Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Watchlist

The CVE Watchlist, Under Review.

Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.

Synced hourly · figures as of Oct 19, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
498 vulnerabilities · highest score first
  • CVE-2022-31854High 7.2
    Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.
    codologic · codoforum
    EPSS32%
    3 exploits
    Published Jul 7, 2022
  • CVE-2022-31101High 8.8
    BlockWishList SQL Injection vulnerability
    prestashop · blockwishlist
    EPSS23%
    2 exploits
    Published Jun 25, 2022
  • CVE-2021-39608High 7.2
    Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code.
    flatcore · flatcore-cms
    EPSS46%
    3 exploits
    Published Aug 23, 2021
  • CVE-2021-37589High 7.5
    Virtua Cobranca before 12R allows SQL Injection on the login page.
    virtuasoftware · cobranca
    EPSS33%
    3 exploits
    Published Jun 7, 2022
  • CVE-2021-24750High 8.8
    WP Visitor Statistics (Real Time Traffic) <= 4.7 - SQL Injection
    codepress · visitor statistics
    EPSS38%
    2 exploits
    Published Dec 21, 2021
  • CVE-2020-7237High 8.8
    Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php.
    cacti · cacti
    EPSS37%
    1 exploit
    Published Jan 20, 2020
  • CVE-2020-5504High 8.8
    phpMyAdmin SQL injection in user accounts page
    phpmyadmin · phpmyadmin
    EPSS39%
    1 exploit
    Published May 24, 2022
  • CVE-2020-29607High 7.2
    A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution.
    pluck-cms · pluck
    EPSS33%
    4 exploits
    Published Dec 16, 2020
  • CVE-2018-9118High 7.5
    exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a ..
    99robots · wp background takeover advertisements
    EPSS46%
    2 exploits
    Published Apr 12, 2018
  • CVE-2018-1000811High 8.8
    bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution.
    bludit · bludit
    EPSS48%
    2 exploits
    Published Dec 20, 2018
  • CVE-2018-0866High 7.5
    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles…
    microsoft · internet explorer
    EPSS44%
    1 exploit
    Published Feb 14, 2018
  • CVE-2017-5972High 7.5
    The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets, as demonstrated by an…
    linux · linux kernel
    EPSS24%
    2 exploits
    Published Feb 14, 2017
  • CVE-2017-3106High 8.8
    flash-plugin: Remote Code Execution due to Type Confusion issue fixed in APSB17-23
    adobe · flash player
    EPSS22%
    2 exploits
    Published Aug 8, 2017
  • CVE-2017-3068High 8.8
    flash-plugin: multiple code execution issues fixed in APSB17-15
    adobe · flash player
    EPSS20%
    2 exploits
    Published May 9, 2017
  • CVE-2017-2985High 8.8
    flash-plugin: multiple code execution issues fixed in APSB17-04
    adobe · flash player
    EPSS22%
    2 exploits
    Published Feb 14, 2017
  • CVE-2017-2932High 8.8
    flash-plugin: multiple code execution issues fixed in APSB17-02
    adobe · flash player
    EPSS25%
    2 exploits
    Published Jan 10, 2017
  • CVE-2017-2931High 8.8
    flash-plugin: multiple code execution issues fixed in APSB17-02
    adobe · flash player
    EPSS21%
    2 exploits
    Published Jan 10, 2017
  • CVE-2017-11903High 7.5
    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the current user, due to…
    microsoft · internet explorer
    EPSS47%
    2 exploits
    Published Dec 12, 2017
  • CVE-2017-11855High 7.5
    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user…
    microsoft · internet explorer
    EPSS49%
    2 exploits
    Published Nov 15, 2017
  • CVE-2016-9565High 8.1
    nagios: Command injection via curl in MagpieRSS
    nagios · nagios
    EPSS23%
    2 exploits
    Published Dec 13, 2016
  • CVE-2016-4179High 8.8
    flash-plugin: multiple code execution issues fixed in APSB16-25
    adobe · flash player
    EPSS20%
    2 exploits
    Published Jul 12, 2016
  • CVE-2016-4175High 8.8
    flash-plugin: multiple code execution issues fixed in APSB16-25
    adobe · flash player
    EPSS20%
    2 exploits
    Published Jul 12, 2016
  • CVE-2016-1013High 8.8
    flash-plugin: multiple code execution issues fixed in APSB16-10
    adobe · flash player
    EPSS23%
    2 exploits
    Published Apr 7, 2016
  • CVE-2016-0063High 8.8
    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0060,…
    microsoft · internet explorer
    EPSS39%
    2 exploits
    Published Feb 10, 2016
  • CVE-2015-7245High 7.5
    Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive information via a ..
    d-link · dvg-n5402sp firmware
    EPSS45%
    3 exploits
    Published Apr 24, 2017
  • CVE-2015-0273High 7.5
    php: use after free vulnerability in unserialize() with DateTimeZone
    php · php
    EPSS44%
    1 exploit
    Published Feb 19, 2015
  • CVE-2012-2386High 7.5
    php: Integer overflow leading to heap-buffer overflow in the Phar extension
    php · php
    EPSS42%
    1 exploit
    Published May 21, 2012
  • CVE-2010-4701High 7.6
    Heap-based buffer overflow in the CDrawPoly::Serialize function in fxscover.exe in Microsoft Windows Fax Services Cover Page Editor 5.2 r2 in Windows XP Professional SP3, Server 2003 R2 Enterprise Edition SP2, and Windows 7 Professional allows remote attackers to execute…
    microsoft · windows 7
    EPSS48%
    2 exploits
    Published Jan 20, 2011
  • CVE-2008-4864High 7.5
    python: imageop module multiple integer overflows
    python · python
    EPSS21%
    2 exploits
    Published Oct 19, 2008
  • CVE-2008-0645High 7.5
    Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 allow remote attackers to execute arbitrary PHP code via a URL in the site_path parameter to (1) config/conf-activation.php, (2) menu/item.php, and (3) modules/conf_modules.php in admin/system/; and…
    portail web php · portail web php
    EPSS34%
    4 exploits
    Published Feb 7, 2008
  • CVE-2005-0944High 7.5
    Unknown vulnerability in Microsoft Jet DB engine (msjet40.dll) 4.00.8618.0, related to insufficient data validation, allows remote attackers to execute arbitrary code via a crafted mdb file.
    microsoft · jet
    EPSS34%
    3 exploits
    Published May 2, 2005
  • CVE-2023-38874High 8.8
    Economizzer remote code execution vulnerability
    economizzer · economizzer
    EPSS32%
    1 exploit
    Published Sep 28, 2023
  • CVE-2022-28079High 8.8
    College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.
    college management system project · college management system
    EPSS29%
    3 exploits
    Published May 5, 2022
  • CVE-2022-27226High 8.8
    A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel.
    irz · rl01 firmware
    EPSS34%
    3 exploits
    Published Mar 19, 2022
  • CVE-2022-26965High 7.2
    In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.
    pluck-cms · pluck
    EPSS36%
    2 exploits
    Published Mar 18, 2022
  • CVE-2022-23046High 7.2
    PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php
    phpipam · phpipam
    EPSS25%
    2 exploits
    Published Jan 19, 2022
  • CVE-2020-14008High 7.2
    Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution.
    zohocorp · manageengine applications manager
    EPSS40%
    2 exploits
    Published Sep 4, 2020
  • CVE-2020-12503High 7.2
    Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3…
    pepperl-fuchs · es7506 firmware
    EPSS23%
    2 exploits
    Published Oct 15, 2020
  • CVE-2019-15813High 8.8
    Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a webshell.
    sentrifugo · sentrifugo
    EPSS33%
    3 exploits
    Published Sep 4, 2019
  • CVE-2019-15715High 7.2
    MantisBT Remote Code Execution
    mantisbt · mantisbt
    EPSS30%
    2 exploits
    Published May 24, 2022
  • CVE-2019-14927High 7.5
    An issue was discovered on Mitsubishi Electric Europe B.V.
    inea · me-rtu firmware
    EPSS41%
    1 exploit
    Published Sep 10, 2021
  • CVE-2018-7658High 7.5
    NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service (daemon crash) by sending exactly 11 bytes.
    softros · network time system
    EPSS39%
    3 exploits
    Published Mar 26, 2018
  • CVE-2018-7582High 7.5
    WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to TCP port 9991.
    weblogexpert · weblog expert
    EPSS36%
    3 exploits
    Published Mar 9, 2018
  • CVE-2018-7171High 7.5
    Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a ..
    lynxtechnology · twonky server
    EPSS28%
    3 exploits
    Published Mar 30, 2018
  • CVE-2018-6008High 7.5
    Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla!
    joomlatag · jtag members directory
    EPSS37%
    3 exploits
    Published Jan 29, 2018
  • CVE-2018-4416High 8.8
    Multiple memory corruption issues were addressed with improved memory handling.
    apple · icloud
    EPSS35%
    1 exploit
    Published Apr 3, 2019
  • CVE-2018-12980High 8.8
    An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02.
    wago · 762-3000 firmware
    EPSS30%
    2 exploits
    Published Jul 12, 2018
  • CVE-2018-12636High 7.2
    The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.
    ithemes · security
    EPSS30%
    2 exploits
    Published Jun 22, 2018
  • CVE-2018-0708High 8.8
    Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
    qnap · q\'center
    EPSS26%
    3 exploits
    Published Jul 16, 2018
  • CVE-2017-7692High 8.8
    squirrelmail: Insufficient escaping of user-supplied data
    squirrelmail · squirrelmail
    EPSS32%
    1 exploit
    Published Apr 19, 2017
Showing 101–150 of 498

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.

Figures as of Oct 19, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.