Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 19, 2026
1,459 vulnerabilities · highest score first
- CVE-2018-11652Critical 9.8CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report.cirt.net · niktoEPSS24%2 exploitsPublished Jun 1, 2018
- CVE-2018-1133High 8.8Moodle calculated question type allows remote code execution by Question authorsmoodle · moodleEPSS31%2 exploitsPublished May 13, 2022
- CVE-2017-8798Critical 9.8Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspecified other impact.miniupnp project · miniupnpdEPSS24%2 exploitsPublished May 11, 2017
- CVE-2017-2992High 8.8flash-plugin: multiple code execution issues fixed in APSB17-04adobe · flash playerEPSS33%2 exploitsPublished Feb 14, 2017
- CVE-2017-2986High 8.8flash-plugin: multiple code execution issues fixed in APSB17-04adobe · flash playerEPSS31%2 exploitsPublished Feb 14, 2017
- CVE-2017-15367Critical 9.8Bacula-web SQL Injection Vulnerabilitiesbacula · bacula-webEPSS23%2 exploitsPublished May 14, 2022
- CVE-2016-6435Medium 6.5The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, aka Bug ID CSCva30376.cisco · secure firewall management centerEPSS37%1 exploitPublished Oct 6, 2016
- CVE-2016-4232High 7.5flash-plugin: multiple code execution issues fixed in APSB16-25adobe · flash playerEPSS36%2 exploitsPublished Jul 12, 2016
- CVE-2016-4231High 8.8flash-plugin: multiple code execution issues fixed in APSB16-25adobe · flash playerEPSS33%2 exploitsPublished Jul 12, 2016
- CVE-2016-4227High 8.8flash-plugin: multiple code execution issues fixed in APSB16-25adobe · flash playerEPSS33%2 exploitsPublished Jul 12, 2016
- CVE-2016-1960High 8.8Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as…mozilla · firefoxEPSS31%2 exploitsPublished Mar 13, 2016
- CVE-2016-0974High 8.8flash-plugin: multiple code execution issues fixed in APSB16-04adobe · air sdkEPSS31%2 exploitsPublished Feb 9, 2016
- CVE-2016-0971High 8.8flash-plugin: multiple code execution issues fixed in APSB16-04adobe · air sdkEPSS33%2 exploitsPublished Feb 9, 2016
- CVE-2014-9013High 8.8The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user.wpmarketplace project · wpmarketplaceEPSS47%2 exploitsPublished Nov 6, 2019
- CVE-2013-1592Critical 9.8A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a…sap · netweaverEPSS24%2 exploitsPublished Jan 23, 2020
- CVE-2012-2626Medium 5.0cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows remote attackers to add administrative accounts via a userprefs action.sonicwall · scrutinizerEPSS44%1 exploitPublished Jul 31, 2012
- CVE-2010-1205Critical 9.8Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.libpng · libpngEPSS43%1 exploitPublished Jun 30, 2010
- CVE-2009-0076Critical 9.3Microsoft Internet Explorer 7, when XHTML strict mode is used, allows remote attackers to execute arbitrary code via the zoom style directive in conjunction with unspecified other directives in a malformed Cascading Style Sheets (CSS) stylesheet in a crafted HTML document, aka…microsoft · internet explorerEPSS34%4 exploitsPublished Feb 10, 2009
- CVE-2002-0082High 7.5The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client…apache-ssl · apache-sslEPSS30%3 exploitsPublished Feb 27, 2002
- CVE-2002-0048Critical 10.0Multiple signedness errors (mixed signed and unsigned numbers) in the I/O functions of rsync 2.4.6, 2.3.2, and other versions allow remote attackers to cause a denial of service and execute arbitrary code in the rsync client or server.andrew tridgell · rsyncEPSS34%3 exploitsPublished Jan 25, 2002
- CVE-2026-90817Critical 9.8An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey…EPSS0.9%7 exploitsPublished Sep 20, 2026
- CVE-2026-23918High 8.8Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.apache · http serverEPSS50%1 exploitPublished May 4, 2026
- CVE-2026-111823Critical 9.8Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.EPSS0.4%1 exploitPublished Oct 16, 2026
- CVE-2025-49002High 8.2Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited.dataease · dataeaseEPSS50%2 exploitsPublished Jun 3, 2025
- CVE-2024-0132Critical 9.3NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerabilitynvidia · nvidia container toolkitEPSS41%1 exploitPublished Sep 27, 2024
- CVE-2023-5148High 8.8UNSUPPORTED WHEN ASSIGNED A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231.dlink · dar-7000 firmwareEPSS31%2 exploitsPublished Sep 25, 2023
- CVE-2023-30145Critical 9.8Server-Side Template Injection in Camaleon CMStuzitio · camaleon cmsEPSS46%1 exploitPublished May 26, 2023
- CVE-2022-35411Critical 9.8rpc.py vulnerable to Deserialization of Untrusted Datarpc.py project · rpc.pyEPSS46%1 exploitPublished Jul 9, 2022
- CVE-2022-24629Critical 9.8Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php.audiocodes · device manager expressEPSS37%1 exploitPublished May 30, 2023
- CVE-2021-40875High 7.5Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure.gurock · testrailEPSS47%2 exploitsPublished Sep 22, 2021
- CVE-2021-24146High 7.5Modern Events Calendar Lite <= 5.16.4 - Unauthenticated Events Exportwebnus · modern events calendar liteEPSS31%2 exploitsPublished Jul 5, 2021
- CVE-2020-5377Critical 9.1Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities.dell · emc openmanage server administratorEPSS48%2 exploitsPublished Jul 28, 2020
- CVE-2020-35313Critical 9.8A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer.wondercms · wondercmsEPSS45%2 exploitsPublished Apr 20, 2021
- CVE-2020-28948High 7.8Deserialization of Untrusted Data in Archive_Tardrupal · drupalEPSS47%1 exploitPublished Apr 22, 2021
- CVE-2020-25494Critical 9.8Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook.xinuos · openserverEPSS39%3 exploitsPublished Dec 18, 2020
- CVE-2019-7274Critical 9.8Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root.optergy · enterpriseEPSS29%2 exploitsPublished Jul 1, 2019
- CVE-2019-17240Critical 9.8bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.bludit · bluditEPSS40%3 exploitsPublished Oct 6, 2019
- CVE-2018-8544High 8.8A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server…microsoft · windows 10EPSS48%2 exploitsPublished Nov 13, 2018
- CVE-2018-19571High 7.7GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks.gitlab · gitlabEPSS32%2 exploitsPublished Jul 10, 2019
- CVE-2018-19246High 7.5LFI in PHP-Proxy 5.1.0php-proxy · php-proxyEPSS22%3 exploitsPublished May 14, 2022
- CVE-2018-14716High 7.5SEOmatic plugin for Craft CMS SSTI Vulnerabilitynystudio107 · seomaticEPSS33%2 exploitsPublished May 13, 2022
- CVE-2018-1306High 7.5Exposure of Sensitive Information in Apache Plutoapache · plutoEPSS43%2 exploitsPublished May 14, 2022
- CVE-2018-12827High 7.5Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability.adobe · flash playerEPSS32%2 exploitsPublished Aug 29, 2018
- CVE-2018-11235High 7.8In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur.gitforwindows · gitEPSS48%1 exploitPublished May 30, 2018
- CVE-2018-10088Critical 9.8Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725.xiongmaitech · uc-httpdEPSS40%3 exploitsPublished Jun 8, 2018
- CVE-2017-8682High 8.8Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, Windows Server 2016, Microsoft Office Word Viewer, Microsoft Office 2007 Service Pack 3 , and…microsoft · office 2007EPSS50%2 exploitsPublished Sep 12, 2017
- CVE-2017-7679Critical 9.8In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.apache · http serverEPSS39%1 exploitPublished Jun 20, 2017
- CVE-2017-2935High 8.8flash-plugin: multiple code execution issues fixed in APSB17-02adobe · flash playerEPSS30%2 exploitsPublished Jan 10, 2017
- CVE-2017-2934High 8.8flash-plugin: multiple code execution issues fixed in APSB17-02adobe · flash playerEPSS30%2 exploitsPublished Jan 10, 2017
- CVE-2017-2933High 8.8flash-plugin: multiple code execution issues fixed in APSB17-02adobe · flash playerEPSS30%2 exploitsPublished Jan 10, 2017
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-11652 | CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report. cirt.net · nikto | Critical 9.8 | 24% | 2 exploits | |
| CVE-2018-1133 | Moodle calculated question type allows remote code execution by Question authors moodle · moodle | High 8.8 | 31% | 2 exploits | |
| CVE-2017-8798 | Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspecified other impact. miniupnp project · miniupnpd | Critical 9.8 | 24% | 2 exploits | |
| CVE-2017-2992 | flash-plugin: multiple code execution issues fixed in APSB17-04 adobe · flash player | High 8.8 | 33% | 2 exploits | |
| CVE-2017-2986 | flash-plugin: multiple code execution issues fixed in APSB17-04 adobe · flash player | High 8.8 | 31% | 2 exploits | |
| CVE-2017-15367 | Bacula-web SQL Injection Vulnerabilities bacula · bacula-web | Critical 9.8 | 23% | 2 exploits | |
| CVE-2016-6435 | The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, aka Bug ID CSCva30376. cisco · secure firewall management center | Medium 6.5 | 37% | 1 exploit | |
| CVE-2016-4232 | flash-plugin: multiple code execution issues fixed in APSB16-25 adobe · flash player | High 7.5 | 36% | 2 exploits | |
| CVE-2016-4231 | flash-plugin: multiple code execution issues fixed in APSB16-25 adobe · flash player | High 8.8 | 33% | 2 exploits | |
| CVE-2016-4227 | flash-plugin: multiple code execution issues fixed in APSB16-25 adobe · flash player | High 8.8 | 33% | 2 exploits | |
| CVE-2016-1960 | Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as… mozilla · firefox | High 8.8 | 31% | 2 exploits | |
| CVE-2016-0974 | flash-plugin: multiple code execution issues fixed in APSB16-04 adobe · air sdk | High 8.8 | 31% | 2 exploits | |
| CVE-2016-0971 | flash-plugin: multiple code execution issues fixed in APSB16-04 adobe · air sdk | High 8.8 | 33% | 2 exploits | |
| CVE-2014-9013 | The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user. wpmarketplace project · wpmarketplace | High 8.8 | 47% | 2 exploits | |
| CVE-2013-1592 | A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a… sap · netweaver | Critical 9.8 | 24% | 2 exploits | |
| CVE-2012-2626 | cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows remote attackers to add administrative accounts via a userprefs action. sonicwall · scrutinizer | Medium 5.0 | 44% | 1 exploit | |
| CVE-2010-1205 | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row. libpng · libpng | Critical 9.8 | 43% | 1 exploit | |
| CVE-2009-0076 | Microsoft Internet Explorer 7, when XHTML strict mode is used, allows remote attackers to execute arbitrary code via the zoom style directive in conjunction with unspecified other directives in a malformed Cascading Style Sheets (CSS) stylesheet in a crafted HTML document, aka… microsoft · internet explorer | Critical 9.3 | 34% | 4 exploits | |
| CVE-2002-0082 | The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client… apache-ssl · apache-ssl | High 7.5 | 30% | 3 exploits | |
| CVE-2002-0048 | Multiple signedness errors (mixed signed and unsigned numbers) in the I/O functions of rsync 2.4.6, 2.3.2, and other versions allow remote attackers to cause a denial of service and execute arbitrary code in the rsync client or server. andrew tridgell · rsync | Critical 10.0 | 34% | 3 exploits | |
| CVE-2026-90817 | An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey… | Critical 9.8 | 0.9% | 7 exploits | |
| CVE-2026-23918 | Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. apache · http server | High 8.8 | 50% | 1 exploit | |
| CVE-2026-111823 | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. | Critical 9.8 | 0.4% | 1 exploit | |
| CVE-2025-49002 | Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited. dataease · dataease | High 8.2 | 50% | 2 exploits | |
| CVE-2024-0132 | NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability nvidia · nvidia container toolkit | Critical 9.3 | 41% | 1 exploit | |
| CVE-2023-5148 | UNSUPPORTED WHEN ASSIGNED A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. dlink · dar-7000 firmware | High 8.8 | 31% | 2 exploits | |
| CVE-2023-30145 | Server-Side Template Injection in Camaleon CMS tuzitio · camaleon cms | Critical 9.8 | 46% | 1 exploit | |
| CVE-2022-35411 | rpc.py vulnerable to Deserialization of Untrusted Data rpc.py project · rpc.py | Critical 9.8 | 46% | 1 exploit | |
| CVE-2022-24629 | Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. audiocodes · device manager express | Critical 9.8 | 37% | 1 exploit | |
| CVE-2021-40875 | Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. gurock · testrail | High 7.5 | 47% | 2 exploits | |
| CVE-2021-24146 | Modern Events Calendar Lite <= 5.16.4 - Unauthenticated Events Export webnus · modern events calendar lite | High 7.5 | 31% | 2 exploits | |
| CVE-2020-5377 | Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. dell · emc openmanage server administrator | Critical 9.1 | 48% | 2 exploits | |
| CVE-2020-35313 | A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer. wondercms · wondercms | Critical 9.8 | 45% | 2 exploits | |
| CVE-2020-28948 | Deserialization of Untrusted Data in Archive_Tar drupal · drupal | High 7.8 | 47% | 1 exploit | |
| CVE-2020-25494 | Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook. xinuos · openserver | Critical 9.8 | 39% | 3 exploits | |
| CVE-2019-7274 | Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root. optergy · enterprise | Critical 9.8 | 29% | 2 exploits | |
| CVE-2019-17240 | bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers. bludit · bludit | Critical 9.8 | 40% | 3 exploits | |
| CVE-2018-8544 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server… microsoft · windows 10 | High 8.8 | 48% | 2 exploits | |
| CVE-2018-19571 | GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks. gitlab · gitlab | High 7.7 | 32% | 2 exploits | |
| CVE-2018-19246 | LFI in PHP-Proxy 5.1.0 php-proxy · php-proxy | High 7.5 | 22% | 3 exploits | |
| CVE-2018-14716 | SEOmatic plugin for Craft CMS SSTI Vulnerability nystudio107 · seomatic | High 7.5 | 33% | 2 exploits | |
| CVE-2018-1306 | Exposure of Sensitive Information in Apache Pluto apache · pluto | High 7.5 | 43% | 2 exploits | |
| CVE-2018-12827 | Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. adobe · flash player | High 7.5 | 32% | 2 exploits | |
| CVE-2018-11235 | In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. gitforwindows · git | High 7.8 | 48% | 1 exploit | |
| CVE-2018-10088 | Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725. xiongmaitech · uc-httpd | Critical 9.8 | 40% | 3 exploits | |
| CVE-2017-8682 | Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, Windows Server 2016, Microsoft Office Word Viewer, Microsoft Office 2007 Service Pack 3 , and… microsoft · office 2007 | High 8.8 | 50% | 2 exploits | |
| CVE-2017-7679 | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. apache · http server | Critical 9.8 | 39% | 1 exploit | |
| CVE-2017-2935 | flash-plugin: multiple code execution issues fixed in APSB17-02 adobe · flash player | High 8.8 | 30% | 2 exploits | |
| CVE-2017-2934 | flash-plugin: multiple code execution issues fixed in APSB17-02 adobe · flash player | High 8.8 | 30% | 2 exploits | |
| CVE-2017-2933 | flash-plugin: multiple code execution issues fixed in APSB17-02 adobe · flash player | High 8.8 | 30% | 2 exploits |
Showing 151–200 of 1,459
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.