Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 19, 2026
725 vulnerabilities · highest score first
- CVE-2015-3128Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-16adobe · airEPSS39%1 exploitPublished Jul 8, 2015
- CVE-2015-3118Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-16adobe · airEPSS40%1 exploitPublished Jul 8, 2015
- CVE-2015-3073Critical 10.0Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062,…adobe · acrobatEPSS25%2 exploitsPublished May 13, 2015
- CVE-2015-3042Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-06adobe · flash playerEPSS37%1 exploitPublished Apr 14, 2015
- CVE-2015-2455Critical 9.3Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1,…microsoft · live meetingEPSS37%2 exploitsPublished Aug 14, 2015
- CVE-2015-0554Critical 9.4The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated…adb · p.dga4001n firmwareEPSS39%3 exploitsPublished Jan 21, 2015
- CVE-2014-4877Critical 9.3Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which…gnu · wgetEPSS40%1 exploitPublished Oct 29, 2014
- CVE-2011-3490Critical 10.0Multiple stack-based buffer overflows in service.exe in Measuresoft ScadaPro 4.0.0 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long command to port 11234, as demonstrated with the TF command.measuresoft · scadaproEPSS36%3 exploitsPublished Sep 16, 2011
- CVE-2009-1960Critical 9.3inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the config_cascade[main][default][] parameter to doku.php.dokuwiki · dokuwikiEPSS23%2 exploitsPublished Jun 8, 2009
- CVE-2009-1667Critical 9.3Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long entry in a .m3u file, a different vector than CVE-2009-5137.mini-stream · castripperEPSS28%4 exploitsPublished May 18, 2009
- CVE-2006-6652Critical 9.0Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914, NetBSD 2.* and 3.* before 20061203, and Apple Mac OS X before 2007-004, as used by the FTP daemon and tnftpd, allows remote authenticated users to execute arbitrary code via a long…apple · mac os xEPSS20%2 exploitsPublished Dec 20, 2006
- CVE-2006-6561Critical 9.3Unspecified vulnerability in Microsoft Word 2000, 2002, and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted DOC file that triggers memory corruption, as demonstrated via the 12122006-djtest.doc file, a different issue than…microsoft · wordEPSS41%1 exploitPublished Dec 14, 2006
- CVE-2004-0557Critical 10.0Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.sox · soxEPSS25%2 exploitsPublished Aug 6, 2004
- CVE-2002-0640Critical 10.0Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication…openbsd · opensshEPSS27%2 exploitsPublished Jul 3, 2002
- CVE-2001-0554Critical 10.0Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.freebsd · freebsdEPSS39%1 exploitPublished Jul 18, 2001
- CVE-2023-4708Critical 9.8It has been rated as critical.infosoftbd · clcknshopEPSS31%1 exploitPublished Sep 1, 2023
- CVE-2023-43187Critical 9.8A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.nodebb · nodebbEPSS47%1 exploitPublished Sep 27, 2023
- CVE-2023-34598Critical 9.8Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.gibbonedu · gibbonEPSS47%1 exploitPublished Jun 29, 2023
- CVE-2023-31546Critical 9.6Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature.dedebiz · dedebizEPSS49%1 exploitPublished Dec 13, 2023
- CVE-2023-1454Critical 9.8jeecg-boot SQL Injection vulnerabilityjeecg · jeecg bootEPSS36%1 exploitPublished Mar 17, 2023
- CVE-2022-40871Critical 9.8Dolibarr vulnerable to Eval Injectiondolibarr · dolibarr erp\/crmEPSS34%1 exploitPublished Oct 12, 2022
- CVE-2021-24284Critical 9.8The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action.kaswara project · kaswaraEPSS42%1 exploitPublished May 14, 2021
- CVE-2019-13577Critical 9.8SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string to the CE Remote feature listening on Port 987.computerlab · maple computer wbt snmp administratorEPSS23%3 exploitsPublished Jul 17, 2019
- CVE-2018-8096Critical 9.8Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticationenabled","Value":false' in an api/settings/setting-isauthenticationenabled PUT request.datalust · seqEPSS48%2 exploitsPublished Mar 13, 2018
- CVE-2018-8057Critical 9.8A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/channel/addchannel request, related to /application/controllers/manage/channel.php.westernbridgegroup · razorEPSS22%4 exploitsPublished Mar 11, 2018
- CVE-2018-5767Critical 9.8An issue was discovered on Tenda AC15 V15.03.1.16_multi devices.tendacn · ac15 firmwareEPSS47%2 exploitsPublished Feb 15, 2018
- CVE-2018-15534Critical 9.8Geutebrueck re_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information including usernames and hashes via a direct request for /statistics/gscsetup.xml on TCP port 12003.geutebrueck · re porter 16 firmwareEPSS32%3 exploitsPublished Aug 21, 2018
- CVE-2017-6026Critical 9.1A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11.schneider-electric · modicon m241 firmwareEPSS32%2 exploitsPublished Jun 30, 2017
- CVE-2017-5792Critical 9.8A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.hp · intelligent management centerEPSS34%1 exploitPublished Feb 15, 2018
- CVE-2017-3241Critical 9.0Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit.oracle · jdkEPSS33%1 exploitPublished Jan 17, 2017
- CVE-2017-3195Critical 9.8Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with administrative privileges.commvault · edgeEPSS21%2 exploitsPublished Dec 15, 2017
- CVE-2017-3078Critical 9.8flash-plugin: multiple code execution issues fixed in APSB17-17adobe · flash playerEPSS31%1 exploitPublished Jun 13, 2017
- CVE-2017-16930Critical 9.8The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the request handler.claymore dual miner project · claymore dual minerEPSS34%2 exploitsPublished Dec 5, 2017
- CVE-2016-2563Critical 9.8Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download…9bis · kittyEPSS34%1 exploitPublished Apr 7, 2016
- CVE-2015-8413Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS32%1 exploitPublished Dec 8, 2015
- CVE-2015-8412Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS32%1 exploitPublished Dec 8, 2015
- CVE-2015-8411Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS32%1 exploitPublished Dec 8, 2015
- CVE-2015-8410Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS32%1 exploitPublished Dec 8, 2015
- CVE-2015-8048Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS32%1 exploitPublished Dec 8, 2015
- CVE-2015-6168Critical 9.3Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6153.microsoft · edgeEPSS31%2 exploitsPublished Dec 9, 2015
- CVE-2015-6104Critical 9.3The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via…microsoft · windows 10EPSS35%2 exploitsPublished Nov 11, 2015
- CVE-2015-6103Critical 9.3The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via…microsoft · windows 10EPSS35%2 exploitsPublished Nov 11, 2015
- CVE-2015-4664Critical 9.8An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.broadcom · privileged access managerEPSS21%3 exploitsPublished Jun 18, 2018
- CVE-2015-4432Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-16adobe · airEPSS34%1 exploitPublished Jul 8, 2015
- CVE-2015-4430Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-16adobe · airEPSS33%1 exploitPublished Jul 8, 2015
- CVE-2015-3137Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-16adobe · airEPSS33%1 exploitPublished Jul 8, 2015
- CVE-2015-3124Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-16adobe · airEPSS33%1 exploitPublished Jul 8, 2015
- CVE-2015-3107Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-11adobe · airEPSS32%1 exploitPublished Jun 9, 2015
- CVE-2015-2464Critical 9.3Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic…microsoft · live meetingEPSS36%2 exploitsPublished Aug 14, 2015
- CVE-2015-2463Critical 9.3Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic…microsoft · live meetingEPSS34%2 exploitsPublished Aug 14, 2015
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-3128 | flash-plugin: multiple code execution issues fixed in APSB15-16 adobe · air | Critical 10.0 | 39% | 1 exploit | |
| CVE-2015-3118 | flash-plugin: multiple code execution issues fixed in APSB15-16 adobe · air | Critical 10.0 | 40% | 1 exploit | |
| CVE-2015-3073 | Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062,… adobe · acrobat | Critical 10.0 | 25% | 2 exploits | |
| CVE-2015-3042 | flash-plugin: multiple code execution issues fixed in APSB15-06 adobe · flash player | Critical 10.0 | 37% | 1 exploit | |
| CVE-2015-2455 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1,… microsoft · live meeting | Critical 9.3 | 37% | 2 exploits | |
| CVE-2015-0554 | The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated… adb · p.dga4001n firmware | Critical 9.4 | 39% | 3 exploits | |
| CVE-2014-4877 | Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which… gnu · wget | Critical 9.3 | 40% | 1 exploit | |
| CVE-2011-3490 | Multiple stack-based buffer overflows in service.exe in Measuresoft ScadaPro 4.0.0 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long command to port 11234, as demonstrated with the TF command. measuresoft · scadapro | Critical 10.0 | 36% | 3 exploits | |
| CVE-2009-1960 | inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the config_cascade[main][default][] parameter to doku.php. dokuwiki · dokuwiki | Critical 9.3 | 23% | 2 exploits | |
| CVE-2009-1667 | Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long entry in a .m3u file, a different vector than CVE-2009-5137. mini-stream · castripper | Critical 9.3 | 28% | 4 exploits | |
| CVE-2006-6652 | Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914, NetBSD 2.* and 3.* before 20061203, and Apple Mac OS X before 2007-004, as used by the FTP daemon and tnftpd, allows remote authenticated users to execute arbitrary code via a long… apple · mac os x | Critical 9.0 | 20% | 2 exploits | |
| CVE-2006-6561 | Unspecified vulnerability in Microsoft Word 2000, 2002, and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted DOC file that triggers memory corruption, as demonstrated via the 12122006-djtest.doc file, a different issue than… microsoft · word | Critical 9.3 | 41% | 1 exploit | |
| CVE-2004-0557 | Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields. sox · sox | Critical 10.0 | 25% | 2 exploits | |
| CVE-2002-0640 | Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication… openbsd · openssh | Critical 10.0 | 27% | 2 exploits | |
| CVE-2001-0554 | Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function. freebsd · freebsd | Critical 10.0 | 39% | 1 exploit | |
| CVE-2023-4708 | It has been rated as critical. infosoftbd · clcknshop | Critical 9.8 | 31% | 1 exploit | |
| CVE-2023-43187 | A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests. nodebb · nodebb | Critical 9.8 | 47% | 1 exploit | |
| CVE-2023-34598 | Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response. gibbonedu · gibbon | Critical 9.8 | 47% | 1 exploit | |
| CVE-2023-31546 | Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature. dedebiz · dedebiz | Critical 9.6 | 49% | 1 exploit | |
| CVE-2023-1454 | jeecg-boot SQL Injection vulnerability jeecg · jeecg boot | Critical 9.8 | 36% | 1 exploit | |
| CVE-2022-40871 | Dolibarr vulnerable to Eval Injection dolibarr · dolibarr erp\/crm | Critical 9.8 | 34% | 1 exploit | |
| CVE-2021-24284 | The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. kaswara project · kaswara | Critical 9.8 | 42% | 1 exploit | |
| CVE-2019-13577 | SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string to the CE Remote feature listening on Port 987. computerlab · maple computer wbt snmp administrator | Critical 9.8 | 23% | 3 exploits | |
| CVE-2018-8096 | Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticationenabled","Value":false' in an api/settings/setting-isauthenticationenabled PUT request. datalust · seq | Critical 9.8 | 48% | 2 exploits | |
| CVE-2018-8057 | A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/channel/addchannel request, related to /application/controllers/manage/channel.php. westernbridgegroup · razor | Critical 9.8 | 22% | 4 exploits | |
| CVE-2018-5767 | An issue was discovered on Tenda AC15 V15.03.1.16_multi devices. tendacn · ac15 firmware | Critical 9.8 | 47% | 2 exploits | |
| CVE-2018-15534 | Geutebrueck re_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information including usernames and hashes via a direct request for /statistics/gscsetup.xml on TCP port 12003. geutebrueck · re porter 16 firmware | Critical 9.8 | 32% | 3 exploits | |
| CVE-2017-6026 | A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. schneider-electric · modicon m241 firmware | Critical 9.1 | 32% | 2 exploits | |
| CVE-2017-5792 | A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. hp · intelligent management center | Critical 9.8 | 34% | 1 exploit | |
| CVE-2017-3241 | Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. oracle · jdk | Critical 9.0 | 33% | 1 exploit | |
| CVE-2017-3195 | Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with administrative privileges. commvault · edge | Critical 9.8 | 21% | 2 exploits | |
| CVE-2017-3078 | flash-plugin: multiple code execution issues fixed in APSB17-17 adobe · flash player | Critical 9.8 | 31% | 1 exploit | |
| CVE-2017-16930 | The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the request handler. claymore dual miner project · claymore dual miner | Critical 9.8 | 34% | 2 exploits | |
| CVE-2016-2563 | Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download… 9bis · kitty | Critical 9.8 | 34% | 1 exploit | |
| CVE-2015-8413 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 32% | 1 exploit | |
| CVE-2015-8412 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 32% | 1 exploit | |
| CVE-2015-8411 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 32% | 1 exploit | |
| CVE-2015-8410 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 32% | 1 exploit | |
| CVE-2015-8048 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 32% | 1 exploit | |
| CVE-2015-6168 | Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6153. microsoft · edge | Critical 9.3 | 31% | 2 exploits | |
| CVE-2015-6104 | The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via… microsoft · windows 10 | Critical 9.3 | 35% | 2 exploits | |
| CVE-2015-6103 | The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via… microsoft · windows 10 | Critical 9.3 | 35% | 2 exploits | |
| CVE-2015-4664 | An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands. broadcom · privileged access manager | Critical 9.8 | 21% | 3 exploits | |
| CVE-2015-4432 | flash-plugin: multiple code execution issues fixed in APSB15-16 adobe · air | Critical 10.0 | 34% | 1 exploit | |
| CVE-2015-4430 | flash-plugin: multiple code execution issues fixed in APSB15-16 adobe · air | Critical 10.0 | 33% | 1 exploit | |
| CVE-2015-3137 | flash-plugin: multiple code execution issues fixed in APSB15-16 adobe · air | Critical 10.0 | 33% | 1 exploit | |
| CVE-2015-3124 | flash-plugin: multiple code execution issues fixed in APSB15-16 adobe · air | Critical 10.0 | 33% | 1 exploit | |
| CVE-2015-3107 | flash-plugin: multiple code execution issues fixed in APSB15-11 adobe · air | Critical 10.0 | 32% | 1 exploit | |
| CVE-2015-2464 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic… microsoft · live meeting | Critical 9.3 | 36% | 2 exploits | |
| CVE-2015-2463 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic… microsoft · live meeting | Critical 9.3 | 34% | 2 exploits |
Showing 151–200 of 725
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.