5487Medium 5.3wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.wordpress · wordpressEPSS87%1 exploitPublished Jan 15, 2017
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-5174 | An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. geutebruck · ip camera g-cam efd-2250 firmware | Critical 9.8 | 52% | 1 exploit | |
| CVE-2017-6622 | A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. cisco · prime collaboration provisioning | Critical 9.8 | 62% | 1 exploit | |
| CVE-2017-8917 | SQL injection vulnerability in Joomla! joomla · joomla\! | Critical 9.8 | 100% | 5 exploits | |
| CVE-2016-10372 | The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and… eir · d1000 modem firmware | Critical 9.8 | 82% | 1 exploit | |
| CVE-2017-8895 | In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution. veritas · backup exec | Critical 9.8 | 71% | 2 exploits | |
| CVE-2017-0290 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server… microsoft · malware protection engine | High 7.8 | 81% | 1 exploit | |
| CVE-2017-7925 | A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3,… dahuasecurity · dh-hcvr4xxx firmware | Critical 9.8 | 51% | · | |
| CVE-2017-3731 | If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. openssl · openssl | High 7.5 | 57% | · | |
| CVE-2017-3730 | In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. openssl · openssl | High 7.5 | 55% | 2 exploits | |
| CVE-2017-8779 | rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no… libtirpc project · libtirpc | High 7.5 | 81% | 1 exploit | |
| CVE-2017-6553 | Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the policy server via an ACT_ALERT_EVENT request that causes memory corruption in the pmmasterd daemon. quest · privilege manager for unix | Critical 9.8 | 42% | 2 exploits | |
| CVE-2017-3548 | Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. oracle · peoplesoft enterprise peopletools | Medium 6.5 | 51% | 2 exploits | |
| CVE-2016-1561 | ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image. exagrid · ex10000e firmware | High 7.5 | 74% | 3 exploits | |
| CVE-2016-1560 | ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session. exagrid · ex10000e firmware | Critical 9.8 | 72% | 3 exploits | |
| CVE-2017-3599 | mysql: integer underflow in get_56_lenc_string() leading to DoS (CPU Apr 2017) oracle · mysql | High 7.5 | 90% | 1 exploit | |
| CVE-2015-8256 | Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras. axis · network camera firmware | Medium 6.1 | 51% | 3 exploits | |
| CVE-2016-5312 | Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary files via a .. symantec · messaging gateway | Medium 6.5 | 54% | 3 exploits | |
| CVE-2016-2555 | SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php. atutor · atutor | Critical 9.8 | 80% | 3 exploits | |
| CVE-2016-7552 | On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. trendmicro · threat discovery appliance | Critical 9.8 | 93% | 2 exploits | |
| CVE-2016-7547 | A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.cgi interface. trendmicro · threat discovery appliance | Critical 9.8 | 93% | 2 exploits | |
| CVE-2017-1001000 | The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts… wordpress · wordpress | High 7.5 | 85% | · | |
| CVE-2015-4624 | Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens. hak5 · wi-fi pineapple firmware | High 7.5 | 37% | 6 exploits | |
| CVE-2017-7310 | A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskSavvy before 10.6, DupScout before 10.6, and VX Search before 10.6 allows attackers to execute arbitrary code via a crafted XML… flexense · diskboss | High 7.8 | 54% | 8 exploits | |
| CVE-2017-6361 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. qnap · qts | Critical 9.8 | 57% | 1 exploit | |
| CVE-2017-6360 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors. qnap · qts | Critical 9.8 | 66% | 1 exploit | |
| CVE-2017-0108 | The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Live Meeting 2007; Silverlight 5; Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1 allows remote attackers to… microsoft · live meeting | High 7.8 | 50% | 1 exploit | |
| CVE-2017-0089 | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Uniscribe Remote Code Execution Vulnerability." This vulnerability is different from those described in… microsoft · windows 7 | High 8.8 | 57% | 1 exploit | |
| CVE-2017-0070 | A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. microsoft · edge | High 7.5 | 79% | 1 exploit | |
| CVE-2017-6398 | An authenticated user can execute a terminal command in the context of the web server user (which is root). trendmicro · interscan messaging security virtual appliance | High 8.8 | 54% | 1 exploit | |
| CVE-2017-6465 | Remote Code Execution was discovered in FTPShell Client 6.53. ftpshell · ftpshell client | Critical 9.8 | 50% | 4 exploits | |
| CVE-2017-6527 | dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user (by using the viewAppletFsa.cgi seqID parameter). dnatools · dnalims | High 7.5 | 57% | 1 exploit | |
| CVE-2017-6526 | dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests). dnatools · dnalims | Critical 9.8 | 57% | 2 exploits | |
| CVE-2017-5982 | Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd. kodi · kodi | High 7.5 | 78% | 2 exploits | |
| CVE-2017-6343 | The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash… dahuasecurity · camera firmware | High 8.1 | 60% | · | |
| CVE-2017-6187 | Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary code via a long URI in a GET request. disksavvy · disksavvy enterprise | Critical 9.8 | 33% | 3 exploits | |
| CVE-2017-0038 | gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive… microsoft · windows 10 | Medium 5.5 | 82% | 1 exploit | |
| CVE-2016-10134 | SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php. zabbix · zabbix | Critical 9.8 | 83% | · | |
| CVE-2016-6210 | sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large… openbsd · openssh | Medium 5.9 | 89% | 2 exploits | |
| CVE-2016-9244 | A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. f5 · big-ip access policy manager | High 7.5 | 74% | 2 exploits | |
| CVE-2017-3823 | A vulnerability in these Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. cisco · activetouch general plugin container | High 8.8 | 27% | 1 exploit | |
| CVE-2016-6267 | SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community, (2) spare_AllowGroupIP, or (3)… trendmicro · smart protection server | High 8.8 | 55% | 1 exploit | |
| CVE-2016-10176 | The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. netgear · wnr2000v5 firmware | Critical 9.8 | 77% | 1 exploit | |
| CVE-2016-10175 | The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. netgear · wnr2000v5 firmware | Critical 9.8 | 66% | 1 exploit | |
| CVE-2017-3248 | Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. oracle · weblogic server | Critical 9.8 | 97% | 2 exploits | |
| CVE-2016-6603 | ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header. zohocorp · webnms framework | Critical 9.8 | 87% | 4 exploits | |
| CVE-2016-6602 | ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. zohocorp · webnms framework | Critical 9.8 | 56% | 4 exploits | |
| CVE-2016-6601 | Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. zohocorp · webnms framework | High 7.5 | 98% | 4 exploits | |
| CVE-2016-6600 | Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. zohocorp · webnms framework | Critical 9.8 | 91% | 5 exploits | |
| CVE-2016-4010 | Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data. magento · magento | Critical 9.8 | 93% | 4 exploits | |
| CVE-2017-5487 | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request. wordpress · wordpress | Medium 5.3 | 87% | 1 exploit |
Showing 2,251–2,300 of 3,918
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.