Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 20, 2026
1,412 vulnerabilities · highest score first
- CVE-2012-2052Critical 9.3Stack-based buffer overflow in the U3D.8BI library plugin in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arbitrary code via a long Collada asset element in a DAE file, as demonstrated by the cameraYFov value in the…adobe · photoshop cs5EPSS23%1 exploitPublished Jun 19, 2014
- CVE-2012-0393Medium 6.4Apache Struts's ParameterInterceptor component does not prevent access to public constructorsapache · strutsEPSS36%1 exploitPublished May 4, 2022
- CVE-2011-3315High 7.8Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response…cisco · unified communications managerEPSS26%1 exploitPublished Oct 27, 2011
- CVE-2011-2755Medium 5.0Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors.manageengine · servicedesk plusEPSS31%3 exploitsPublished Jul 17, 2011
- CVE-2011-2013Critical 9.8Integer overflow in the TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code by sending a sequence of crafted UDP packets to a closed port, aka "Reference…microsoft · windows 7EPSS32%1 exploitPublished Nov 8, 2011
- CVE-2010-2103Medium 4.3Improper Neutralization of Input During Web Page Generation in Apache Axis2apache · axis2EPSS35%1 exploitPublished May 14, 2022
- CVE-2010-1173High 7.1The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a…linux · linux kernelEPSS21%1 exploitPublished May 7, 2010
- CVE-2010-0926Low 3.5The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in…samba · sambaEPSS30%2 exploitsPublished Mar 10, 2010
- CVE-2010-0476Critical 10.0The SMB client in Microsoft Windows Server 2003 SP2, Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and reboot) via a crafted SMB…microsoft · windows server 2003EPSS34%1 exploitPublished Apr 14, 2010
- CVE-2010-0027Critical 9.3The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, does not properly process input parameters, which allows remote attackers to execute arbitrary…microsoft · internet explorerEPSS34%1 exploitPublished Jan 22, 2010
- CVE-2010-0017Critical 9.3Race condition in the SMB client implementation in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code, and in the SMB client implementation in Windows Vista Gold, SP1, and SP2 and Server 2008 Gold…microsoft · windows 7EPSS31%1 exploitPublished Feb 10, 2010
- CVE-2009-0026Medium 4.3Apache Jackrabbit contains Cross-site Scriptingapache · jackrabbitEPSS27%2 exploitsPublished May 2, 2022
- CVE-2008-0117Critical 9.3Unspecified vulnerability in Microsoft Excel 2000 SP3 and 2002 SP2, and Office 2004 and 2008 for Mac, allows user-assisted remote attackers to execute arbitrary code via crafted conditional formatting values, aka "Excel Conditional Formatting Vulnerability."microsoft · excelEPSS33%1 exploitPublished Mar 11, 2008
- CVE-2008-0112Critical 9.3Unspecified vulnerability in Microsoft Excel 2000 SP3, and Office for Mac 2004 and 2008 allows user-assisted remote attackers to execute arbitrary code via a crafted .SLK file that is not properly handled when importing the file, aka "Excel File Import Vulnerability."microsoft · excelEPSS32%1 exploitPublished Mar 11, 2008
- CVE-2007-2221Critical 9.3Unspecified vulnerability in the mdsauth.dll COM object in Microsoft Windows Media Server in the Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 or SP2; or 7 on Windows Vista allows remote…microsoft · internet explorerEPSS35%1 exploitPublished May 8, 2007
- CVE-2007-1658Critical 9.3Windows Mail in Microsoft Windows Vista might allow user-assisted remote attackers to execute certain programs via a link to a (1) local file or (2) UNC share pathname in which there is a directory with the same base name as an executable program at the same level, as…microsoft · windows vistaEPSS36%1 exploitPublished Mar 24, 2007
- CVE-2007-0612High 7.8Multiple ActiveX controls in Microsoft Windows 2000, XP, 2003, and Vista allows remote attackers to cause a denial of service (Internet Explorer crash) by accessing the bgColor, fgColor, linkColor, alinkColor, vlinkColor, or defaultCharset properties in the (1) giffile, (2)…microsoft · internet explorerEPSS44%1 exploitPublished Jan 31, 2007
- CVE-2005-3524Critical 10.0Buffer overflow in the SSL-ready version of linux-ftpd (linux-ftpd-ssl) 0.17 allows remote attackers to execute arbitrary code by creating a long directory name, then executing the XPWD command.linux-ftpd-ssl · linux-ftpd-sslEPSS21%1 exploitPublished Nov 7, 2005
- CVE-2005-3277Critical 10.0The LPD service in HP-UX 10.20 11.11 (11i) and earlier allows remote attackers to execute arbitrary code via shell metacharacters ("" or single backquote) in a request that is not properly handled when an error occurs, as demonstrated by killing the connection, a different…hp · hp-uxEPSS22%1 exploitPublished Oct 21, 2005
- CVE-2004-2289Critical 10.0Microsoft Windows XP Explorer allows local users to execute arbitrary code via a system folder with a Desktop.ini file containing a .ShellClassInfo specifier with a CLSID value that is associated with an executable file.microsoft · windows xpEPSS23%1 exploitPublished Dec 31, 2004
- CVE-2003-1328High 7.5The showHelp() function in Microsoft Internet Explorer 5.01, 5.5, and 6.0 supports certain types of pluggable protocols that allow remote attackers to bypass the cross-domain security model and execute arbitrary code, aka "Improper Cross Domain Security Validation with ShowHelp…microsoft · internet explorerEPSS39%1 exploitPublished Feb 19, 2003
- CVE-2003-0686High 7.5Buffer overflow in PAM SMB module (pam_smb) 1.1.6 and earlier, when authenticating to a remote service, allows remote attackers to execute arbitrary code.dave airlie · pam smbEPSS27%1 exploitPublished Aug 26, 2003
- CVE-2003-0227Medium 5.0The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute…microsoft · windows ntEPSS34%1 exploitPublished Jun 9, 2003
- CVE-2003-0042Medium 5.0Jakarta Tomcat Directory Listing vulnerabilityapache · tomcatEPSS46%1 exploitPublished Apr 29, 2022
- CVE-2002-1131High 7.5Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.squirrelmail · squirrelmailEPSS26%1 exploitPublished Sep 16, 2002
- CVE-2002-0866High 7.5Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DLLs (dynamic link libraries) via a Java applet that calls the constructor for com.ms.jdbc.odbc.JdbcOdbc with the desired DLL…microsoft · virtual machineEPSS41%1 exploitPublished Oct 11, 2002
- CVE-2002-0724High 7.5Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of service (crash) via a SMB_COM_TRANSACTION packet with a request for the (1) NetShareEnum, (2) NetServerEnum2, or (3) NetServerEnum3,…microsoft · windows 2000EPSS26%2 exploitsPublished Sep 24, 2002
- CVE-2002-0702Critical 10.0Format string vulnerabilities in the logging routines for dynamic DNS code (print.c) of ISC DHCP daemon (DHCPD) 3 to 3.0.1rc8, with the NSUPDATE option enabled, allow remote malicious DNS servers to execute arbitrary code via format strings in a DNS server response.isc · dhcpdEPSS31%1 exploitPublished Jul 26, 2002
- CVE-2002-0597Medium 5.0LANMAN service on Microsoft Windows 2000 allows remote attackers to cause a denial of service (CPU/memory exhaustion) via a stream of malformed data to microsoft-ds port 445.microsoft · windows 2000EPSS47%2 exploitsPublished Jun 18, 2002
- CVE-2002-0033Critical 10.0Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name.sun · solarisEPSS23%1 exploitPublished May 29, 2002
- CVE-2001-0875High 7.5Internet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name of the file in the dialogue in a way that could fool users into thinking that the file type is safe to download.microsoft · internet explorerEPSS28%2 exploitsPublished Nov 26, 2001
- CVE-2001-0341High 7.5Buffer overflow in Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbitrary commands via a long registration request (URL) to fp30reg.dll.microsoft · frontpage server extensionsEPSS30%2 exploitsPublished Jul 21, 2001
- CVE-2000-0967High 10.0PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.php · phpEPSS21%2 exploitsPublished Oct 12, 2000
- CVE-1999-1575Medium 5.1The Kodak/Wang (1) Image Edit (imgedit.ocx), (2) Image Annotation (imgedit.ocx), (3) Image Scan (imgscan.ocx), (4) Thumbnail Image (imgthumb.ocx), (5) Image Admin (imgadmin.ocx), (6) HHOpen (hhopen.ocx), (7) Registration Wizard (regwizc.dll), and (8) IE Active Setup…microsoft · internet explorerEPSS36%3 exploitsPublished Sep 10, 1999
- CVE-1999-0920Critical 10.0Buffer overflow in the pop-2d POP daemon in the IMAP package allows remote attackers to gain privileges via the FOLD command.university of washington · imapEPSS32%1 exploitPublished May 26, 1999
- CVE-2026-27606High 8.8Rollup 4 has Arbitrary File Write via Path Traversalrollupjs · rollupEPSS1.6%1 exploitPublished Feb 25, 2026
- CVE-2024-7332Critical 9.3It has been classified as critical.totolink · cp450 firmwareEPSS21%1 exploitPublished Jul 31, 2024
- CVE-2024-50352Medium 5.4LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.phplibrenms · librenmsEPSS39%1 exploitPublished Nov 15, 2024
- CVE-2024-49357High 7.5In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as http:///v1/users/image?path=/var/lib/casaos/1/app_order.json and http:///v1/users/image?path=/var/lib/casaos/1/system.json, expose sensitive data like installed applications and system information…zimaspace · zimaosEPSS24%1 exploitPublished Oct 24, 2024
- CVE-2023-26255High 7.5An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira.stagil · stagil navigationEPSS47%1 exploitPublished Feb 28, 2023
- CVE-2022-47071Critical 9.8In NVS365 V01, the background network test function can trigger command execution.nvs365 · nvs-365-v01 firmwareEPSS26%1 exploitPublished Feb 6, 2023
- CVE-2022-40881Critical 9.8SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.phpcontec · solarview compact firmwareEPSS30%1 exploitPublished Nov 17, 2022
- CVE-2022-35555Critical 9.8A command injection vulnerability exists in /goform/exeCommand in Tenda W6 V1.0.0.9(4122), which allows attackers to construct cmdinput parameters for arbitrary command execution.tenda · w6 firmwareEPSS26%1 exploitPublished Aug 12, 2022
- CVE-2022-30887Critical 9.8Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProductImage.php.pharmacy management system project · pharmacy management systemEPSS26%1 exploitPublished May 20, 2022
- CVE-2022-30860High 7.2FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel.fudforum · fudforumEPSS25%1 exploitPublished Jun 6, 2022
- CVE-2022-30023High 8.8Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.tenda · hg9 firmwareEPSS39%1 exploitPublished Jun 16, 2022
- CVE-2022-28590High 7.2A Remote Code Execution (RCE) vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=install_theme.pixelimity · pixelimityEPSS24%1 exploitPublished May 3, 2022
- CVE-2022-26263Medium 6.1Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.yonyou · u8\+EPSS42%1 exploitPublished Mar 25, 2022
- CVE-2022-26213Critical 9.8Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters.totolink · x5000r firmwareEPSS26%1 exploitPublished Mar 15, 2022
- CVE-2022-24632Medium 5.3It is directory traversal during file download via the BrowseFiles.php view parameter.audiocodes · device manager expressEPSS27%1 exploitPublished May 30, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-2052 | Stack-based buffer overflow in the U3D.8BI library plugin in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arbitrary code via a long Collada asset element in a DAE file, as demonstrated by the cameraYFov value in the… adobe · photoshop cs5 | Critical 9.3 | 23% | 1 exploit | |
| CVE-2012-0393 | Apache Struts's ParameterInterceptor component does not prevent access to public constructors apache · struts | Medium 6.4 | 36% | 1 exploit | |
| CVE-2011-3315 | Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response… cisco · unified communications manager | High 7.8 | 26% | 1 exploit | |
| CVE-2011-2755 | Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors. manageengine · servicedesk plus | Medium 5.0 | 31% | 3 exploits | |
| CVE-2011-2013 | Integer overflow in the TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code by sending a sequence of crafted UDP packets to a closed port, aka "Reference… microsoft · windows 7 | Critical 9.8 | 32% | 1 exploit | |
| CVE-2010-2103 | Improper Neutralization of Input During Web Page Generation in Apache Axis2 apache · axis2 | Medium 4.3 | 35% | 1 exploit | |
| CVE-2010-1173 | The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a… linux · linux kernel | High 7.1 | 21% | 1 exploit | |
| CVE-2010-0926 | The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in… samba · samba | Low 3.5 | 30% | 2 exploits | |
| CVE-2010-0476 | The SMB client in Microsoft Windows Server 2003 SP2, Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and reboot) via a crafted SMB… microsoft · windows server 2003 | Critical 10.0 | 34% | 1 exploit | |
| CVE-2010-0027 | The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, does not properly process input parameters, which allows remote attackers to execute arbitrary… microsoft · internet explorer | Critical 9.3 | 34% | 1 exploit | |
| CVE-2010-0017 | Race condition in the SMB client implementation in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code, and in the SMB client implementation in Windows Vista Gold, SP1, and SP2 and Server 2008 Gold… microsoft · windows 7 | Critical 9.3 | 31% | 1 exploit | |
| CVE-2009-0026 | Apache Jackrabbit contains Cross-site Scripting apache · jackrabbit | Medium 4.3 | 27% | 2 exploits | |
| CVE-2008-0117 | Unspecified vulnerability in Microsoft Excel 2000 SP3 and 2002 SP2, and Office 2004 and 2008 for Mac, allows user-assisted remote attackers to execute arbitrary code via crafted conditional formatting values, aka "Excel Conditional Formatting Vulnerability." microsoft · excel | Critical 9.3 | 33% | 1 exploit | |
| CVE-2008-0112 | Unspecified vulnerability in Microsoft Excel 2000 SP3, and Office for Mac 2004 and 2008 allows user-assisted remote attackers to execute arbitrary code via a crafted .SLK file that is not properly handled when importing the file, aka "Excel File Import Vulnerability." microsoft · excel | Critical 9.3 | 32% | 1 exploit | |
| CVE-2007-2221 | Unspecified vulnerability in the mdsauth.dll COM object in Microsoft Windows Media Server in the Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 or SP2; or 7 on Windows Vista allows remote… microsoft · internet explorer | Critical 9.3 | 35% | 1 exploit | |
| CVE-2007-1658 | Windows Mail in Microsoft Windows Vista might allow user-assisted remote attackers to execute certain programs via a link to a (1) local file or (2) UNC share pathname in which there is a directory with the same base name as an executable program at the same level, as… microsoft · windows vista | Critical 9.3 | 36% | 1 exploit | |
| CVE-2007-0612 | Multiple ActiveX controls in Microsoft Windows 2000, XP, 2003, and Vista allows remote attackers to cause a denial of service (Internet Explorer crash) by accessing the bgColor, fgColor, linkColor, alinkColor, vlinkColor, or defaultCharset properties in the (1) giffile, (2)… microsoft · internet explorer | High 7.8 | 44% | 1 exploit | |
| CVE-2005-3524 | Buffer overflow in the SSL-ready version of linux-ftpd (linux-ftpd-ssl) 0.17 allows remote attackers to execute arbitrary code by creating a long directory name, then executing the XPWD command. linux-ftpd-ssl · linux-ftpd-ssl | Critical 10.0 | 21% | 1 exploit | |
| CVE-2005-3277 | The LPD service in HP-UX 10.20 11.11 (11i) and earlier allows remote attackers to execute arbitrary code via shell metacharacters ("" or single backquote) in a request that is not properly handled when an error occurs, as demonstrated by killing the connection, a different… hp · hp-ux | Critical 10.0 | 22% | 1 exploit | |
| CVE-2004-2289 | Microsoft Windows XP Explorer allows local users to execute arbitrary code via a system folder with a Desktop.ini file containing a .ShellClassInfo specifier with a CLSID value that is associated with an executable file. microsoft · windows xp | Critical 10.0 | 23% | 1 exploit | |
| CVE-2003-1328 | The showHelp() function in Microsoft Internet Explorer 5.01, 5.5, and 6.0 supports certain types of pluggable protocols that allow remote attackers to bypass the cross-domain security model and execute arbitrary code, aka "Improper Cross Domain Security Validation with ShowHelp… microsoft · internet explorer | High 7.5 | 39% | 1 exploit | |
| CVE-2003-0686 | Buffer overflow in PAM SMB module (pam_smb) 1.1.6 and earlier, when authenticating to a remote service, allows remote attackers to execute arbitrary code. dave airlie · pam smb | High 7.5 | 27% | 1 exploit | |
| CVE-2003-0227 | The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute… microsoft · windows nt | Medium 5.0 | 34% | 1 exploit | |
| CVE-2003-0042 | Jakarta Tomcat Directory Listing vulnerability apache · tomcat | Medium 5.0 | 46% | 1 exploit | |
| CVE-2002-1131 | Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php. squirrelmail · squirrelmail | High 7.5 | 26% | 1 exploit | |
| CVE-2002-0866 | Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DLLs (dynamic link libraries) via a Java applet that calls the constructor for com.ms.jdbc.odbc.JdbcOdbc with the desired DLL… microsoft · virtual machine | High 7.5 | 41% | 1 exploit | |
| CVE-2002-0724 | Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of service (crash) via a SMB_COM_TRANSACTION packet with a request for the (1) NetShareEnum, (2) NetServerEnum2, or (3) NetServerEnum3,… microsoft · windows 2000 | High 7.5 | 26% | 2 exploits | |
| CVE-2002-0702 | Format string vulnerabilities in the logging routines for dynamic DNS code (print.c) of ISC DHCP daemon (DHCPD) 3 to 3.0.1rc8, with the NSUPDATE option enabled, allow remote malicious DNS servers to execute arbitrary code via format strings in a DNS server response. isc · dhcpd | Critical 10.0 | 31% | 1 exploit | |
| CVE-2002-0597 | LANMAN service on Microsoft Windows 2000 allows remote attackers to cause a denial of service (CPU/memory exhaustion) via a stream of malformed data to microsoft-ds port 445. microsoft · windows 2000 | Medium 5.0 | 47% | 2 exploits | |
| CVE-2002-0033 | Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name. sun · solaris | Critical 10.0 | 23% | 1 exploit | |
| CVE-2001-0875 | Internet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name of the file in the dialogue in a way that could fool users into thinking that the file type is safe to download. microsoft · internet explorer | High 7.5 | 28% | 2 exploits | |
| CVE-2001-0341 | Buffer overflow in Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbitrary commands via a long registration request (URL) to fp30reg.dll. microsoft · frontpage server extensions | High 7.5 | 30% | 2 exploits | |
| CVE-2000-0967 | PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs. php · php | High 10.0 | 21% | 2 exploits | |
| CVE-1999-1575 | The Kodak/Wang (1) Image Edit (imgedit.ocx), (2) Image Annotation (imgedit.ocx), (3) Image Scan (imgscan.ocx), (4) Thumbnail Image (imgthumb.ocx), (5) Image Admin (imgadmin.ocx), (6) HHOpen (hhopen.ocx), (7) Registration Wizard (regwizc.dll), and (8) IE Active Setup… microsoft · internet explorer | Medium 5.1 | 36% | 3 exploits | |
| CVE-1999-0920 | Buffer overflow in the pop-2d POP daemon in the IMAP package allows remote attackers to gain privileges via the FOLD command. university of washington · imap | Critical 10.0 | 32% | 1 exploit | |
| CVE-2026-27606 | Rollup 4 has Arbitrary File Write via Path Traversal rollupjs · rollup | High 8.8 | 1.6% | 1 exploit | |
| CVE-2024-7332 | It has been classified as critical. totolink · cp450 firmware | Critical 9.3 | 21% | 1 exploit | |
| CVE-2024-50352 | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php librenms · librenms | Medium 5.4 | 39% | 1 exploit | |
| CVE-2024-49357 | In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as http:///v1/users/image?path=/var/lib/casaos/1/app_order.json and http:///v1/users/image?path=/var/lib/casaos/1/system.json, expose sensitive data like installed applications and system information… zimaspace · zimaos | High 7.5 | 24% | 1 exploit | |
| CVE-2023-26255 | An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. stagil · stagil navigation | High 7.5 | 47% | 1 exploit | |
| CVE-2022-47071 | In NVS365 V01, the background network test function can trigger command execution. nvs365 · nvs-365-v01 firmware | Critical 9.8 | 26% | 1 exploit | |
| CVE-2022-40881 | SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php contec · solarview compact firmware | Critical 9.8 | 30% | 1 exploit | |
| CVE-2022-35555 | A command injection vulnerability exists in /goform/exeCommand in Tenda W6 V1.0.0.9(4122), which allows attackers to construct cmdinput parameters for arbitrary command execution. tenda · w6 firmware | Critical 9.8 | 26% | 1 exploit | |
| CVE-2022-30887 | Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProductImage.php. pharmacy management system project · pharmacy management system | Critical 9.8 | 26% | 1 exploit | |
| CVE-2022-30860 | FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel. fudforum · fudforum | High 7.2 | 25% | 1 exploit | |
| CVE-2022-30023 | Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function. tenda · hg9 firmware | High 8.8 | 39% | 1 exploit | |
| CVE-2022-28590 | A Remote Code Execution (RCE) vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=install_theme. pixelimity · pixelimity | High 7.2 | 24% | 1 exploit | |
| CVE-2022-26263 | Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp. yonyou · u8\+ | Medium 6.1 | 42% | 1 exploit | |
| CVE-2022-26213 | Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. totolink · x5000r firmware | Critical 9.8 | 26% | 1 exploit | |
| CVE-2022-24632 | It is directory traversal during file download via the BrowseFiles.php view parameter. audiocodes · device manager express | Medium 5.3 | 27% | 1 exploit |
Showing 1,051–1,100 of 1,412
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.