Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 20, 2026
503 vulnerabilities · highest score first
- CVE-2006-3431High 7.5Buffer overflow in certain Asian language versions of Microsoft Excel might allow user-assisted attackers to execute arbitrary code via a crafted STYLE record in a spreadsheet that triggers the overflow when the user attempts to repair the document or selects the "Style" option,…microsoft · excelEPSS28%1 exploitPublished Jul 7, 2006
- CVE-2004-0727High 7.5Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the…microsoft · internet explorerEPSS40%1 exploitPublished Jul 27, 2004
- CVE-2004-0104High 7.5Multiple format string vulnerabilities in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.metamail corporation · metamailEPSS26%1 exploitPublished Feb 18, 2004
- CVE-2003-0910High 7.2The NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows local attackers to gain access to kernel memory and execute arbitrary code via an expand-down data segment descriptor descriptor that points…microsoft · windows 2000EPSS26%1 exploitPublished Jun 1, 2004
- CVE-2003-0908High 7.2The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a Windows message that accesses the context sensitive help button in the GUI, as demonstrated using…microsoft · windows 2000EPSS26%1 exploitPublished Jun 1, 2004
- CVE-2003-0838High 7.5Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but…microsoft · internet explorerEPSS38%1 exploitPublished Nov 17, 2003
- CVE-2003-0113High 7.5Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code via an HTTP response containing long values in (1) Content-type and (2) Content-encoding fields.microsoft · internet explorerEPSS39%1 exploitPublished May 12, 2003
- CVE-2002-1973High 7.5Buffer overflow in CHttpServer::OnParseError in the ISAPI extension (Isapi.cpp) when built using Microsoft Foundation Class (MFC) static libraries in Visual C++ 5.0, and 6.0 before SP3, as used in multiple products including BadBlue, allows remote attackers to cause a denial of…working resources inc. · badblueEPSS40%1 exploitPublished Dec 31, 2002
- CVE-2002-1412High 7.5Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERY_BASEDIR variable that points to a directory or URL that contains a Trojan horse init.php script.gallery project · galleryEPSS39%1 exploitPublished Apr 11, 2003
- CVE-2001-0239High 7.5Microsoft Internet Security and Acceleration (ISA) Server 2000 Web Proxy allows remote attackers to cause a denial of service via a long web request with a specific type.microsoft · isa serverEPSS28%1 exploitPublished Jul 2, 2001
- CVE-2000-0834High 7.5The Windows 2000 telnet client attempts to perform NTLM authentication by default, which allows remote attackers to capture and replay the NTLM challenge/response via a telnet:// URL that points to the malicious server, aka the "Windows 2000 Telnet Client NTLM Authentication"…microsoft · windows 2000EPSS40%1 exploitPublished Nov 14, 2000
- CVE-1999-0236High 7.5ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs.apache · http serverEPSS26%1 exploitPublished Jan 1, 1997
- CVE-2026-85250High 7.5Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.Published Oct 19, 2026
- CVE-2026-58221High 8.8Samba AD authenticated LDAP access domain takeover.Published Jul 28, 2026
- CVE-2026-53995High 8.8MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint.Published Oct 19, 2026
- CVE-2026-52856High 7.5Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic.EPSS0.6%1 exploitPublished Jul 31, 2026
- CVE-2026-102578High 8.8Moodle: sql injection in question bank web servicemoodle · moodleEPSS0.3%1 exploitPublished Sep 30, 2026
- CVE-2025-7206High 8.9A vulnerability, which was classified as critical, has been found in D-Link DIR-825 2.10.dlink · dir-825 firmwareEPSS22%1 exploitPublished Jul 8, 2025
- CVE-2025-47166High 8.8Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint enterprise serverEPSS22%1 exploitPublished Jun 9, 2025
- CVE-2024-27356High 7.5An issue was discovered on certain GL-iNet devices.gl-inet · a1300 firmwareEPSS24%1 exploitPublished Feb 26, 2024
- CVE-2023-2522High 7.2It has been declared as critical.feiyuxing · vec40g firmwareEPSS34%1 exploitPublished May 4, 2023
- CVE-2022-36620High 7.5D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting.dlink · dir-816 firmwareEPSS24%1 exploitPublished Aug 31, 2022
- CVE-2022-36309High 8.8Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI.airspan · airvelocity 1500 firmwareEPSS25%1 exploitPublished Aug 15, 2022
- CVE-2022-34047High 7.5An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd].wavlink · wl-wn530hg4 firmwareEPSS22%1 exploitPublished Jul 20, 2022
- CVE-2022-34046High 7.5An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);].wavlink · wn533a8 firmwareEPSS21%1 exploitPublished Jul 20, 2022
- CVE-2021-45043High 7.5HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.hd-network real-time monitoring system project · hd-network real-time monitoring systemEPSS33%1 exploitPublished Dec 15, 2021
- CVE-2021-40382High 7.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.comprotech · ip570 firmwareEPSS23%1 exploitPublished Sep 1, 2021
- CVE-2021-40381High 7.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.comprotech · ip570 firmwareEPSS23%1 exploitPublished Sep 1, 2021
- CVE-2021-40380High 7.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.comprotech · ip570 firmwareEPSS23%1 exploitPublished Sep 1, 2021
- CVE-2021-40379High 7.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.comprotech · ip570 firmwareEPSS22%1 exploitPublished Sep 1, 2021
- CVE-2020-5192High 8.8PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not validating user input, and allow for the application's database and information to be fully compromised.phpgurukul · hospital management systemEPSS24%1 exploitPublished Jan 5, 2020
- CVE-2020-16138High 7.5A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled.cisco · unified ip conference station 7937g firmwareEPSS21%1 exploitPublished Aug 12, 2020
- CVE-2019-9202High 8.8Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.nagios · incident managerEPSS24%1 exploitPublished Mar 28, 2019
- CVE-2019-19494High 8.8Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser.compal · 7284e firmwareEPSS23%1 exploitPublished Jan 9, 2020
- CVE-2019-1914High 7.2A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated, remote attacker to perform a command injection attack.cisco · sf-220-24 firmwareEPSS25%1 exploitPublished Aug 7, 2019
- CVE-2019-12480High 7.5BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, AtomicReadFile and DeviceCommunicationControl services.bacnet protocol stack project · bacnet protocol stackEPSS34%1 exploitPublished May 30, 2019
- CVE-2019-0667High 7.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'.microsoft · internet explorerEPSS31%1 exploitPublished Apr 8, 2019
- CVE-2018-18980High 7.5An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request.zohocorp · manageengine network configuration managerEPSS25%1 exploitPublished Nov 6, 2018
- CVE-2015-2470High 9.3Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Integer Underflow Vulnerability."microsoft · officeEPSS27%1 exploitPublished Aug 14, 2015
- CVE-2015-2469High 9.3Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."microsoft · officeEPSS27%1 exploitPublished Aug 14, 2015
- CVE-2015-2468High 9.3Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office…microsoft · officeEPSS30%1 exploitPublished Aug 14, 2015
- CVE-2015-2467High 9.3Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."microsoft · officeEPSS28%1 exploitPublished Aug 14, 2015
- CVE-2010-2746High 7.6Heap-based buffer overflow in Comctl32.dll (aka the common control library) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when a third-party SVG viewer is used, allows remote…microsoft · windows 7EPSS36%1 exploitPublished Oct 13, 2010
- CVE-2006-4182High 7.5Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when…clam anti-virus · clamavEPSS21%1 exploitPublished Oct 16, 2006
- CVE-2005-1383High 7.5The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server mod_access restrictions via a request to the webcache TCP port 7778.oracle · application serverEPSS31%1 exploitPublished May 3, 2005
- CVE-2004-0399High 7.5Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification.university of cambridge · eximEPSS21%1 exploitPublished Jul 7, 2004
- CVE-2003-0111High 7.5The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier, as used in Windows and Internet Explorer, allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet, aka "Flaw in Microsoft VM Could…microsoft · virtual machineEPSS36%1 exploitPublished May 5, 2003
- CVE-2002-1847High 7.5Buffer overflow in mplay32.exe of Microsoft Windows Media Player (WMP) 6.3 through 7.1 allows remote attackers to execute arbitrary commands via a long mp3 filename command line argument.microsoft · windows media playerEPSS34%1 exploitPublished Dec 31, 2002
- CVE-2002-1317High 7.5Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query.sun · solarisEPSS24%1 exploitPublished Dec 11, 2002
- CVE-2002-1179High 7.5Buffer overflow in the S/MIME Parsing capability in Microsoft Outlook Express 5.5 and 6.0 allows remote attackers to execute arbitrary code via a digitally signed email with a long "From" address, which triggers the overflow when the user views or previews the message.microsoft · outlook expressEPSS22%1 exploitPublished Oct 28, 2002
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2006-3431 | Buffer overflow in certain Asian language versions of Microsoft Excel might allow user-assisted attackers to execute arbitrary code via a crafted STYLE record in a spreadsheet that triggers the overflow when the user attempts to repair the document or selects the "Style" option,… microsoft · excel | High 7.5 | 28% | 1 exploit | |
| CVE-2004-0727 | Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the… microsoft · internet explorer | High 7.5 | 40% | 1 exploit | |
| CVE-2004-0104 | Multiple format string vulnerabilities in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code. metamail corporation · metamail | High 7.5 | 26% | 1 exploit | |
| CVE-2003-0910 | The NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows local attackers to gain access to kernel memory and execute arbitrary code via an expand-down data segment descriptor descriptor that points… microsoft · windows 2000 | High 7.2 | 26% | 1 exploit | |
| CVE-2003-0908 | The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a Windows message that accesses the context sensitive help button in the GUI, as demonstrated using… microsoft · windows 2000 | High 7.2 | 26% | 1 exploit | |
| CVE-2003-0838 | Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but… microsoft · internet explorer | High 7.5 | 38% | 1 exploit | |
| CVE-2003-0113 | Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code via an HTTP response containing long values in (1) Content-type and (2) Content-encoding fields. microsoft · internet explorer | High 7.5 | 39% | 1 exploit | |
| CVE-2002-1973 | Buffer overflow in CHttpServer::OnParseError in the ISAPI extension (Isapi.cpp) when built using Microsoft Foundation Class (MFC) static libraries in Visual C++ 5.0, and 6.0 before SP3, as used in multiple products including BadBlue, allows remote attackers to cause a denial of… working resources inc. · badblue | High 7.5 | 40% | 1 exploit | |
| CVE-2002-1412 | Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a modified GALLERY_BASEDIR variable that points to a directory or URL that contains a Trojan horse init.php script. gallery project · gallery | High 7.5 | 39% | 1 exploit | |
| CVE-2001-0239 | Microsoft Internet Security and Acceleration (ISA) Server 2000 Web Proxy allows remote attackers to cause a denial of service via a long web request with a specific type. microsoft · isa server | High 7.5 | 28% | 1 exploit | |
| CVE-2000-0834 | The Windows 2000 telnet client attempts to perform NTLM authentication by default, which allows remote attackers to capture and replay the NTLM challenge/response via a telnet:// URL that points to the malicious server, aka the "Windows 2000 Telnet Client NTLM Authentication"… microsoft · windows 2000 | High 7.5 | 40% | 1 exploit | |
| CVE-1999-0236 | ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs. apache · http server | High 7.5 | 26% | 1 exploit | |
| CVE-2026-85250 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. | High 7.5 | · | 1 exploit | |
| CVE-2026-58221 | Samba AD authenticated LDAP access domain takeover. | High 8.8 | · | 1 exploit | |
| CVE-2026-53995 | MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. | High 8.8 | · | 1 exploit | |
| CVE-2026-52856 | Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. | High 7.5 | 0.6% | 1 exploit | |
| CVE-2026-102578 | Moodle: sql injection in question bank web service moodle · moodle | High 8.8 | 0.3% | 1 exploit | |
| CVE-2025-7206 | A vulnerability, which was classified as critical, has been found in D-Link DIR-825 2.10. dlink · dir-825 firmware | High 8.9 | 22% | 1 exploit | |
| CVE-2025-47166 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint enterprise server | High 8.8 | 22% | 1 exploit | |
| CVE-2024-27356 | An issue was discovered on certain GL-iNet devices. gl-inet · a1300 firmware | High 7.5 | 24% | 1 exploit | |
| CVE-2023-2522 | It has been declared as critical. feiyuxing · vec40g firmware | High 7.2 | 34% | 1 exploit | |
| CVE-2022-36620 | D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting. dlink · dir-816 firmware | High 7.5 | 24% | 1 exploit | |
| CVE-2022-36309 | Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI. airspan · airvelocity 1500 firmware | High 8.8 | 25% | 1 exploit | |
| CVE-2022-34047 | An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd]. wavlink · wl-wn530hg4 firmware | High 7.5 | 22% | 1 exploit | |
| CVE-2022-34046 | An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);]. wavlink · wn533a8 firmware | High 7.5 | 21% | 1 exploit | |
| CVE-2021-45043 | HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter. hd-network real-time monitoring system project · hd-network real-time monitoring system | High 7.5 | 33% | 1 exploit | |
| CVE-2021-40382 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. comprotech · ip570 firmware | High 7.5 | 23% | 1 exploit | |
| CVE-2021-40381 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. comprotech · ip570 firmware | High 7.5 | 23% | 1 exploit | |
| CVE-2021-40380 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. comprotech · ip570 firmware | High 7.5 | 23% | 1 exploit | |
| CVE-2021-40379 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. comprotech · ip570 firmware | High 7.5 | 22% | 1 exploit | |
| CVE-2020-5192 | PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not validating user input, and allow for the application's database and information to be fully compromised. phpgurukul · hospital management system | High 8.8 | 24% | 1 exploit | |
| CVE-2020-16138 | A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. cisco · unified ip conference station 7937g firmware | High 7.5 | 21% | 1 exploit | |
| CVE-2019-9202 | Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues. nagios · incident manager | High 8.8 | 24% | 1 exploit | |
| CVE-2019-19494 | Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. compal · 7284e firmware | High 8.8 | 23% | 1 exploit | |
| CVE-2019-1914 | A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated, remote attacker to perform a command injection attack. cisco · sf-220-24 firmware | High 7.2 | 25% | 1 exploit | |
| CVE-2019-12480 | BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, AtomicReadFile and DeviceCommunicationControl services. bacnet protocol stack project · bacnet protocol stack | High 7.5 | 34% | 1 exploit | |
| CVE-2019-0667 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. microsoft · internet explorer | High 7.5 | 31% | 1 exploit | |
| CVE-2018-18980 | An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. zohocorp · manageengine network configuration manager | High 7.5 | 25% | 1 exploit | |
| CVE-2015-2470 | Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Integer Underflow Vulnerability." microsoft · office | High 9.3 | 27% | 1 exploit | |
| CVE-2015-2469 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." microsoft · office | High 9.3 | 27% | 1 exploit | |
| CVE-2015-2468 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office… microsoft · office | High 9.3 | 30% | 1 exploit | |
| CVE-2015-2467 | Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." microsoft · office | High 9.3 | 28% | 1 exploit | |
| CVE-2010-2746 | Heap-based buffer overflow in Comctl32.dll (aka the common control library) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when a third-party SVG viewer is used, allows remote… microsoft · windows 7 | High 7.6 | 36% | 1 exploit | |
| CVE-2006-4182 | Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when… clam anti-virus · clamav | High 7.5 | 21% | 1 exploit | |
| CVE-2005-1383 | The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server mod_access restrictions via a request to the webcache TCP port 7778. oracle · application server | High 7.5 | 31% | 1 exploit | |
| CVE-2004-0399 | Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification. university of cambridge · exim | High 7.5 | 21% | 1 exploit | |
| CVE-2003-0111 | The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier, as used in Windows and Internet Explorer, allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet, aka "Flaw in Microsoft VM Could… microsoft · virtual machine | High 7.5 | 36% | 1 exploit | |
| CVE-2002-1847 | Buffer overflow in mplay32.exe of Microsoft Windows Media Player (WMP) 6.3 through 7.1 allows remote attackers to execute arbitrary commands via a long mp3 filename command line argument. microsoft · windows media player | High 7.5 | 34% | 1 exploit | |
| CVE-2002-1317 | Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query. sun · solaris | High 7.5 | 24% | 1 exploit | |
| CVE-2002-1179 | Buffer overflow in the S/MIME Parsing capability in Microsoft Outlook Express 5.5 and 6.0 allows remote attackers to execute arbitrary code via a digitally signed email with a long "From" address, which triggers the overflow when the user views or previews the message. microsoft · outlook express | High 7.5 | 22% | 1 exploit |
Showing 451–500 of 503
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.