Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 20, 2026
1,412 vulnerabilities · highest score first
- CVE-2014-2757Critical 9.3Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282,…microsoft · internet explorerEPSS23%1 exploitPublished Jun 11, 2014
- CVE-2014-2756Critical 9.3Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2755Critical 9.3Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-2754Critical 9.3Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1774 and CVE-2014-1788.microsoft · internet explorerEPSS22%1 exploitPublished Jun 11, 2014
- CVE-2014-2753Critical 9.3Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-1815Critical 9.3Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as exploited in the wild in May 2014, aka "Internet Explorer Memory Corruption Vulnerability," a different…microsoft · internet explorerEPSS20%1 exploitPublished May 14, 2014
- CVE-2014-1805Critical 9.3Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,…microsoft · internet explorerEPSS22%1 exploitPublished Jun 11, 2014
- CVE-2014-1804Critical 9.3Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1781, CVE-2014-1792, and…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-1803Critical 9.3Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282,…microsoft · internet explorerEPSS23%1 exploitPublished Jun 11, 2014
- CVE-2014-1802Critical 9.3Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-1796Critical 9.3Microsoft Internet Explorer 6 and 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."microsoft · internet explorerEPSS21%1 exploitPublished Jun 11, 2014
- CVE-2014-1794Critical 9.3Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,…microsoft · internet explorerEPSS21%1 exploitPublished Jun 11, 2014
- CVE-2014-1792Critical 9.3Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1781, CVE-2014-1804, and…microsoft · internet explorerEPSS21%1 exploitPublished Jun 11, 2014
- CVE-2014-1790Critical 9.3Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1789.microsoft · internet explorerEPSS21%1 exploitPublished Jun 11, 2014
- CVE-2014-1788Critical 9.3Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1774 and CVE-2014-2754.microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-1786Critical 9.3Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,…microsoft · internet explorerEPSS21%1 exploitPublished Jun 11, 2014
- CVE-2014-1784Critical 9.3Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,…microsoft · internet explorerEPSS21%1 exploitPublished Jun 11, 2014
- CVE-2014-1783Critical 9.3Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,…microsoft · internet explorerEPSS21%1 exploitPublished Jun 11, 2014
- CVE-2014-1782Critical 9.3Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1785,…microsoft · internet explorerEPSS21%1 exploitPublished Jun 11, 2014
- CVE-2014-1781Critical 9.3Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1792, CVE-2014-1804, and…microsoft · internet explorerEPSS21%1 exploitPublished Jun 11, 2014
- CVE-2014-1780Critical 9.3Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1794,…microsoft · internet explorerEPSS21%1 exploitPublished Jun 11, 2014
- CVE-2014-1775Critical 9.3Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282,…microsoft · internet explorerEPSS23%1 exploitPublished Jun 11, 2014
- CVE-2014-1774Critical 9.3Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1788 and CVE-2014-2754.microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2014-1772Critical 9.3Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1780, CVE-2014-1794,…microsoft · internet explorerEPSS22%1 exploitPublished Jun 11, 2014
- CVE-2014-1769Critical 9.3Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1782, CVE-2014-1785,…microsoft · internet explorerEPSS20%1 exploitPublished Jun 11, 2014
- CVE-2013-3846Critical 9.3Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted CSpliceTreeEngine::InsertSplice object in an HTML document, aka "Internet Explorer Memory…microsoft · internet explorerEPSS22%1 exploitPublished Dec 29, 2013
- CVE-2013-2419Medium 5.0Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to 2D.oracle · jreEPSS23%1 exploitPublished Apr 17, 2013
- CVE-2013-0177Low 3.5Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1)…apache · ofbizEPSS21%1 exploitPublished Jan 30, 2014
- CVE-2012-0016Critical 9.3Untrusted search path vulnerability in Microsoft Expression Design; Expression Design SP1; and Expression Design 2, 3, and 4 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .xpr or…microsoft · expression designEPSS22%1 exploitPublished Mar 13, 2012
- CVE-2011-5057Medium 5.0struts: improper access restrictions to collections such as session and requestapache · strutsEPSS27%1 exploitPublished Dec 21, 2011
- CVE-2011-2131Critical 9.3Adobe Photoshop 12.0 in Creative Suite 5 (CS5) and 12.1 in Creative Suite 5.1 (CS5.1) allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted GIF file.adobe · creative suiteEPSS22%1 exploitPublished Aug 11, 2011
- CVE-2011-1772Low 2.6Cross-site Scripting in Apache Strutsapache · strutsEPSS33%1 exploitPublished May 17, 2022
- CVE-2010-4598Medium 5.0Directory traversal vulnerability in Ecava IntegraXor 3.6.4000.0 and earlier allows remote attackers to read arbitrary files via a ..ecava · integraxorEPSS26%2 exploitsPublished Dec 23, 2010
- CVE-2010-4476Medium 5.0Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environmentsun · jreEPSS23%1 exploitPublished May 14, 2022
- CVE-2010-4051Medium 5.0The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the…gnu · glibcEPSS40%1 exploitPublished Jan 13, 2011
- CVE-2010-2746High 7.6Heap-based buffer overflow in Comctl32.dll (aka the common control library) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when a third-party SVG viewer is used, allows remote…microsoft · windows 7EPSS36%1 exploitPublished Oct 13, 2010
- CVE-2010-2265Medium 4.3Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003 allows remote attackers to inject arbitrary web script or HTML via the svr parameter to…microsoft · windows server 2003EPSS21%1 exploitPublished Jun 15, 2010
- CVE-2010-1305Medium 5.0Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly other versions before 1.26.03, a module for Joomla!, allows remote attackers to read arbitrary files via a ..joomlamo · com jinventoryEPSS21%2 exploitsPublished Apr 8, 2010
- CVE-2010-1247Critical 9.3Unspecified vulnerability in Microsoft Office Excel 2002 SP3 allows remote attackers to execute arbitrary code via an Excel file with a malformed RTD (0x813) record that triggers heap corruption, aka "Excel Memory Corruption Vulnerability," a different vulnerability than…microsoft · excelEPSS22%1 exploitPublished Jun 8, 2010
- CVE-2010-1245Critical 9.3Unspecified vulnerability in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file with a malformed SxView (0xB0) record, aka "Excel Record Memory…microsoft · excelEPSS22%1 exploitPublished Jun 8, 2010
- CVE-2010-0824Critical 9.3Unspecified vulnerability in Microsoft Office Excel 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via an Excel file with a malformed WOPT (0x80B) record, aka "Excel Record Memory Corruption Vulnerability," a different vulnerability than…microsoft · excelEPSS22%1 exploitPublished Jun 8, 2010
- CVE-2010-0816Critical 9.3Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; and Windows Mail on Windows Vista SP1 and SP2, Windows Server 2008…microsoft · outlook expressEPSS20%1 exploitPublished May 12, 2010
- CVE-2009-3270Medium 5.0Microsoft Internet Explorer 7 through 7.0.6000.16711 allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a related issue to CVE-2009-0821.microsoft · internet explorerEPSS28%1 exploitPublished Sep 18, 2009
- CVE-2008-1311Medium 5.0The TFTP server in PacketTrap pt360 Tool Suite PRO 2.0.3901.0 and earlier allows remote attackers to cause a denial of service (daemon hang) by uploading a file named (1) '|' (pipe), (2) '"' (quotation mark), or (3) "<>" (less than, greater than); or (4) a file with a long name.packettrap · pt360 tool suite proEPSS49%1 exploitPublished Mar 12, 2008
- CVE-2007-2795Critical 9.0Multiple buffer overflows in Ipswitch IMail before 2006.21 allow remote attackers or authenticated users to execute arbitrary code via (1) the authentication feature in IMailsec.dll, which triggers heap corruption in the IMail Server, or (2) a long SUBSCRIBE IMAP command, which…ipswitch · imailEPSS24%1 exploitPublished Jan 27, 2009
- CVE-2007-2581Medium 4.3Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as…microsoft · sharepoint serverEPSS36%1 exploitPublished May 9, 2007
- CVE-2007-2353Medium 5.3Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actorapache · axisEPSS28%1 exploitPublished May 1, 2022
- CVE-2007-0247Medium 5.0squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing responses, possibly related to the (1) ftpListingFinish and (2) ftpHtmlifyListEntry functions.squid · squidEPSS20%1 exploitPublished Jan 16, 2007
- CVE-2006-4182High 7.5Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when…clam anti-virus · clamavEPSS21%1 exploitPublished Oct 16, 2006
- CVE-2005-1383High 7.5The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server mod_access restrictions via a request to the webcache TCP port 7778.oracle · application serverEPSS31%1 exploitPublished May 3, 2005
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-2757 | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282,… microsoft · internet explorer | Critical 9.3 | 23% | 1 exploit | |
| CVE-2014-2756 | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2755 | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-2754 | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1774 and CVE-2014-1788. microsoft · internet explorer | Critical 9.3 | 22% | 1 exploit | |
| CVE-2014-2753 | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-1815 | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as exploited in the wild in May 2014, aka "Internet Explorer Memory Corruption Vulnerability," a different… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-1805 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,… microsoft · internet explorer | Critical 9.3 | 22% | 1 exploit | |
| CVE-2014-1804 | Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1781, CVE-2014-1792, and… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-1803 | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282,… microsoft · internet explorer | Critical 9.3 | 23% | 1 exploit | |
| CVE-2014-1802 | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-1796 | Microsoft Internet Explorer 6 and 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." microsoft · internet explorer | Critical 9.3 | 21% | 1 exploit | |
| CVE-2014-1794 | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780,… microsoft · internet explorer | Critical 9.3 | 21% | 1 exploit | |
| CVE-2014-1792 | Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1781, CVE-2014-1804, and… microsoft · internet explorer | Critical 9.3 | 21% | 1 exploit | |
| CVE-2014-1790 | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1789. microsoft · internet explorer | Critical 9.3 | 21% | 1 exploit | |
| CVE-2014-1788 | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1774 and CVE-2014-2754. microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-1786 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,… microsoft · internet explorer | Critical 9.3 | 21% | 1 exploit | |
| CVE-2014-1784 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,… microsoft · internet explorer | Critical 9.3 | 21% | 1 exploit | |
| CVE-2014-1783 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,… microsoft · internet explorer | Critical 9.3 | 21% | 1 exploit | |
| CVE-2014-1782 | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1785,… microsoft · internet explorer | Critical 9.3 | 21% | 1 exploit | |
| CVE-2014-1781 | Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1792, CVE-2014-1804, and… microsoft · internet explorer | Critical 9.3 | 21% | 1 exploit | |
| CVE-2014-1780 | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1794,… microsoft · internet explorer | Critical 9.3 | 21% | 1 exploit | |
| CVE-2014-1775 | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0282,… microsoft · internet explorer | Critical 9.3 | 23% | 1 exploit | |
| CVE-2014-1774 | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1788 and CVE-2014-2754. microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2014-1772 | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1780, CVE-2014-1794,… microsoft · internet explorer | Critical 9.3 | 22% | 1 exploit | |
| CVE-2014-1769 | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1782, CVE-2014-1785,… microsoft · internet explorer | Critical 9.3 | 20% | 1 exploit | |
| CVE-2013-3846 | Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted CSpliceTreeEngine::InsertSplice object in an HTML document, aka "Internet Explorer Memory… microsoft · internet explorer | Critical 9.3 | 22% | 1 exploit | |
| CVE-2013-2419 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to 2D. oracle · jre | Medium 5.0 | 23% | 1 exploit | |
| CVE-2013-0177 | Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1)… apache · ofbiz | Low 3.5 | 21% | 1 exploit | |
| CVE-2012-0016 | Untrusted search path vulnerability in Microsoft Expression Design; Expression Design SP1; and Expression Design 2, 3, and 4 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .xpr or… microsoft · expression design | Critical 9.3 | 22% | 1 exploit | |
| CVE-2011-5057 | struts: improper access restrictions to collections such as session and request apache · struts | Medium 5.0 | 27% | 1 exploit | |
| CVE-2011-2131 | Adobe Photoshop 12.0 in Creative Suite 5 (CS5) and 12.1 in Creative Suite 5.1 (CS5.1) allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted GIF file. adobe · creative suite | Critical 9.3 | 22% | 1 exploit | |
| CVE-2011-1772 | Cross-site Scripting in Apache Struts apache · struts | Low 2.6 | 33% | 1 exploit | |
| CVE-2010-4598 | Directory traversal vulnerability in Ecava IntegraXor 3.6.4000.0 and earlier allows remote attackers to read arbitrary files via a .. ecava · integraxor | Medium 5.0 | 26% | 2 exploits | |
| CVE-2010-4476 | Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment sun · jre | Medium 5.0 | 23% | 1 exploit | |
| CVE-2010-4051 | The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the… gnu · glibc | Medium 5.0 | 40% | 1 exploit | |
| CVE-2010-2746 | Heap-based buffer overflow in Comctl32.dll (aka the common control library) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when a third-party SVG viewer is used, allows remote… microsoft · windows 7 | High 7.6 | 36% | 1 exploit | |
| CVE-2010-2265 | Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003 allows remote attackers to inject arbitrary web script or HTML via the svr parameter to… microsoft · windows server 2003 | Medium 4.3 | 21% | 1 exploit | |
| CVE-2010-1305 | Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly other versions before 1.26.03, a module for Joomla!, allows remote attackers to read arbitrary files via a .. joomlamo · com jinventory | Medium 5.0 | 21% | 2 exploits | |
| CVE-2010-1247 | Unspecified vulnerability in Microsoft Office Excel 2002 SP3 allows remote attackers to execute arbitrary code via an Excel file with a malformed RTD (0x813) record that triggers heap corruption, aka "Excel Memory Corruption Vulnerability," a different vulnerability than… microsoft · excel | Critical 9.3 | 22% | 1 exploit | |
| CVE-2010-1245 | Unspecified vulnerability in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file with a malformed SxView (0xB0) record, aka "Excel Record Memory… microsoft · excel | Critical 9.3 | 22% | 1 exploit | |
| CVE-2010-0824 | Unspecified vulnerability in Microsoft Office Excel 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via an Excel file with a malformed WOPT (0x80B) record, aka "Excel Record Memory Corruption Vulnerability," a different vulnerability than… microsoft · excel | Critical 9.3 | 22% | 1 exploit | |
| CVE-2010-0816 | Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; and Windows Mail on Windows Vista SP1 and SP2, Windows Server 2008… microsoft · outlook express | Critical 9.3 | 20% | 1 exploit | |
| CVE-2009-3270 | Microsoft Internet Explorer 7 through 7.0.6000.16711 allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a related issue to CVE-2009-0821. microsoft · internet explorer | Medium 5.0 | 28% | 1 exploit | |
| CVE-2008-1311 | The TFTP server in PacketTrap pt360 Tool Suite PRO 2.0.3901.0 and earlier allows remote attackers to cause a denial of service (daemon hang) by uploading a file named (1) '|' (pipe), (2) '"' (quotation mark), or (3) "<>" (less than, greater than); or (4) a file with a long name. packettrap · pt360 tool suite pro | Medium 5.0 | 49% | 1 exploit | |
| CVE-2007-2795 | Multiple buffer overflows in Ipswitch IMail before 2006.21 allow remote attackers or authenticated users to execute arbitrary code via (1) the authentication feature in IMailsec.dll, which triggers heap corruption in the IMail Server, or (2) a long SUBSCRIBE IMAP command, which… ipswitch · imail | Critical 9.0 | 24% | 1 exploit | |
| CVE-2007-2581 | Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as… microsoft · sharepoint server | Medium 4.3 | 36% | 1 exploit | |
| CVE-2007-2353 | Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actor apache · axis | Medium 5.3 | 28% | 1 exploit | |
| CVE-2007-0247 | squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing responses, possibly related to the (1) ftpListingFinish and (2) ftpHtmlifyListEntry functions. squid · squid | Medium 5.0 | 20% | 1 exploit | |
| CVE-2006-4182 | Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when… clam anti-virus · clamav | High 7.5 | 21% | 1 exploit | |
| CVE-2005-1383 | The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server mod_access restrictions via a request to the webcache TCP port 7778. oracle · application server | High 7.5 | 31% | 1 exploit |
Showing 1,351–1,400 of 1,412
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.