Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 20, 2026
525 vulnerabilities · highest score first
- CVE-2021-40379High 7.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.comprotech · ip570 firmwareEPSS22%1 exploitPublished Sep 1, 2021
- CVE-2020-5192High 8.8PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not validating user input, and allow for the application's database and information to be fully compromised.phpgurukul · hospital management systemEPSS24%1 exploitPublished Jan 5, 2020
- CVE-2020-16138High 7.5A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled.cisco · unified ip conference station 7937g firmwareEPSS21%1 exploitPublished Aug 12, 2020
- CVE-2019-9202High 8.8Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.nagios · incident managerEPSS24%1 exploitPublished Mar 28, 2019
- CVE-2019-19494High 8.8Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser.compal · 7284e firmwareEPSS23%1 exploitPublished Jan 9, 2020
- CVE-2019-1914High 7.2A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated, remote attacker to perform a command injection attack.cisco · sf-220-24 firmwareEPSS25%1 exploitPublished Aug 7, 2019
- CVE-2019-12480High 7.5BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, AtomicReadFile and DeviceCommunicationControl services.bacnet protocol stack project · bacnet protocol stackEPSS34%1 exploitPublished May 30, 2019
- CVE-2019-0667High 7.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'.microsoft · internet explorerEPSS31%1 exploitPublished Apr 8, 2019
- CVE-2018-18980High 7.5An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request.zohocorp · manageengine network configuration managerEPSS25%1 exploitPublished Nov 6, 2018
- CVE-2016-7191High 8.1Authentication Bypass in passport-azure-admicrosoft · azure active directory passportEPSS29%·Published Jul 26, 2018
- CVE-2015-2470High 9.3Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Integer Underflow Vulnerability."microsoft · officeEPSS27%1 exploitPublished Aug 14, 2015
- CVE-2015-2469High 9.3Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."microsoft · officeEPSS27%1 exploitPublished Aug 14, 2015
- CVE-2015-2468High 9.3Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office…microsoft · officeEPSS30%1 exploitPublished Aug 14, 2015
- CVE-2015-2467High 9.3Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."microsoft · officeEPSS28%1 exploitPublished Aug 14, 2015
- CVE-2010-2746High 7.6Heap-based buffer overflow in Comctl32.dll (aka the common control library) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when a third-party SVG viewer is used, allows remote…microsoft · windows 7EPSS36%1 exploitPublished Oct 13, 2010
- CVE-2006-4182High 7.5Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when…clam anti-virus · clamavEPSS21%1 exploitPublished Oct 16, 2006
- CVE-2005-1383High 7.5The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server mod_access restrictions via a request to the webcache TCP port 7778.oracle · application serverEPSS31%1 exploitPublished May 3, 2005
- CVE-2004-0399High 7.5Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification.university of cambridge · eximEPSS21%1 exploitPublished Jul 7, 2004
- CVE-2003-0111High 7.5The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier, as used in Windows and Internet Explorer, allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet, aka "Flaw in Microsoft VM Could…microsoft · virtual machineEPSS36%1 exploitPublished May 5, 2003
- CVE-2002-1847High 7.5Buffer overflow in mplay32.exe of Microsoft Windows Media Player (WMP) 6.3 through 7.1 allows remote attackers to execute arbitrary commands via a long mp3 filename command line argument.microsoft · windows media playerEPSS34%1 exploitPublished Dec 31, 2002
- CVE-2002-1317High 7.5Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query.sun · solarisEPSS24%1 exploitPublished Dec 11, 2002
- CVE-2002-1179High 7.5Buffer overflow in the S/MIME Parsing capability in Microsoft Outlook Express 5.5 and 6.0 allows remote attackers to execute arbitrary code via a digitally signed email with a long "From" address, which triggers the overflow when the user views or previews the message.microsoft · outlook expressEPSS22%1 exploitPublished Oct 28, 2002
- CVE-2002-0193High 7.5Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than…microsoft · internet explorerEPSS33%1 exploitPublished May 29, 2002
- CVE-2000-0711High 7.5Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, which allows remote attackers to create a server on the victim's system via a malicious applet, as demonstrated by Brown Orifice.netscape · communicatorEPSS34%1 exploitPublished Oct 20, 2000
- CVE-2000-0380High 7.1The IOS HTTP service in Cisco routers and switches running IOS 11.1 through 12.1 allows remote attackers to cause a denial of service by requesting a URL that contains a %% string.cisco · iosEPSS35%1 exploitPublished Apr 26, 2000
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-40379 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. comprotech · ip570 firmware | High 7.5 | 22% | 1 exploit | |
| CVE-2020-5192 | PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not validating user input, and allow for the application's database and information to be fully compromised. phpgurukul · hospital management system | High 8.8 | 24% | 1 exploit | |
| CVE-2020-16138 | A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. cisco · unified ip conference station 7937g firmware | High 7.5 | 21% | 1 exploit | |
| CVE-2019-9202 | Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues. nagios · incident manager | High 8.8 | 24% | 1 exploit | |
| CVE-2019-19494 | Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. compal · 7284e firmware | High 8.8 | 23% | 1 exploit | |
| CVE-2019-1914 | A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated, remote attacker to perform a command injection attack. cisco · sf-220-24 firmware | High 7.2 | 25% | 1 exploit | |
| CVE-2019-12480 | BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, AtomicReadFile and DeviceCommunicationControl services. bacnet protocol stack project · bacnet protocol stack | High 7.5 | 34% | 1 exploit | |
| CVE-2019-0667 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. microsoft · internet explorer | High 7.5 | 31% | 1 exploit | |
| CVE-2018-18980 | An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. zohocorp · manageengine network configuration manager | High 7.5 | 25% | 1 exploit | |
| CVE-2016-7191 | Authentication Bypass in passport-azure-ad microsoft · azure active directory passport | High 8.1 | 29% | · | |
| CVE-2015-2470 | Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Integer Underflow Vulnerability." microsoft · office | High 9.3 | 27% | 1 exploit | |
| CVE-2015-2469 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." microsoft · office | High 9.3 | 27% | 1 exploit | |
| CVE-2015-2468 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office… microsoft · office | High 9.3 | 30% | 1 exploit | |
| CVE-2015-2467 | Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." microsoft · office | High 9.3 | 28% | 1 exploit | |
| CVE-2010-2746 | Heap-based buffer overflow in Comctl32.dll (aka the common control library) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when a third-party SVG viewer is used, allows remote… microsoft · windows 7 | High 7.6 | 36% | 1 exploit | |
| CVE-2006-4182 | Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when… clam anti-virus · clamav | High 7.5 | 21% | 1 exploit | |
| CVE-2005-1383 | The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server mod_access restrictions via a request to the webcache TCP port 7778. oracle · application server | High 7.5 | 31% | 1 exploit | |
| CVE-2004-0399 | Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification. university of cambridge · exim | High 7.5 | 21% | 1 exploit | |
| CVE-2003-0111 | The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier, as used in Windows and Internet Explorer, allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet, aka "Flaw in Microsoft VM Could… microsoft · virtual machine | High 7.5 | 36% | 1 exploit | |
| CVE-2002-1847 | Buffer overflow in mplay32.exe of Microsoft Windows Media Player (WMP) 6.3 through 7.1 allows remote attackers to execute arbitrary commands via a long mp3 filename command line argument. microsoft · windows media player | High 7.5 | 34% | 1 exploit | |
| CVE-2002-1317 | Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query. sun · solaris | High 7.5 | 24% | 1 exploit | |
| CVE-2002-1179 | Buffer overflow in the S/MIME Parsing capability in Microsoft Outlook Express 5.5 and 6.0 allows remote attackers to execute arbitrary code via a digitally signed email with a long "From" address, which triggers the overflow when the user views or previews the message. microsoft · outlook express | High 7.5 | 22% | 1 exploit | |
| CVE-2002-0193 | Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than… microsoft · internet explorer | High 7.5 | 33% | 1 exploit | |
| CVE-2000-0711 | Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, which allows remote attackers to create a server on the victim's system via a malicious applet, as demonstrated by Brown Orifice. netscape · communicator | High 7.5 | 34% | 1 exploit | |
| CVE-2000-0380 | The IOS HTTP service in Cisco routers and switches running IOS 11.1 through 12.1 allows remote attackers to cause a denial of service by requesting a URL that contains a %% string. cisco · ios | High 7.1 | 35% | 1 exploit |
Showing 501–525 of 525
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.