Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Watchlist

The CVE Watchlist, Under Review.

Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.

Synced hourly · figures as of Oct 20, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
729 vulnerabilities · highest score first
  • CVE-2022-31885Critical 9.8
    Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.
    marvalglobal · marval msm
    EPSS33%
    1 exploit
    Published Jun 28, 2022
  • CVE-2022-29009Critical 9.8
    Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication.
    phpgurukul · cyber cafe management system
    EPSS23%
    2 exploits
    Published May 11, 2022
  • CVE-2022-26272Critical 9.8
    A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted string written to the file application/config/config.php.
    ionizecms · ionize
    EPSS22%
    1 exploit
    Published Mar 24, 2022
  • CVE-2022-2488Critical 9.8
    The manipulation of the argument IP leads to os command injection.
    wavlink · wl-wn535k2 firmware
    EPSS33%
    1 exploit
    Published Jul 20, 2022
  • CVE-2022-1390Critical 9.8
    The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique.
    admin word count column project · admin word count column
    EPSS22%
    1 exploit
    Published Apr 25, 2022
  • CVE-2021-46314Critical 9.8
    A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin because backticks can be used for command injection when judging whether it is a reasonable…
    dlink · dir-846 firmware
    EPSS33%
    1 exploit
    Published Feb 17, 2022
  • CVE-2021-42887Critical 9.8
    In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
    totolink · ex1200t firmware
    EPSS44%
    1 exploit
    Published Jun 3, 2022
  • CVE-2021-31251Critical 9.8
    An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileged connection with the target device by supplying a specially malformed request and an attacker may force the remote…
    chiyu-tech · bf-430 firmware
    EPSS36%
    1 exploit
    Published Jun 4, 2021
  • CVE-2020-5505Critical 9.8
    Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"application/x-php"} to the /api/files/ URI.
    vaaip · freelancy
    EPSS44%
    1 exploit
    Published Jan 14, 2020
  • CVE-2018-5997Critical 9.8
    Due to an unrestricted upload feature and a path traversal vulnerability, it is possible to upload a file on a filesystem with root privileges: this will lead to remote code execution as root.
    ravpower · filehub firmware
    EPSS24%
    2 exploits
    Published Jan 25, 2018
  • CVE-2018-16158Critical 9.8
    Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins (to uid 0) via the…
    eaton · power xpert meter 4000 firmware
    EPSS35%
    1 exploit
    Published Aug 30, 2018
  • CVE-2018-13417Critical 9.8
    In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack.
    vuze · bittorrent client
    EPSS20%
    2 exploits
    Published Aug 13, 2018
  • CVE-2018-12571Critical 9.8
    uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitrary hosts via a comma-separated list of URLs in the orig_url parameter, possibly causing a traffic amplification and/or…
    microsoft · forefront unified access gateway
    EPSS31%
    1 exploit
    Published Jul 5, 2018
  • CVE-2017-11346Critical 9.8
    Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.
    zohocorp · manageengine desktop central
    EPSS43%
    1 exploit
    Published Jul 17, 2017
  • CVE-2015-7622Critical 10.0
    Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to execute arbitrary code or cause a denial…
    adobe · acrobat
    EPSS23%
    1 exploit
    Published Oct 14, 2015
  • CVE-2015-0081Critical 9.3
    Windows Text Services (WTS) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a…
    microsoft · windows 7
    EPSS24%
    1 exploit
    Published Mar 11, 2015
  • CVE-2013-3174Critical 9.3
    DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted GIF file, aka "DirectShow Arbitrary…
    microsoft · windows 7
    EPSS32%
    1 exploit
    Published Jul 10, 2013
  • CVE-2013-3120Critical 9.3
    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3118 and CVE-2013-3125.
    microsoft · internet explorer
    EPSS32%
    1 exploit
    Published Jun 12, 2013
  • CVE-2013-3111Critical 9.3
    Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3123.
    microsoft · internet explorer
    EPSS34%
    1 exploit
    Published Jun 12, 2013
  • CVE-2013-1306Critical 9.3
    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1313.
    microsoft · internet explorer
    EPSS33%
    1 exploit
    Published May 15, 2013
  • CVE-2013-0657Critical 10.0
    Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remote attackers to execute arbitrary code by sending TCP port-12397 data that does not comply with a protocol.
    schneider-electric · interactive graphical scada system
    EPSS21%
    2 exploits
    Published Jan 21, 2013
  • CVE-2013-0019Critical 9.3
    Use-after-free vulnerability in Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer COmWindowProxy Use After Free Vulnerability."
    microsoft · internet explorer
    EPSS35%
    1 exploit
    Published Feb 13, 2013
  • CVE-2012-5863Critical 10.0
    These Sinapsi devices do not check for special elements in commands sent to the system.
    sinapsitech · esolar duo photovoltaic system monitor
    EPSS25%
    2 exploits
    Published Nov 23, 2012
  • CVE-2012-1661Critical 9.3
    ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map (.mxd) file.
    esri · arcmap
    EPSS24%
    2 exploits
    Published Jul 12, 2012
  • CVE-2011-1866Critical 10.0
    Buffer overflow in omniinet.exe in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to execute arbitrary code via a crafted request, related to the EXEC_CMD functionality.
    hp · openview storage data protector
    EPSS21%
    1 exploit
    Published Jul 1, 2011
  • CVE-2011-0978Critical 9.3
    Stack-based buffer overflow in Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via vectors related to an…
    microsoft · excel
    EPSS43%
    1 exploit
    Published Feb 10, 2011
  • CVE-2011-0285Critical 10.0
    The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted…
    mit · kerberos 5
    EPSS21%
    1 exploit
    Published Apr 15, 2011
  • CVE-2010-4588Critical 9.3
    The WBEMSingleView.ocx ActiveX control 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier allows remote attackers to execute arbitrary code via a crafted argument to the ReleaseContext method, a different vector than CVE-2010-3973, possibly an untrusted pointer…
    microsoft · wmi administrative tools
    EPSS33%
    1 exploit
    Published Dec 23, 2010
  • CVE-2008-2469Critical 10.0
    Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field.
    libspf · libspf2
    EPSS22%
    1 exploit
    Published Oct 23, 2008
  • CVE-2008-0105Critical 9.3
    Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section header index table information, aka "Microsoft Works File Converter Index Table…
    microsoft · office
    EPSS44%
    1 exploit
    Published Feb 12, 2008
  • CVE-2007-1399Critical 9.8
    Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with PHP 5.2.0 and 5.2.1, allows remote attackers to execute arbitrary code via a long zip:// URL, as demonstrated by actively triggering URL access from a remote PHP interpreter via…
    php · php
    EPSS20%
    1 exploit
    Published Mar 10, 2007
  • CVE-2007-0031Critical 9.3
    Heap-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a BIFF8 spreadsheet with a PALETTE record that contains a large number of entries.
    microsoft · excel
    EPSS42%
    1 exploit
    Published Jan 9, 2007
  • CVE-2006-6027Critical 9.3
    Adobe Reader (Adobe Acrobat Reader) 7.0 through 7.0.8 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long argument string to the LoadFile method in an AcroPDF ActiveX control.
    adobe · acrobat reader
    EPSS45%
    1 exploit
    Published Nov 21, 2006
  • CVE-2004-1137Critical 10.0
    Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and 2.6.x to 2.6.9, allow local and remote attackers to cause a denial of service or execute arbitrary code via (1) the ip_mc_source function, which decrements a counter to -1, or (2) the…
    linux · linux kernel
    EPSS21%
    1 exploit
    Published Dec 14, 2004
  • CVE-2004-0333Critical 10.0
    Buffer overflow in the UUDeview package, as used in WinZip 6.2 through WinZip 8.1 SR-1, and possibly other packages, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.
    uudeview · uudeview
    EPSS24%
    1 exploit
    Published Nov 23, 2004
  • CVE-1999-0003Critical 10.0
    Execute commands as root via buffer overflow in Tooltalk database server (rpc.ttdbserverd).
    sun · solaris
    EPSS25%
    2 exploits
    Published Apr 1, 1998
  • CVE-2026-92262Critical 9.9
    Numerous issues caused by historical #mysql50# tablename encoding bypass
    EPSS0.7%
    1 exploit
    Published Sep 7, 2026
  • CVE-2026-105105Critical 9.8
    CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data,…
    EPSS0.8%
    1 exploit
    Published Oct 3, 2026
  • CVE-2025-4978Critical 9.3
    A vulnerability, which was classified as very critical, was found in Netgear DGND3700 1.1.00.15_1.00.15NA.
    netgear · dgnd3700 firmware
    EPSS21%
    1 exploit
    Published May 20, 2025
  • CVE-2024-38289Critical 9.8
    A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input.
    rhubcom · turbomeeting
    EPSS41%
    1 exploit
    Published Jul 25, 2024
  • CVE-2024-24116Critical 9.8
    An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.
    ruijie · rg-nbs2009g-p firmware
    EPSS28%
    1 exploit
    Published Oct 2, 2024
  • CVE-2023-34800Critical 9.8
    D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgi_main.
    dlink · go-rt-ac750 firmware
    EPSS28%
    1 exploit
    Published Jun 15, 2023
  • CVE-2022-46476Critical 9.8
    D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function.
    dlink · dir-859 a1 firmware
    EPSS41%
    1 exploit
    Published Jan 19, 2023
  • CVE-2022-28573Critical 9.8
    D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNTPserverSeting.
    dlink · dir-823 pro firmware
    EPSS28%
    1 exploit
    Published May 2, 2022
  • CVE-2022-2486Critical 9.8
    A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3.
    wavlink · wl-wn535k2 firmware
    EPSS30%
    1 exploit
    Published Jul 20, 2022
  • CVE-2021-43711Critical 9.8
    The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters.
    totolink · ex200 firmware
    EPSS38%
    1 exploit
    Published Jan 4, 2022
  • CVE-2020-10548Critical 9.8
    rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection.
    rconfig · rconfig
    EPSS37%
    1 exploit
    Published Jun 4, 2020
  • CVE-2020-10547Critical 9.8
    rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection.
    rconfig · rconfig
    EPSS37%
    1 exploit
    Published Jun 4, 2020
  • CVE-2019-8050Critical 9.8
    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability.
    adobe · acrobat dc
    EPSS41%
    1 exploit
    Published Aug 20, 2019
  • CVE-2019-7442Critical 9.8
    An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read arbitrary files or potentially bypass authentication via a crafted DTD in the SAML authentication system.
    cyberark · enterprise password vault
    EPSS40%
    1 exploit
    Published May 8, 2019
Showing 451–500 of 729

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.

Figures as of Oct 20, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.