Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 19, 2026
521 vulnerabilities · highest score first
- CVE-2001-0876High 7.5Buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with a long Location URL.microsoft · windows 98EPSS49%2 exploitsPublished Dec 20, 2001
- CVE-2025-11001High 7.87-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability.7-zip · 7-zipEPSS27%1 exploitPublished Nov 19, 2025
- CVE-2025-1097High 8.8ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotationEPSS33%1 exploitPublished Mar 25, 2025
- CVE-2024-55661High 8.7Laravel Pulse Allows Remote Code Execution via Unprotected Query Methodlaravel · pulseEPSS30%1 exploitPublished Dec 13, 2024
- CVE-2024-31445High 8.8Cacti provides an operational monitoring and fault management framework.cacti · cactiEPSS26%1 exploitPublished May 14, 2024
- CVE-2024-24824High 8.8Graylog vulnerable to instantiation of arbitrary classes triggered by API requestgraylog · graylogEPSS35%1 exploitPublished Feb 7, 2024
- CVE-2024-24747High 8.8Minio unsafe default: Access keys inherit admin of root user, allowing privilege escalationminio · minioEPSS34%1 exploitPublished Feb 1, 2024
- CVE-2023-5147High 8.8UNSUPPORTED WHEN ASSIGNED A vulnerability was found in D-Link DAR-7000 up to 20151231.dlink · dar-7000 firmwareEPSS26%1 exploitPublished Sep 25, 2023
- CVE-2023-3852High 7.2It has been declared as critical.openrapid · rapidcmsEPSS25%1 exploitPublished Jul 23, 2023
- CVE-2023-37569High 8.8This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component.esds.co · emagic data center managementEPSS34%2 exploitsPublished Aug 8, 2023
- CVE-2023-34129High 8.8Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authenticated remote attacker to traverse the directory and extract arbitrary files using Zip Slip method to any location on the underlying…sonicwall · analyticsEPSS41%·Published Jul 13, 2023
- CVE-2023-32235High 7.5Path Traversal in Ghostghost · ghostEPSS39%1 exploitPublished May 5, 2023
- CVE-2022-48194High 8.8TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a crafted firmware update because the signature check is inadequate.tp-link · tl-wr902ac firmwareEPSS33%1 exploitPublished Dec 30, 2022
- CVE-2022-45701High 8.8Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.commscope · arris tg2482a firmwareEPSS43%2 exploitsPublished Feb 17, 2023
- CVE-2022-37190High 8.8CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE).cuppacms · cuppacmsEPSS46%2 exploitsPublished Sep 13, 2022
- CVE-2021-43164High 8.8A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the updateVersion function in /cgi-bin/luci/api/wireless.ruijienetworks · reyeeosEPSS35%2 exploitsPublished May 3, 2022
- CVE-2021-42697High 7.5Uncontrolled Recursion in Akka HTTPakka · http serverEPSS36%1 exploitPublished May 24, 2022
- CVE-2021-20044High 8.8A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the appliance.sonicwall · sma 200 firmwareEPSS40%·Published Jan 4, 2022
- CVE-2020-5844High 7.2index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location.artica · pandora fmsEPSS30%3 exploitsPublished Mar 16, 2020
- CVE-2020-5515High 7.2Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.gilacms · gila cmsEPSS27%3 exploitsPublished Jan 6, 2020
- CVE-2020-29134High 8.6The TOTVS Fluig platform allows path traversal through the parameter "file = ..totvs · fluigEPSS28%3 exploitsPublished Mar 5, 2021
- CVE-2019-9164High 8.8Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.nagios · nagios xiEPSS46%1 exploitPublished Mar 28, 2019
- CVE-2019-7669High 8.8Prima Systems FlexAir, Versions 2.3.38 and prior.primasystems · flexairEPSS31%1 exploitPublished Jul 1, 2019
- CVE-2019-15978High 7.2Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system (OS).cisco · data center network managerEPSS37%2 exploitsPublished Jan 6, 2020
- CVE-2019-15977High 7.5Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device.cisco · data center network managerEPSS38%2 exploitsPublished Jan 6, 2020
- CVE-2019-13359High 7.5In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user.control-webpanel · webpanelEPSS26%3 exploitsPublished Jul 16, 2019
- CVE-2019-1150High 8.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts.microsoft · windows 10EPSS26%2 exploitsPublished Aug 14, 2019
- CVE-2019-0235High 8.8Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.apache · ofbizEPSS33%2 exploitsPublished Apr 30, 2020
- CVE-2018-8413High 7.8A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2012,…microsoft · windows 10EPSS46%1 exploitPublished Oct 10, 2018
- CVE-2018-19616High 8.1An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element.rockwellautomation · powermonitor 1000 firmwareEPSS30%1 exploitPublished Dec 26, 2018
- CVE-2018-16752High 8.8LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp.linknet-usa · lw-n605r firmwareEPSS43%2 exploitsPublished Sep 20, 2018
- CVE-2018-12054High 7.5Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.schools alert management script project · schools alert management scriptEPSS38%2 exploitsPublished Jun 8, 2018
- CVE-2017-6019High 7.5A series of rapid requests to the device may cause it to reboot.schneider-electric · conext combox 865-1058 firmwareEPSS37%1 exploitPublished Apr 7, 2017
- CVE-2016-6255High 7.5Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.libupnp project · libupnpEPSS27%1 exploitPublished Mar 7, 2017
- CVE-2016-4108High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS38%1 exploitPublished May 10, 2016
- CVE-2016-1106High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS37%1 exploitPublished May 10, 2016
- CVE-2016-1105High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS38%1 exploitPublished May 10, 2016
- CVE-2016-1104High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS40%1 exploitPublished May 10, 2016
- CVE-2016-1103High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS38%1 exploitPublished May 10, 2016
- CVE-2016-1102High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS40%1 exploitPublished May 10, 2016
- CVE-2016-1101High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS38%1 exploitPublished May 10, 2016
- CVE-2016-1096High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS40%1 exploitPublished May 10, 2016
- CVE-2015-8644High 8.8flash-plugin: multiple code execution issues fixed in APSB16-01adobe · airEPSS26%1 exploitPublished Dec 28, 2015
- CVE-2015-8635High 8.8flash-plugin: multiple code execution issues fixed in APSB16-01adobe · airEPSS25%1 exploitPublished Dec 28, 2015
- CVE-2015-8634High 8.8flash-plugin: multiple code execution issues fixed in APSB16-01adobe · airEPSS25%1 exploitPublished Dec 28, 2015
- CVE-2015-0008High 8.3The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client,…microsoft · windows 7EPSS29%1 exploitPublished Feb 11, 2015
- CVE-2014-5006High 7.5Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a ..zohocorp · manageengine desktop centralEPSS25%3 exploitsPublished Oct 21, 2014
- CVE-2012-1592High 8.8Unrestricted Upload of File with Dangerous Type in Apache Struts2apache · strutsEPSS29%1 exploitPublished Apr 23, 2022
- CVE-2007-0039High 7.8The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS…microsoft · exchange serverEPSS45%·Published May 8, 2007
- CVE-2006-1236High 7.5Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010.crossfire · crossfireEPSS28%2 exploitsPublished Mar 15, 2006
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2001-0876 | Buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with a long Location URL. microsoft · windows 98 | High 7.5 | 49% | 2 exploits | |
| CVE-2025-11001 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. 7-zip · 7-zip | High 7.8 | 27% | 1 exploit | |
| CVE-2025-1097 | ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation | High 8.8 | 33% | 1 exploit | |
| CVE-2024-55661 | Laravel Pulse Allows Remote Code Execution via Unprotected Query Method laravel · pulse | High 8.7 | 30% | 1 exploit | |
| CVE-2024-31445 | Cacti provides an operational monitoring and fault management framework. cacti · cacti | High 8.8 | 26% | 1 exploit | |
| CVE-2024-24824 | Graylog vulnerable to instantiation of arbitrary classes triggered by API request graylog · graylog | High 8.8 | 35% | 1 exploit | |
| CVE-2024-24747 | Minio unsafe default: Access keys inherit admin of root user, allowing privilege escalation minio · minio | High 8.8 | 34% | 1 exploit | |
| CVE-2023-5147 | UNSUPPORTED WHEN ASSIGNED A vulnerability was found in D-Link DAR-7000 up to 20151231. dlink · dar-7000 firmware | High 8.8 | 26% | 1 exploit | |
| CVE-2023-3852 | It has been declared as critical. openrapid · rapidcms | High 7.2 | 25% | 1 exploit | |
| CVE-2023-37569 | This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. esds.co · emagic data center management | High 8.8 | 34% | 2 exploits | |
| CVE-2023-34129 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authenticated remote attacker to traverse the directory and extract arbitrary files using Zip Slip method to any location on the underlying… sonicwall · analytics | High 8.8 | 41% | · | |
| CVE-2023-32235 | Path Traversal in Ghost ghost · ghost | High 7.5 | 39% | 1 exploit | |
| CVE-2022-48194 | TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a crafted firmware update because the signature check is inadequate. tp-link · tl-wr902ac firmware | High 8.8 | 33% | 1 exploit | |
| CVE-2022-45701 | Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature. commscope · arris tg2482a firmware | High 8.8 | 43% | 2 exploits | |
| CVE-2022-37190 | CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). cuppacms · cuppacms | High 8.8 | 46% | 2 exploits | |
| CVE-2021-43164 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the updateVersion function in /cgi-bin/luci/api/wireless. ruijienetworks · reyeeos | High 8.8 | 35% | 2 exploits | |
| CVE-2021-42697 | Uncontrolled Recursion in Akka HTTP akka · http server | High 7.5 | 36% | 1 exploit | |
| CVE-2021-20044 | A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the appliance. sonicwall · sma 200 firmware | High 8.8 | 40% | · | |
| CVE-2020-5844 | index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. artica · pandora fms | High 7.2 | 30% | 3 exploits | |
| CVE-2020-5515 | Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection. gilacms · gila cms | High 7.2 | 27% | 3 exploits | |
| CVE-2020-29134 | The TOTVS Fluig platform allows path traversal through the parameter "file = .. totvs · fluig | High 8.6 | 28% | 3 exploits | |
| CVE-2019-9164 | Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job. nagios · nagios xi | High 8.8 | 46% | 1 exploit | |
| CVE-2019-7669 | Prima Systems FlexAir, Versions 2.3.38 and prior. primasystems · flexair | High 8.8 | 31% | 1 exploit | |
| CVE-2019-15978 | Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system (OS). cisco · data center network manager | High 7.2 | 37% | 2 exploits | |
| CVE-2019-15977 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. cisco · data center network manager | High 7.5 | 38% | 2 exploits | |
| CVE-2019-13359 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user. control-webpanel · webpanel | High 7.5 | 26% | 3 exploits | |
| CVE-2019-1150 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. microsoft · windows 10 | High 8.8 | 26% | 2 exploits | |
| CVE-2019-0235 | Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks. apache · ofbiz | High 8.8 | 33% | 2 exploits | |
| CVE-2018-8413 | A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2012,… microsoft · windows 10 | High 7.8 | 46% | 1 exploit | |
| CVE-2018-19616 | An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element. rockwellautomation · powermonitor 1000 firmware | High 8.1 | 30% | 1 exploit | |
| CVE-2018-16752 | LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. linknet-usa · lw-n605r firmware | High 8.8 | 43% | 2 exploits | |
| CVE-2018-12054 | Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal. schools alert management script project · schools alert management script | High 7.5 | 38% | 2 exploits | |
| CVE-2017-6019 | A series of rapid requests to the device may cause it to reboot. schneider-electric · conext combox 865-1058 firmware | High 7.5 | 37% | 1 exploit | |
| CVE-2016-6255 | Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler. libupnp project · libupnp | High 7.5 | 27% | 1 exploit | |
| CVE-2016-4108 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 38% | 1 exploit | |
| CVE-2016-1106 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 37% | 1 exploit | |
| CVE-2016-1105 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 38% | 1 exploit | |
| CVE-2016-1104 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 40% | 1 exploit | |
| CVE-2016-1103 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 38% | 1 exploit | |
| CVE-2016-1102 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 40% | 1 exploit | |
| CVE-2016-1101 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 38% | 1 exploit | |
| CVE-2016-1096 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 40% | 1 exploit | |
| CVE-2015-8644 | flash-plugin: multiple code execution issues fixed in APSB16-01 adobe · air | High 8.8 | 26% | 1 exploit | |
| CVE-2015-8635 | flash-plugin: multiple code execution issues fixed in APSB16-01 adobe · air | High 8.8 | 25% | 1 exploit | |
| CVE-2015-8634 | flash-plugin: multiple code execution issues fixed in APSB16-01 adobe · air | High 8.8 | 25% | 1 exploit | |
| CVE-2015-0008 | The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client,… microsoft · windows 7 | High 8.3 | 29% | 1 exploit | |
| CVE-2014-5006 | Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. zohocorp · manageengine desktop central | High 7.5 | 25% | 3 exploits | |
| CVE-2012-1592 | Unrestricted Upload of File with Dangerous Type in Apache Struts2 apache · struts | High 8.8 | 29% | 1 exploit | |
| CVE-2007-0039 | The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS… microsoft · exchange server | High 7.8 | 45% | · | |
| CVE-2006-1236 | Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010. crossfire · crossfire | High 7.5 | 28% | 2 exploits |
Showing 201–250 of 521
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.