Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 20, 2026
1,412 vulnerabilities · highest score first
- CVE-2024-27356High 7.5An issue was discovered on certain GL-iNet devices.gl-inet · a1300 firmwareEPSS24%1 exploitPublished Feb 26, 2024
- CVE-2023-2522High 7.2It has been declared as critical.feiyuxing · vec40g firmwareEPSS34%1 exploitPublished May 4, 2023
- CVE-2023-0084Medium 6.1Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scriptingwpmet · metform elementor contact form builderEPSS29%1 exploitPublished Feb 1, 2023
- CVE-2022-36620High 7.5D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting.dlink · dir-816 firmwareEPSS24%1 exploitPublished Aug 31, 2022
- CVE-2022-36309High 8.8Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI.airspan · airvelocity 1500 firmwareEPSS25%1 exploitPublished Aug 15, 2022
- CVE-2022-34047High 7.5An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd].wavlink · wl-wn530hg4 firmwareEPSS22%1 exploitPublished Jul 20, 2022
- CVE-2022-34046High 7.5An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);].wavlink · wn533a8 firmwareEPSS21%1 exploitPublished Jul 20, 2022
- CVE-2022-31827Critical 9.1MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.monstaftp · monstaftpEPSS22%1 exploitPublished Jun 9, 2022
- CVE-2021-45043High 7.5HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.hd-network real-time monitoring system project · hd-network real-time monitoring systemEPSS33%1 exploitPublished Dec 15, 2021
- CVE-2021-40382High 7.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.comprotech · ip570 firmwareEPSS23%1 exploitPublished Sep 1, 2021
- CVE-2021-40381High 7.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.comprotech · ip570 firmwareEPSS23%1 exploitPublished Sep 1, 2021
- CVE-2021-40380High 7.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.comprotech · ip570 firmwareEPSS23%1 exploitPublished Sep 1, 2021
- CVE-2021-40379High 7.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.comprotech · ip570 firmwareEPSS22%1 exploitPublished Sep 1, 2021
- CVE-2021-25158Medium 5.9A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and…arubanetworks · instantEPSS30%2 exploitsPublished Mar 29, 2021
- CVE-2020-5192High 8.8PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not validating user input, and allow for the application's database and information to be fully compromised.phpgurukul · hospital management systemEPSS24%1 exploitPublished Jan 5, 2020
- CVE-2020-16138High 7.5A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled.cisco · unified ip conference station 7937g firmwareEPSS21%1 exploitPublished Aug 12, 2020
- CVE-2019-9202High 8.8Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.nagios · incident managerEPSS24%1 exploitPublished Mar 28, 2019
- CVE-2019-19494High 8.8Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser.compal · 7284e firmwareEPSS23%1 exploitPublished Jan 9, 2020
- CVE-2019-1914High 7.2A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated, remote attacker to perform a command injection attack.cisco · sf-220-24 firmwareEPSS25%1 exploitPublished Aug 7, 2019
- CVE-2019-12480High 7.5BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, AtomicReadFile and DeviceCommunicationControl services.bacnet protocol stack project · bacnet protocol stackEPSS34%1 exploitPublished May 30, 2019
- CVE-2019-0667High 7.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'.microsoft · internet explorerEPSS31%1 exploitPublished Apr 8, 2019
- CVE-2018-18980High 7.5An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request.zohocorp · manageengine network configuration managerEPSS25%1 exploitPublished Nov 6, 2018
- CVE-2018-18777Medium 4.3Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /..microstrategy · microstrategy webEPSS23%3 exploitsPublished Nov 1, 2018
- CVE-2015-5116Medium 5.0flash-plugin: information disclosure issues fixed in APSB15-16adobe · airEPSS22%1 exploitPublished Jul 8, 2015
- CVE-2015-3337Medium 4.3Improper Limitation of a Pathname to a Restricted Directory in Elasticsearchelasticsearch · elasticsearchEPSS33%1 exploitPublished May 17, 2022
- CVE-2015-2998Medium 5.0SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by decrypting the database password in WEB-INF/conf/serverConf.xml.sysaid · sysaidEPSS26%2 exploitsPublished Jun 8, 2015
- CVE-2015-2746Medium 6.5The network diagnostics tool (CommandLineServlet) in the Appliance Manager command line utility (CLU) in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "second"…websense · tritonEPSS25%2 exploitsPublished Mar 26, 2015
- CVE-2015-2470High 9.3Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Integer Underflow Vulnerability."microsoft · officeEPSS27%1 exploitPublished Aug 14, 2015
- CVE-2015-2469High 9.3Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."microsoft · officeEPSS27%1 exploitPublished Aug 14, 2015
- CVE-2015-2468High 9.3Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office…microsoft · officeEPSS30%1 exploitPublished Aug 14, 2015
- CVE-2015-2467High 9.3Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."microsoft · officeEPSS28%1 exploitPublished Aug 14, 2015
- CVE-2015-1579Medium 5.0Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a ..elegantthemes · diviEPSS21%3 exploitsPublished Feb 11, 2015
- CVE-2014-7883Medium 5.0HP Universal CMDB (UCMDB) Probe 9.05, 10.01, and 10.11 enables the HTTP TRACE method, which allows remote attackers to obtain sensitive information by reading the headers of a response.hp · universal configuration management databaseEPSS37%1 exploitPublished Feb 15, 2015
- CVE-2014-6308Medium 5.0Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a ..osclass · osclassEPSS22%3 exploitsPublished Oct 20, 2014
- CVE-2014-5258Medium 4.0Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated users to read arbitrary files via a ..webedition · webedition cmsEPSS20%2 exploitsPublished Nov 6, 2014
- CVE-2014-2773Critical 9.3Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2768.microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2772Critical 9.3Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2771Critical 9.3Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2770Critical 9.3Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1781, CVE-2014-1792, and…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2769Critical 9.3Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2768Critical 9.3Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2773.microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2767Critical 9.3Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2766Critical 9.3Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2765Critical 9.3Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2764Critical 9.3Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2763Critical 9.3Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2761Critical 9.3Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2760Critical 9.3Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2759Critical 9.3Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2758Critical 9.3Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-27356 | An issue was discovered on certain GL-iNet devices. gl-inet · a1300 firmware | High 7.5 | 24% | 1 exploit | |
| CVE-2023-2522 | It has been declared as critical. feiyuxing · vec40g firmware | High 7.2 | 34% | 1 exploit | |
| CVE-2023-0084 | Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting wpmet · metform elementor contact form builder | Medium 6.1 | 29% | 1 exploit | |
| CVE-2022-36620 | D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting. dlink · dir-816 firmware | High 7.5 | 24% | 1 exploit | |
| CVE-2022-36309 | Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI. airspan · airvelocity 1500 firmware | High 8.8 | 25% | 1 exploit | |
| CVE-2022-34047 | An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd]. wavlink · wl-wn530hg4 firmware | High 7.5 | 22% | 1 exploit | |
| CVE-2022-34046 | An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);]. wavlink · wn533a8 firmware | High 7.5 | 21% | 1 exploit | |
| CVE-2022-31827 | MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php. monstaftp · monstaftp | Critical 9.1 | 22% | 1 exploit | |
| CVE-2021-45043 | HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter. hd-network real-time monitoring system project · hd-network real-time monitoring system | High 7.5 | 33% | 1 exploit | |
| CVE-2021-40382 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. comprotech · ip570 firmware | High 7.5 | 23% | 1 exploit | |
| CVE-2021-40381 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. comprotech · ip570 firmware | High 7.5 | 23% | 1 exploit | |
| CVE-2021-40380 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. comprotech · ip570 firmware | High 7.5 | 23% | 1 exploit | |
| CVE-2021-40379 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. comprotech · ip570 firmware | High 7.5 | 22% | 1 exploit | |
| CVE-2021-25158 | A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and… arubanetworks · instant | Medium 5.9 | 30% | 2 exploits | |
| CVE-2020-5192 | PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not validating user input, and allow for the application's database and information to be fully compromised. phpgurukul · hospital management system | High 8.8 | 24% | 1 exploit | |
| CVE-2020-16138 | A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. cisco · unified ip conference station 7937g firmware | High 7.5 | 21% | 1 exploit | |
| CVE-2019-9202 | Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues. nagios · incident manager | High 8.8 | 24% | 1 exploit | |
| CVE-2019-19494 | Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. compal · 7284e firmware | High 8.8 | 23% | 1 exploit | |
| CVE-2019-1914 | A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated, remote attacker to perform a command injection attack. cisco · sf-220-24 firmware | High 7.2 | 25% | 1 exploit | |
| CVE-2019-12480 | BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, AtomicReadFile and DeviceCommunicationControl services. bacnet protocol stack project · bacnet protocol stack | High 7.5 | 34% | 1 exploit | |
| CVE-2019-0667 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. microsoft · internet explorer | High 7.5 | 31% | 1 exploit | |
| CVE-2018-18980 | An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. zohocorp · manageengine network configuration manager | High 7.5 | 25% | 1 exploit | |
| CVE-2018-18777 | Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. microstrategy · microstrategy web | Medium 4.3 | 23% | 3 exploits | |
| CVE-2015-5116 | flash-plugin: information disclosure issues fixed in APSB15-16 adobe · air | Medium 5.0 | 22% | 1 exploit | |
| CVE-2015-3337 | Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch elasticsearch · elasticsearch | Medium 4.3 | 33% | 1 exploit | |
| CVE-2015-2998 | SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by decrypting the database password in WEB-INF/conf/serverConf.xml. sysaid · sysaid | Medium 5.0 | 26% | 2 exploits | |
| CVE-2015-2746 | The network diagnostics tool (CommandLineServlet) in the Appliance Manager command line utility (CLU) in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "second"… websense · triton | Medium 6.5 | 25% | 2 exploits | |
| CVE-2015-2470 | Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Integer Underflow Vulnerability." microsoft · office | High 9.3 | 27% | 1 exploit | |
| CVE-2015-2469 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." microsoft · office | High 9.3 | 27% | 1 exploit | |
| CVE-2015-2468 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office… microsoft · office | High 9.3 | 30% | 1 exploit | |
| CVE-2015-2467 | Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." microsoft · office | High 9.3 | 28% | 1 exploit | |
| CVE-2015-1579 | Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. elegantthemes · divi | Medium 5.0 | 21% | 3 exploits | |
| CVE-2014-7883 | HP Universal CMDB (UCMDB) Probe 9.05, 10.01, and 10.11 enables the HTTP TRACE method, which allows remote attackers to obtain sensitive information by reading the headers of a response. hp · universal configuration management database | Medium 5.0 | 37% | 1 exploit | |
| CVE-2014-6308 | Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. osclass · osclass | Medium 5.0 | 22% | 3 exploits | |
| CVE-2014-5258 | Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated users to read arbitrary files via a .. webedition · webedition cms | Medium 4.0 | 20% | 2 exploits | |
| CVE-2014-2773 | Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2768. microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2772 | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2771 | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2770 | Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1781, CVE-2014-1792, and… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2769 | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2768 | Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2773. microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2767 | Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2766 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2765 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2764 | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2763 | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2761 | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2760 | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2759 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2758 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit |
Showing 1,301–1,350 of 1,412
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.