Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 19, 2026
1,409 vulnerabilities · highest score first
- CVE-2021-29440High 7.2Grav's Twig processing allowing dangerous PHP functions by defaultgetgrav · gravEPSS30%2 exploitsPublished Apr 16, 2021
- CVE-2021-24284Critical 9.8The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action.kaswara project · kaswaraEPSS42%1 exploitPublished May 14, 2021
- CVE-2021-21974High 8.8OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability.vmware · cloud foundationEPSS45%Ransomware1 exploit1 actorPublished Feb 8, 2023
- CVE-2020-14209High 8.8Dolibarr Unrestricted Upload of File with Dangerous Typedolibarr · dolibarrEPSS27%2 exploitsPublished May 24, 2022
- CVE-2019-6225High 7.8A memory corruption issue was addressed with improved validation.apple · tvosEPSS29%2 exploitsPublished Mar 5, 2019
- CVE-2019-16405High 7.2Improper Input Validation in Centreon Webcentreon · centreon webEPSS27%2 exploitsPublished Jul 28, 2021
- CVE-2019-13577Critical 9.8SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string to the CE Remote feature listening on Port 987.computerlab · maple computer wbt snmp administratorEPSS23%3 exploitsPublished Jul 17, 2019
- CVE-2019-13024High 8.8Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it…centreon · centreonEPSS32%4 exploitsPublished Jul 1, 2019
- CVE-2019-11932High 8.8android-gif-drawable Double Free vulnerabilityandroid-gif-drawable project · android-gif-drawableEPSS45%1 exploitPublished May 24, 2022
- CVE-2018-8474High 7.5A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Feature Bypass Vulnerability." This affects Microsoft Lync.microsoft · lync for macEPSS38%2 exploitsPublished Sep 12, 2018
- CVE-2018-8096Critical 9.8Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticationenabled","Value":false' in an api/settings/setting-isauthenticationenabled PUT request.datalust · seqEPSS48%2 exploitsPublished Mar 13, 2018
- CVE-2018-8057Critical 9.8A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/channel/addchannel request, related to /application/controllers/manage/channel.php.westernbridgegroup · razorEPSS22%4 exploitsPublished Mar 11, 2018
- CVE-2018-7182High 7.5The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.ntp · ntpEPSS29%2 exploitsPublished Mar 6, 2018
- CVE-2018-5767Critical 9.8An issue was discovered on Tenda AC15 V15.03.1.16_multi devices.tendacn · ac15 firmwareEPSS47%2 exploitsPublished Feb 15, 2018
- CVE-2018-4937High 8.8Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability.adobe · flash playerEPSS26%2 exploitsPublished May 19, 2018
- CVE-2018-4935High 8.8Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability.adobe · flash playerEPSS26%2 exploitsPublished May 19, 2018
- CVE-2018-16323Medium 6.5ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value.imagemagick · imagemagickEPSS49%2 exploitsPublished Sep 1, 2018
- CVE-2018-15534Critical 9.8Geutebrueck re_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information including usernames and hashes via a direct request for /statistics/gscsetup.xml on TCP port 12003.geutebrueck · re porter 16 firmwareEPSS32%3 exploitsPublished Aug 21, 2018
- CVE-2017-8558High 7.8The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on 32-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703…microsoft · endpoint protectionEPSS44%1 exploitPublished Jun 29, 2017
- CVE-2017-6026Critical 9.1A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11.schneider-electric · modicon m241 firmwareEPSS32%2 exploitsPublished Jun 30, 2017
- CVE-2017-5792Critical 9.8A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.hp · intelligent management centerEPSS34%1 exploitPublished Feb 15, 2018
- CVE-2017-3241Critical 9.0Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit.oracle · jdkEPSS33%1 exploitPublished Jan 17, 2017
- CVE-2017-3195Critical 9.8Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with administrative privileges.commvault · edgeEPSS21%2 exploitsPublished Dec 15, 2017
- CVE-2017-3078Critical 9.8flash-plugin: multiple code execution issues fixed in APSB17-17adobe · flash playerEPSS31%1 exploitPublished Jun 13, 2017
- CVE-2017-16930Critical 9.8The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the request handler.claymore dual miner project · claymore dual minerEPSS34%2 exploitsPublished Dec 5, 2017
- CVE-2017-16642High 7.5php: Out-of-bound read in timelib_meridian()php · phpEPSS26%2 exploitsPublished Nov 7, 2017
- CVE-2016-2563Critical 9.8Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download…9bis · kittyEPSS34%1 exploitPublished Apr 7, 2016
- CVE-2016-1011High 8.8flash-plugin: multiple code execution issues fixed in APSB16-10adobe · flash playerEPSS26%2 exploitsPublished Apr 7, 2016
- CVE-2016-1001High 8.8flash-plugin: multiple code execution issues fixed in APSB16-08adobe · airEPSS25%2 exploitsPublished Mar 10, 2016
- CVE-2016-1000High 8.8flash-plugin: multiple code execution issues fixed in APSB16-08adobe · airEPSS29%2 exploitsPublished Mar 10, 2016
- CVE-2016-0999High 8.8flash-plugin: multiple code execution issues fixed in APSB16-08adobe · airEPSS29%2 exploitsPublished Mar 10, 2016
- CVE-2016-0997High 8.8flash-plugin: multiple code execution issues fixed in APSB16-08adobe · airEPSS29%2 exploitsPublished Mar 10, 2016
- CVE-2016-0985High 8.8flash-plugin: multiple code execution issues fixed in APSB16-04adobe · air sdkEPSS26%2 exploitsPublished Feb 9, 2016
- CVE-2015-8413Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS32%1 exploitPublished Dec 8, 2015
- CVE-2015-8412Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS32%1 exploitPublished Dec 8, 2015
- CVE-2015-8411Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS32%1 exploitPublished Dec 8, 2015
- CVE-2015-8410Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS32%1 exploitPublished Dec 8, 2015
- CVE-2015-8048Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS32%1 exploitPublished Dec 8, 2015
- CVE-2015-6168Critical 9.3Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6153.microsoft · edgeEPSS31%2 exploitsPublished Dec 9, 2015
- CVE-2015-6104Critical 9.3The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via…microsoft · windows 10EPSS35%2 exploitsPublished Nov 11, 2015
- CVE-2015-6103Critical 9.3The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via…microsoft · windows 10EPSS35%2 exploitsPublished Nov 11, 2015
- CVE-2015-4664Critical 9.8An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.broadcom · privileged access managerEPSS21%3 exploitsPublished Jun 18, 2018
- CVE-2015-4432Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-16adobe · airEPSS34%1 exploitPublished Jul 8, 2015
- CVE-2015-4430Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-16adobe · airEPSS33%1 exploitPublished Jul 8, 2015
- CVE-2015-3137Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-16adobe · airEPSS33%1 exploitPublished Jul 8, 2015
- CVE-2015-3124Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-16adobe · airEPSS33%1 exploitPublished Jul 8, 2015
- CVE-2015-3107Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-11adobe · airEPSS32%1 exploitPublished Jun 9, 2015
- CVE-2015-2464Critical 9.3Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic…microsoft · live meetingEPSS36%2 exploitsPublished Aug 14, 2015
- CVE-2015-2463Critical 9.3Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic…microsoft · live meetingEPSS34%2 exploitsPublished Aug 14, 2015
- CVE-2015-2462Critical 9.3ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5,…microsoft · .net frameworkEPSS36%2 exploitsPublished Aug 14, 2015
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-29440 | Grav's Twig processing allowing dangerous PHP functions by default getgrav · grav | High 7.2 | 30% | 2 exploits | |
| CVE-2021-24284 | The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. kaswara project · kaswara | Critical 9.8 | 42% | 1 exploit | |
| CVE-2021-21974 | OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. vmware · cloud foundation | High 8.8 | 45% | Ransomware1 exploit1 actor | |
| CVE-2020-14209 | Dolibarr Unrestricted Upload of File with Dangerous Type dolibarr · dolibarr | High 8.8 | 27% | 2 exploits | |
| CVE-2019-6225 | A memory corruption issue was addressed with improved validation. apple · tvos | High 7.8 | 29% | 2 exploits | |
| CVE-2019-16405 | Improper Input Validation in Centreon Web centreon · centreon web | High 7.2 | 27% | 2 exploits | |
| CVE-2019-13577 | SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string to the CE Remote feature listening on Port 987. computerlab · maple computer wbt snmp administrator | Critical 9.8 | 23% | 3 exploits | |
| CVE-2019-13024 | Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it… centreon · centreon | High 8.8 | 32% | 4 exploits | |
| CVE-2019-11932 | android-gif-drawable Double Free vulnerability android-gif-drawable project · android-gif-drawable | High 8.8 | 45% | 1 exploit | |
| CVE-2018-8474 | A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Feature Bypass Vulnerability." This affects Microsoft Lync. microsoft · lync for mac | High 7.5 | 38% | 2 exploits | |
| CVE-2018-8096 | Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticationenabled","Value":false' in an api/settings/setting-isauthenticationenabled PUT request. datalust · seq | Critical 9.8 | 48% | 2 exploits | |
| CVE-2018-8057 | A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/channel/addchannel request, related to /application/controllers/manage/channel.php. westernbridgegroup · razor | Critical 9.8 | 22% | 4 exploits | |
| CVE-2018-7182 | The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10. ntp · ntp | High 7.5 | 29% | 2 exploits | |
| CVE-2018-5767 | An issue was discovered on Tenda AC15 V15.03.1.16_multi devices. tendacn · ac15 firmware | Critical 9.8 | 47% | 2 exploits | |
| CVE-2018-4937 | Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. adobe · flash player | High 8.8 | 26% | 2 exploits | |
| CVE-2018-4935 | Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. adobe · flash player | High 8.8 | 26% | 2 exploits | |
| CVE-2018-16323 | ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. imagemagick · imagemagick | Medium 6.5 | 49% | 2 exploits | |
| CVE-2018-15534 | Geutebrueck re_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information including usernames and hashes via a direct request for /statistics/gscsetup.xml on TCP port 12003. geutebrueck · re porter 16 firmware | Critical 9.8 | 32% | 3 exploits | |
| CVE-2017-8558 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on 32-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703… microsoft · endpoint protection | High 7.8 | 44% | 1 exploit | |
| CVE-2017-6026 | A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. schneider-electric · modicon m241 firmware | Critical 9.1 | 32% | 2 exploits | |
| CVE-2017-5792 | A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. hp · intelligent management center | Critical 9.8 | 34% | 1 exploit | |
| CVE-2017-3241 | Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. oracle · jdk | Critical 9.0 | 33% | 1 exploit | |
| CVE-2017-3195 | Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with administrative privileges. commvault · edge | Critical 9.8 | 21% | 2 exploits | |
| CVE-2017-3078 | flash-plugin: multiple code execution issues fixed in APSB17-17 adobe · flash player | Critical 9.8 | 31% | 1 exploit | |
| CVE-2017-16930 | The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the request handler. claymore dual miner project · claymore dual miner | Critical 9.8 | 34% | 2 exploits | |
| CVE-2017-16642 | php: Out-of-bound read in timelib_meridian() php · php | High 7.5 | 26% | 2 exploits | |
| CVE-2016-2563 | Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download… 9bis · kitty | Critical 9.8 | 34% | 1 exploit | |
| CVE-2016-1011 | flash-plugin: multiple code execution issues fixed in APSB16-10 adobe · flash player | High 8.8 | 26% | 2 exploits | |
| CVE-2016-1001 | flash-plugin: multiple code execution issues fixed in APSB16-08 adobe · air | High 8.8 | 25% | 2 exploits | |
| CVE-2016-1000 | flash-plugin: multiple code execution issues fixed in APSB16-08 adobe · air | High 8.8 | 29% | 2 exploits | |
| CVE-2016-0999 | flash-plugin: multiple code execution issues fixed in APSB16-08 adobe · air | High 8.8 | 29% | 2 exploits | |
| CVE-2016-0997 | flash-plugin: multiple code execution issues fixed in APSB16-08 adobe · air | High 8.8 | 29% | 2 exploits | |
| CVE-2016-0985 | flash-plugin: multiple code execution issues fixed in APSB16-04 adobe · air sdk | High 8.8 | 26% | 2 exploits | |
| CVE-2015-8413 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 32% | 1 exploit | |
| CVE-2015-8412 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 32% | 1 exploit | |
| CVE-2015-8411 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 32% | 1 exploit | |
| CVE-2015-8410 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 32% | 1 exploit | |
| CVE-2015-8048 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 32% | 1 exploit | |
| CVE-2015-6168 | Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6153. microsoft · edge | Critical 9.3 | 31% | 2 exploits | |
| CVE-2015-6104 | The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via… microsoft · windows 10 | Critical 9.3 | 35% | 2 exploits | |
| CVE-2015-6103 | The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via… microsoft · windows 10 | Critical 9.3 | 35% | 2 exploits | |
| CVE-2015-4664 | An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands. broadcom · privileged access manager | Critical 9.8 | 21% | 3 exploits | |
| CVE-2015-4432 | flash-plugin: multiple code execution issues fixed in APSB15-16 adobe · air | Critical 10.0 | 34% | 1 exploit | |
| CVE-2015-4430 | flash-plugin: multiple code execution issues fixed in APSB15-16 adobe · air | Critical 10.0 | 33% | 1 exploit | |
| CVE-2015-3137 | flash-plugin: multiple code execution issues fixed in APSB15-16 adobe · air | Critical 10.0 | 33% | 1 exploit | |
| CVE-2015-3124 | flash-plugin: multiple code execution issues fixed in APSB15-16 adobe · air | Critical 10.0 | 33% | 1 exploit | |
| CVE-2015-3107 | flash-plugin: multiple code execution issues fixed in APSB15-11 adobe · air | Critical 10.0 | 32% | 1 exploit | |
| CVE-2015-2464 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic… microsoft · live meeting | Critical 9.3 | 36% | 2 exploits | |
| CVE-2015-2463 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic… microsoft · live meeting | Critical 9.3 | 34% | 2 exploits | |
| CVE-2015-2462 | ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5,… microsoft · .net framework | Critical 9.3 | 36% | 2 exploits |
Showing 251–300 of 1,409
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.