Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 19, 2026
178 vulnerabilities · highest score first
- CVE-2014-8499Medium 6.5Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter to (1)…manageengine · password manager proEPSS36%3 exploitsPublished Nov 17, 2014
- CVE-2014-2383Medium 6.8DOMPDF Arbitrary File Readdompdf · dompdfEPSS39%1 exploitPublished May 14, 2022
- CVE-2012-5612Medium 6.5mysql: MDL subsystem heap-based buffer overflowmariadb · mariadbEPSS21%2 exploitsPublished Dec 1, 2012
- CVE-2011-0966Medium 6.8Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to read arbitrary files via a ..cisco · ciscoworks common servicesEPSS41%3 exploitsPublished May 20, 2011
- CVE-2010-4172Medium 4.3Improper Neutralization of Input During Web Page Generation in Apache Tomcatapache · tomcatEPSS42%1 exploitPublished May 14, 2022
- CVE-2006-3835Medium 5.0Apache Tomcat Reveals Directoriesapache · tomcatEPSS46%1 exploitPublished May 1, 2022
- CVE-2003-1025Medium 4.3Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL…microsoft · internet explorerEPSS27%3 exploitsPublished Jan 20, 2004
- CVE-2021-31642Medium 6.5A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC.chiyu-tech · bf-630 firmwareEPSS44%2 exploitsPublished Jun 1, 2021
- CVE-2019-19368Medium 6.1A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1.maxum · rumpusEPSS26%3 exploitsPublished Dec 16, 2019
- CVE-2019-17671Medium 5.3In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.wordpress · wordpressEPSS37%1 exploitPublished Oct 17, 2019
- CVE-2019-15276Medium 6.5A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.cisco · wireless lan controller softwareEPSS46%2 exploitsPublished Nov 26, 2019
- CVE-2018-8716Medium 5.4WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.wso2 · identity serverEPSS38%3 exploitsPublished Apr 25, 2018
- CVE-2018-16133Medium 5.3Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.cybrotech · cybrohttpserverEPSS39%3 exploitsPublished Aug 29, 2018
- CVE-2017-1129Medium 6.5IBM Notes 8.5 and 9.0 is vulnerable to a denial of service.ibm · expeditorEPSS30%3 exploitsPublished Sep 5, 2017
- CVE-2016-3115Medium 6.4Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.openbsd · opensshEPSS36%1 exploitPublished Mar 22, 2016
- CVE-2015-2067Medium 5.0MAGMI plugin for Magento Server Directory Traversalmagmi project · magmiEPSS38%1 exploitPublished May 13, 2022
- CVE-2015-0252Medium 5.0internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.apache · xerces-c\+\+EPSS40%1 exploitPublished Mar 24, 2015
- CVE-2014-8676Medium 5.3Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a ..soplanning · soplanningEPSS41%1 exploitPublished Aug 31, 2017
- CVE-2013-5528Medium 4.0Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815.cisco · unified communications managerEPSS23%3 exploitsPublished Oct 11, 2013
- CVE-2013-4450Medium 5.0The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.nodejs · nodejsEPSS37%1 exploitPublished Oct 21, 2013
- CVE-2011-4362Medium 5.0Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that…lighttpd · lighttpdEPSS21%2 exploitsPublished Dec 24, 2011
- CVE-2011-0959Medium 4.3Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to inject arbitrary web script or HTML via (1) the extn parameter to iptm/advancedfind.do, (2) the deviceInstanceName parameter to iptm/ddv.do, the…cisco · unified operations managerEPSS21%7 exploitsPublished May 20, 2011
- CVE-2011-0514Medium 5.0The RDS service (rds.exe) in HP Data Protector Manager 6.11 allows remote attackers to cause a denial of service (crash) via a packet with a large data size to TCP port 1530.hp · data protector managerEPSS49%2 exploitsPublished Jan 20, 2011
- CVE-2008-6504Medium 5.0Improper Input Validation in OpenSymphony XWorkapache · strutsEPSS37%1 exploitPublished May 17, 2022
- CVE-2007-3382Medium 4.3Apache Tomcat treats single quotes as delimiters in cookiesapache · tomcatEPSS37%1 exploitPublished May 1, 2022
- CVE-2006-0030Medium 5.1Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic, which leads to memory corruption.microsoft · excelEPSS40%1 exploitPublished Mar 14, 2006
- CVE-2002-2007Medium 5.0The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3)…apache · tomcatEPSS41%3 exploitsPublished Dec 31, 2002
- CVE-2002-0659Medium 5.0The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encodings.openssl · opensslEPSS36%1 exploitPublished Aug 12, 2002
- CVE-2026-50229Medium 6.1Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.apache · tomcatEPSS4.1%2 exploitsPublished Jun 29, 2026
- CVE-2025-23200Medium 5.4LibreNMS Misc Section Stored Cross-site Scripting vulnerabilitylibrenms · librenmsEPSS31%1 exploitPublished Jan 16, 2025
- CVE-2015-5471Medium 5.3Swim Team < 1.45.1085 - Directory Traversalswim team project · swim teamEPSS32%2 exploitsPublished Jul 7, 2015
- CVE-2015-3622Medium 5.9The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.gnu · libtasn1EPSS33%1 exploitPublished May 12, 2015
- CVE-2013-3827Medium 5.0Path Traversal in Eclipse Mojarraoracle · fusion middlewareEPSS32%1 exploitPublished May 17, 2022
- CVE-2013-2160Medium 5.0Missing XML Validation in Apache CXFapache · cxfEPSS32%1 exploitPublished May 13, 2022
- CVE-2012-0393Medium 6.4Apache Struts's ParameterInterceptor component does not prevent access to public constructorsapache · strutsEPSS36%1 exploitPublished May 4, 2022
- CVE-2011-2755Medium 5.0Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors.manageengine · servicedesk plusEPSS31%3 exploitsPublished Jul 17, 2011
- CVE-2010-2103Medium 4.3Improper Neutralization of Input During Web Page Generation in Apache Axis2apache · axis2EPSS35%1 exploitPublished May 14, 2022
- CVE-2009-0026Medium 4.3Apache Jackrabbit contains Cross-site Scriptingapache · jackrabbitEPSS27%2 exploitsPublished May 2, 2022
- CVE-2003-0227Medium 5.0The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute…microsoft · windows ntEPSS34%1 exploitPublished Jun 9, 2003
- CVE-2003-0042Medium 5.0Jakarta Tomcat Directory Listing vulnerabilityapache · tomcatEPSS46%1 exploitPublished Apr 29, 2022
- CVE-2002-0597Medium 5.0LANMAN service on Microsoft Windows 2000 allows remote attackers to cause a denial of service (CPU/memory exhaustion) via a stream of malformed data to microsoft-ds port 445.microsoft · windows 2000EPSS47%2 exploitsPublished Jun 18, 2002
- CVE-1999-1575Medium 5.1The Kodak/Wang (1) Image Edit (imgedit.ocx), (2) Image Annotation (imgedit.ocx), (3) Image Scan (imgscan.ocx), (4) Thumbnail Image (imgthumb.ocx), (5) Image Admin (imgadmin.ocx), (6) HHOpen (hhopen.ocx), (7) Registration Wizard (regwizc.dll), and (8) IE Active Setup…microsoft · internet explorerEPSS36%3 exploitsPublished Sep 10, 1999
- CVE-2024-50352Medium 5.4LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.phplibrenms · librenmsEPSS39%1 exploitPublished Nov 15, 2024
- CVE-2022-26263Medium 6.1Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.yonyou · u8\+EPSS42%1 exploitPublished Mar 25, 2022
- CVE-2022-24632Medium 5.3It is directory traversal during file download via the BrowseFiles.php view parameter.audiocodes · device manager expressEPSS27%1 exploitPublished May 30, 2023
- CVE-2021-25156Medium 4.9A remote arbitrary directory create vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant…arubanetworks · instantEPSS40%2 exploitsPublished Mar 29, 2021
- CVE-2021-24563Medium 6.1The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directlyfrontend uploader project · frontend uploaderEPSS26%2 exploitsPublished Oct 11, 2021
- CVE-2020-28976Medium 5.3The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability.canto · cantoEPSS28%1 exploitPublished Nov 30, 2020
- CVE-2020-11798Medium 5.3A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation.mitel · micollab audio\, web \& video conferencingEPSS49%1 exploitPublished Jun 10, 2020
- CVE-2018-1189Medium 4.8Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Antivirus Page within the OneFS web administration interface.dell · emc isilonEPSS28%2 exploitsPublished Mar 26, 2018
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-8499 | Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter to (1)… manageengine · password manager pro | Medium 6.5 | 36% | 3 exploits | |
| CVE-2014-2383 | DOMPDF Arbitrary File Read dompdf · dompdf | Medium 6.8 | 39% | 1 exploit | |
| CVE-2012-5612 | mysql: MDL subsystem heap-based buffer overflow mariadb · mariadb | Medium 6.5 | 21% | 2 exploits | |
| CVE-2011-0966 | Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to read arbitrary files via a .. cisco · ciscoworks common services | Medium 6.8 | 41% | 3 exploits | |
| CVE-2010-4172 | Improper Neutralization of Input During Web Page Generation in Apache Tomcat apache · tomcat | Medium 4.3 | 42% | 1 exploit | |
| CVE-2006-3835 | Apache Tomcat Reveals Directories apache · tomcat | Medium 5.0 | 46% | 1 exploit | |
| CVE-2003-1025 | Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL… microsoft · internet explorer | Medium 4.3 | 27% | 3 exploits | |
| CVE-2021-31642 | A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. chiyu-tech · bf-630 firmware | Medium 6.5 | 44% | 2 exploits | |
| CVE-2019-19368 | A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. maxum · rumpus | Medium 6.1 | 26% | 3 exploits | |
| CVE-2019-17671 | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled. wordpress · wordpress | Medium 5.3 | 37% | 1 exploit | |
| CVE-2019-15276 | A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. cisco · wireless lan controller software | Medium 6.5 | 46% | 2 exploits | |
| CVE-2018-8716 | WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers. wso2 · identity server | Medium 5.4 | 38% | 3 exploits | |
| CVE-2018-16133 | Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI. cybrotech · cybrohttpserver | Medium 5.3 | 39% | 3 exploits | |
| CVE-2017-1129 | IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. ibm · expeditor | Medium 6.5 | 30% | 3 exploits | |
| CVE-2016-3115 | Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions. openbsd · openssh | Medium 6.4 | 36% | 1 exploit | |
| CVE-2015-2067 | MAGMI plugin for Magento Server Directory Traversal magmi project · magmi | Medium 5.0 | 38% | 1 exploit | |
| CVE-2015-0252 | internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data. apache · xerces-c\+\+ | Medium 5.0 | 40% | 1 exploit | |
| CVE-2014-8676 | Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. soplanning · soplanning | Medium 5.3 | 41% | 1 exploit | |
| CVE-2013-5528 | Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815. cisco · unified communications manager | Medium 4.0 | 23% | 3 exploits | |
| CVE-2013-4450 | The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response. nodejs · nodejs | Medium 5.0 | 37% | 1 exploit | |
| CVE-2011-4362 | Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that… lighttpd · lighttpd | Medium 5.0 | 21% | 2 exploits | |
| CVE-2011-0959 | Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to inject arbitrary web script or HTML via (1) the extn parameter to iptm/advancedfind.do, (2) the deviceInstanceName parameter to iptm/ddv.do, the… cisco · unified operations manager | Medium 4.3 | 21% | 7 exploits | |
| CVE-2011-0514 | The RDS service (rds.exe) in HP Data Protector Manager 6.11 allows remote attackers to cause a denial of service (crash) via a packet with a large data size to TCP port 1530. hp · data protector manager | Medium 5.0 | 49% | 2 exploits | |
| CVE-2008-6504 | Improper Input Validation in OpenSymphony XWork apache · struts | Medium 5.0 | 37% | 1 exploit | |
| CVE-2007-3382 | Apache Tomcat treats single quotes as delimiters in cookies apache · tomcat | Medium 4.3 | 37% | 1 exploit | |
| CVE-2006-0030 | Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic, which leads to memory corruption. microsoft · excel | Medium 5.1 | 40% | 1 exploit | |
| CVE-2002-2007 | The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3)… apache · tomcat | Medium 5.0 | 41% | 3 exploits | |
| CVE-2002-0659 | The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encodings. openssl · openssl | Medium 5.0 | 36% | 1 exploit | |
| CVE-2026-50229 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. apache · tomcat | Medium 6.1 | 4.1% | 2 exploits | |
| CVE-2025-23200 | LibreNMS Misc Section Stored Cross-site Scripting vulnerability librenms · librenms | Medium 5.4 | 31% | 1 exploit | |
| CVE-2015-5471 | Swim Team < 1.45.1085 - Directory Traversal swim team project · swim team | Medium 5.3 | 32% | 2 exploits | |
| CVE-2015-3622 | The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate. gnu · libtasn1 | Medium 5.9 | 33% | 1 exploit | |
| CVE-2013-3827 | Path Traversal in Eclipse Mojarra oracle · fusion middleware | Medium 5.0 | 32% | 1 exploit | |
| CVE-2013-2160 | Missing XML Validation in Apache CXF apache · cxf | Medium 5.0 | 32% | 1 exploit | |
| CVE-2012-0393 | Apache Struts's ParameterInterceptor component does not prevent access to public constructors apache · struts | Medium 6.4 | 36% | 1 exploit | |
| CVE-2011-2755 | Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors. manageengine · servicedesk plus | Medium 5.0 | 31% | 3 exploits | |
| CVE-2010-2103 | Improper Neutralization of Input During Web Page Generation in Apache Axis2 apache · axis2 | Medium 4.3 | 35% | 1 exploit | |
| CVE-2009-0026 | Apache Jackrabbit contains Cross-site Scripting apache · jackrabbit | Medium 4.3 | 27% | 2 exploits | |
| CVE-2003-0227 | The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute… microsoft · windows nt | Medium 5.0 | 34% | 1 exploit | |
| CVE-2003-0042 | Jakarta Tomcat Directory Listing vulnerability apache · tomcat | Medium 5.0 | 46% | 1 exploit | |
| CVE-2002-0597 | LANMAN service on Microsoft Windows 2000 allows remote attackers to cause a denial of service (CPU/memory exhaustion) via a stream of malformed data to microsoft-ds port 445. microsoft · windows 2000 | Medium 5.0 | 47% | 2 exploits | |
| CVE-1999-1575 | The Kodak/Wang (1) Image Edit (imgedit.ocx), (2) Image Annotation (imgedit.ocx), (3) Image Scan (imgscan.ocx), (4) Thumbnail Image (imgthumb.ocx), (5) Image Admin (imgadmin.ocx), (6) HHOpen (hhopen.ocx), (7) Registration Wizard (regwizc.dll), and (8) IE Active Setup… microsoft · internet explorer | Medium 5.1 | 36% | 3 exploits | |
| CVE-2024-50352 | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php librenms · librenms | Medium 5.4 | 39% | 1 exploit | |
| CVE-2022-26263 | Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp. yonyou · u8\+ | Medium 6.1 | 42% | 1 exploit | |
| CVE-2022-24632 | It is directory traversal during file download via the BrowseFiles.php view parameter. audiocodes · device manager express | Medium 5.3 | 27% | 1 exploit | |
| CVE-2021-25156 | A remote arbitrary directory create vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant… arubanetworks · instant | Medium 4.9 | 40% | 2 exploits | |
| CVE-2021-24563 | The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly frontend uploader project · frontend uploader | Medium 6.1 | 26% | 2 exploits | |
| CVE-2020-28976 | The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. canto · canto | Medium 5.3 | 28% | 1 exploit | |
| CVE-2020-11798 | A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. mitel · micollab audio\, web \& video conferencing | Medium 5.3 | 49% | 1 exploit | |
| CVE-2018-1189 | Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Antivirus Page within the OneFS web administration interface. dell · emc isilon | Medium 4.8 | 28% | 2 exploits |
Showing 51–100 of 178
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.