Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 19, 2026
751 vulnerabilities · highest score first
- CVE-2009-1936Critical 9.8_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks, execute arbitrary PHP…cpcommerce project · cpcommerceEPSS42%1 exploitPublished Jun 5, 2009
- CVE-2008-5232Critical 9.3Buffer overflow in the CallHTMLHelp method in the Microsoft Windows Media Services ActiveX control in nskey.dll 4.1.00.3917 in Windows Media Services on Microsoft Windows NT and 2000, and Avaya Media and Message Application servers, allows remote attackers to execute arbitrary…microsoft · windows ntEPSS32%1 exploitPublished Nov 25, 2008
- CVE-2008-3641Critical 10.0The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory.apple · cupsEPSS24%1 exploitPublished Oct 10, 2008
- CVE-2008-3529Critical 10.0Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.xmlsoft · libxml2EPSS23%1 exploitPublished Sep 12, 2008
- CVE-2008-0118Critical 9.3Unspecified vulnerability in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, Excel Viewer 2003 up to SP3, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption from an "allocation…microsoft · officeEPSS35%2 exploitsPublished Mar 11, 2008
- CVE-2008-0113Critical 9.3Unspecified vulnerability in Microsoft Office Excel Viewer 2003 up to SP3 allows user-assisted remote attackers to execute arbitrary code via an Excel document with malformed cell comments that trigger memory corruption from an "allocation error," aka "Microsoft Office Cell…microsoft · excel viewerEPSS42%1 exploitPublished Mar 11, 2008
- CVE-2007-0024Critical 9.3Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains…microsoft · internet explorerEPSS44%2 exploitsPublished Jan 9, 2007
- CVE-2006-5559Critical 9.3The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and 2.8 SP1 does not properly track freed memory when the second argument is a…microsoft · data access componentsEPSS44%1 exploitPublished Oct 27, 2006
- CVE-2005-3120Critical 9.8Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.invisible-island · lynxEPSS23%1 exploitPublished Oct 17, 2005
- CVE-2004-1769Critical 10.0The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.cpanel · cpanelEPSS35%1 exploitPublished Mar 11, 2004
- CVE-2004-0083Critical 10.0Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106.xfree86 project · x11r6EPSS21%1 exploitPublished Feb 8, 2004
- CVE-2026-53787Critical 9.3Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint…EPSS6.5%4 exploitsPublished Jun 12, 2026
- CVE-2026-105445Critical 9.4Docker Hub account conversion could reassign an active personal access token to another userEPSS0.4%1 exploitPublished Oct 13, 2026
- CVE-2024-22836Critical 9.8An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier.akaunting · akauntingEPSS30%1 exploitPublished Feb 8, 2024
- CVE-2022-46020Critical 9.8WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.wbce · wbce cmsEPSS39%1 exploitPublished Dec 20, 2022
- CVE-2022-22916Critical 9.8O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.zoneland · o2oaEPSS39%1 exploitPublished Feb 17, 2022
- CVE-2021-46424Critical 9.1Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request.telesquare · tlr-2005ksh firmwareEPSS36%2 exploitsPublished Apr 27, 2022
- CVE-2021-45092Critical 9.8Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.cybelesoft · thinfinity virtualuiEPSS41%1 exploitPublished Dec 16, 2021
- CVE-2021-3817Critical 9.8wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Commandwbce · wbce cmsEPSS38%2 exploitsPublished Dec 9, 2021
- CVE-2021-3278Critical 9.8Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection .local services search engine management system project · local services search engine management systemEPSS25%2 exploitsPublished Jan 26, 2021
- CVE-2021-29003Critical 9.8Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstrated by the sys_config_valid.xgi?exeshell=%60telnetd%20%26%60 URI.genexis · platinum 4410 firmwareEPSS45%1 exploitPublished Apr 13, 2021
- CVE-2020-35314Critical 9.8A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a webshell via the theme/plugin installer.wondercms · wondercmsEPSS27%2 exploitsPublished Apr 20, 2021
- CVE-2020-20277Critical 9.8There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper implementation of a chroot jail in common.c's compose_abspath function that can be abused to read or write to arbitrary files…troglobit · uftpdEPSS26%2 exploitsPublished Dec 18, 2020
- CVE-2020-14011Critical 9.8Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked.lansweeper · lansweeperEPSS29%1 exploitPublished Jun 15, 2020
- CVE-2019-25024Critical 9.8OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_service parameter.alleghenycreative · openrepeaterEPSS28%2 exploitsPublished Feb 19, 2021
- CVE-2018-9032Critical 9.8An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmware Version : 1.02-2.06) devices potentially allows attackers to bypass SharePort Web Access Portal by directly visiting /category_view.php…dlink · dir-850l firmwareEPSS28%2 exploitsPublished Mar 27, 2018
- CVE-2018-17440Critical 9.8An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1.dlink · central wifimanagerEPSS38%2 exploitsPublished Oct 8, 2018
- CVE-2018-14064Critical 9.8The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80.velotismart project · velotismart wifi firmwareEPSS37%2 exploitsPublished Jul 15, 2018
- CVE-2018-13050Critical 9.8A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST request.zohocorp · manageengine applications managerEPSS40%1 exploitPublished Jul 2, 2018
- CVE-2017-12943Critical 9.8D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/show_info.php?REQUIRE_FILE= absolute path traversal attack, as demonstrated by discovering the admin password.dlink · dir-600 b1 firmwareEPSS39%1 exploitPublished Aug 18, 2017
- CVE-2015-6131Critical 9.3Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted .mcl file, aka "Media Center Library Parsing RCE Vulnerability."microsoft · windows 7EPSS31%2 exploitsPublished Dec 9, 2015
- CVE-2015-3036Critical 10.0Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in certain NETGEAR products, TP-LINK products, and other products, allows remote attackers to execute arbitrary code by providing a long computer name in a session…kcodes · netusbEPSS28%2 exploitsPublished May 20, 2015
- CVE-2013-4976Critical 9.8Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentialshikvision · ds-2cd7153-e firmwareEPSS36%1 exploitPublished Dec 27, 2019
- CVE-2013-2570Critical 9.8A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary /opt/cgi/view/param, which could let a remove malicious user execute arbitrary code.zavio · f3105 firmwareEPSS27%1 exploitPublished Jan 29, 2020
- CVE-2013-0633Critical 9.3flash-plugin: multiple code execution flaws (APSB13-04)adobe · flash playerEPSS21%1 exploitPublished Feb 7, 2013
- CVE-2011-3142Critical 10.0Stack-based buffer overflow in an ActiveX control in KVWebSvr.dll in WellinTech KingView 6.52 and 6.53 allows remote attackers to execute arbitrary code via a long second argument to the ValidateUser method.wellintech · kingviewEPSS38%2 exploitsPublished Aug 16, 2011
- CVE-2010-4538Critical 9.3Buffer overflow in the sect_enttec_dmx_da function in epan/dissectors/packet-enttec.c in Wireshark 1.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ENTTEC DMX packet with Run Length Encoding (RLE)…wireshark · wiresharkEPSS29%1 exploitPublished Jan 7, 2011
- CVE-2010-3639Critical 9.3flash-plugin: security bulletin APSB10-26adobe · flash playerEPSS22%1 exploitPublished Nov 4, 2010
- CVE-2010-3227Critical 9.3Stack-based buffer overflow in the UpdateFrameTitleForDocument method in the CFrameWnd class in mfc42.dll in the Microsoft Foundation Class (MFC) Library in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and…microsoft · windows 7EPSS21%2 exploitsPublished Oct 26, 2010
- CVE-2010-2321Critical 9.3Buffer overflow in Adobe InDesign CS3 10.0 allows user-assisted remote attackers to execute arbitrary code via a crafted .indd file.adobe · indesign cs3EPSS21%2 exploitsPublished Jun 18, 2010
- CVE-2009-0692Critical 10.0dhclient: stack overflow leads to arbitrary code execution as rootisc · dhcpEPSS26%1 exploitPublished Jul 14, 2009
- CVE-2009-0565Critical 9.3Buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote…microsoft · officeEPSS41%2 exploitsPublished Jun 10, 2009
- CVE-2008-0116Critical 9.3Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via malformed tags in rich text, aka "Excel Rich Text Validation Vulnerability."microsoft · excelEPSS48%1 exploitPublished Mar 11, 2008
- CVE-2007-2217Critical 9.3Kodak Image Viewer in Microsoft Windows 2000 SP4, and in some cases XP SP2 and Server 2003 SP1 and SP2, allows remote attackers to execute arbitrary code via crafted image files that trigger memory corruption, as demonstrated by a certain .tif (TIFF) file.kodak · image viewerEPSS41%1 exploitPublished Oct 9, 2007
- CVE-2007-2216Critical 9.3The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to…microsoft · internet explorerEPSS41%1 exploitPublished Aug 14, 2007
- CVE-2007-0216Critical 9.3wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section length headers, aka "Microsoft Works File Converter Input Validation…microsoft · officeEPSS38%1 exploitPublished Feb 12, 2008
- CVE-1999-0911Critical 10.0Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories.proftpd project · proftpdEPSS38%2 exploitsPublished Aug 27, 1999
- CVE-1999-0368Critical 10.0Buffer overflows in wuarchive ftpd (wu-ftpd) and ProFTPD lead to remote root access, a.k.a.proftpd project · proftpdEPSS40%2 exploitsPublished Feb 9, 1999
- CVE-2026-97205Critical 9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.microsoft · azl3 httpd 2.4.68-1EPSS0.5%1 exploitPublished Oct 14, 2026
- CVE-2025-64155Critical 9.8An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an…fortinet · fortisiemEPSS43%1 exploitPublished Jan 13, 2026
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2009-1936 | _functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks, execute arbitrary PHP… cpcommerce project · cpcommerce | Critical 9.8 | 42% | 1 exploit | |
| CVE-2008-5232 | Buffer overflow in the CallHTMLHelp method in the Microsoft Windows Media Services ActiveX control in nskey.dll 4.1.00.3917 in Windows Media Services on Microsoft Windows NT and 2000, and Avaya Media and Message Application servers, allows remote attackers to execute arbitrary… microsoft · windows nt | Critical 9.3 | 32% | 1 exploit | |
| CVE-2008-3641 | The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory. apple · cups | Critical 10.0 | 24% | 1 exploit | |
| CVE-2008-3529 | Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name. xmlsoft · libxml2 | Critical 10.0 | 23% | 1 exploit | |
| CVE-2008-0118 | Unspecified vulnerability in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, Excel Viewer 2003 up to SP3, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption from an "allocation… microsoft · office | Critical 9.3 | 35% | 2 exploits | |
| CVE-2008-0113 | Unspecified vulnerability in Microsoft Office Excel Viewer 2003 up to SP3 allows user-assisted remote attackers to execute arbitrary code via an Excel document with malformed cell comments that trigger memory corruption from an "allocation error," aka "Microsoft Office Cell… microsoft · excel viewer | Critical 9.3 | 42% | 1 exploit | |
| CVE-2007-0024 | Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains… microsoft · internet explorer | Critical 9.3 | 44% | 2 exploits | |
| CVE-2006-5559 | The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and 2.8 SP1 does not properly track freed memory when the second argument is a… microsoft · data access components | Critical 9.3 | 44% | 1 exploit | |
| CVE-2005-3120 | Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters. invisible-island · lynx | Critical 9.8 | 23% | 1 exploit | |
| CVE-2004-1769 | The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass. cpanel · cpanel | Critical 10.0 | 35% | 1 exploit | |
| CVE-2004-0083 | Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106. xfree86 project · x11r6 | Critical 10.0 | 21% | 1 exploit | |
| CVE-2026-53787 | Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint… | Critical 9.3 | 6.5% | 4 exploits | |
| CVE-2026-105445 | Docker Hub account conversion could reassign an active personal access token to another user | Critical 9.4 | 0.4% | 1 exploit | |
| CVE-2024-22836 | An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. akaunting · akaunting | Critical 9.8 | 30% | 1 exploit | |
| CVE-2022-46020 | WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. wbce · wbce cms | Critical 9.8 | 39% | 1 exploit | |
| CVE-2022-22916 | O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke. zoneland · o2oa | Critical 9.8 | 39% | 1 exploit | |
| CVE-2021-46424 | Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request. telesquare · tlr-2005ksh firmware | Critical 9.1 | 36% | 2 exploits | |
| CVE-2021-45092 | Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter. cybelesoft · thinfinity virtualui | Critical 9.8 | 41% | 1 exploit | |
| CVE-2021-3817 | wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command wbce · wbce cms | Critical 9.8 | 38% | 2 exploits | |
| CVE-2021-3278 | Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection . local services search engine management system project · local services search engine management system | Critical 9.8 | 25% | 2 exploits | |
| CVE-2021-29003 | Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstrated by the sys_config_valid.xgi?exeshell=%60telnetd%20%26%60 URI. genexis · platinum 4410 firmware | Critical 9.8 | 45% | 1 exploit | |
| CVE-2020-35314 | A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a webshell via the theme/plugin installer. wondercms · wondercms | Critical 9.8 | 27% | 2 exploits | |
| CVE-2020-20277 | There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper implementation of a chroot jail in common.c's compose_abspath function that can be abused to read or write to arbitrary files… troglobit · uftpd | Critical 9.8 | 26% | 2 exploits | |
| CVE-2020-14011 | Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. lansweeper · lansweeper | Critical 9.8 | 29% | 1 exploit | |
| CVE-2019-25024 | OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_service parameter. alleghenycreative · openrepeater | Critical 9.8 | 28% | 2 exploits | |
| CVE-2018-9032 | An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmware Version : 1.02-2.06) devices potentially allows attackers to bypass SharePort Web Access Portal by directly visiting /category_view.php… dlink · dir-850l firmware | Critical 9.8 | 28% | 2 exploits | |
| CVE-2018-17440 | An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. dlink · central wifimanager | Critical 9.8 | 38% | 2 exploits | |
| CVE-2018-14064 | The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80. velotismart project · velotismart wifi firmware | Critical 9.8 | 37% | 2 exploits | |
| CVE-2018-13050 | A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST request. zohocorp · manageengine applications manager | Critical 9.8 | 40% | 1 exploit | |
| CVE-2017-12943 | D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/show_info.php?REQUIRE_FILE= absolute path traversal attack, as demonstrated by discovering the admin password. dlink · dir-600 b1 firmware | Critical 9.8 | 39% | 1 exploit | |
| CVE-2015-6131 | Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted .mcl file, aka "Media Center Library Parsing RCE Vulnerability." microsoft · windows 7 | Critical 9.3 | 31% | 2 exploits | |
| CVE-2015-3036 | Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in certain NETGEAR products, TP-LINK products, and other products, allows remote attackers to execute arbitrary code by providing a long computer name in a session… kcodes · netusb | Critical 10.0 | 28% | 2 exploits | |
| CVE-2013-4976 | Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials hikvision · ds-2cd7153-e firmware | Critical 9.8 | 36% | 1 exploit | |
| CVE-2013-2570 | A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary /opt/cgi/view/param, which could let a remove malicious user execute arbitrary code. zavio · f3105 firmware | Critical 9.8 | 27% | 1 exploit | |
| CVE-2013-0633 | flash-plugin: multiple code execution flaws (APSB13-04) adobe · flash player | Critical 9.3 | 21% | 1 exploit | |
| CVE-2011-3142 | Stack-based buffer overflow in an ActiveX control in KVWebSvr.dll in WellinTech KingView 6.52 and 6.53 allows remote attackers to execute arbitrary code via a long second argument to the ValidateUser method. wellintech · kingview | Critical 10.0 | 38% | 2 exploits | |
| CVE-2010-4538 | Buffer overflow in the sect_enttec_dmx_da function in epan/dissectors/packet-enttec.c in Wireshark 1.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ENTTEC DMX packet with Run Length Encoding (RLE)… wireshark · wireshark | Critical 9.3 | 29% | 1 exploit | |
| CVE-2010-3639 | flash-plugin: security bulletin APSB10-26 adobe · flash player | Critical 9.3 | 22% | 1 exploit | |
| CVE-2010-3227 | Stack-based buffer overflow in the UpdateFrameTitleForDocument method in the CFrameWnd class in mfc42.dll in the Microsoft Foundation Class (MFC) Library in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and… microsoft · windows 7 | Critical 9.3 | 21% | 2 exploits | |
| CVE-2010-2321 | Buffer overflow in Adobe InDesign CS3 10.0 allows user-assisted remote attackers to execute arbitrary code via a crafted .indd file. adobe · indesign cs3 | Critical 9.3 | 21% | 2 exploits | |
| CVE-2009-0692 | dhclient: stack overflow leads to arbitrary code execution as root isc · dhcp | Critical 10.0 | 26% | 1 exploit | |
| CVE-2009-0565 | Buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote… microsoft · office | Critical 9.3 | 41% | 2 exploits | |
| CVE-2008-0116 | Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via malformed tags in rich text, aka "Excel Rich Text Validation Vulnerability." microsoft · excel | Critical 9.3 | 48% | 1 exploit | |
| CVE-2007-2217 | Kodak Image Viewer in Microsoft Windows 2000 SP4, and in some cases XP SP2 and Server 2003 SP1 and SP2, allows remote attackers to execute arbitrary code via crafted image files that trigger memory corruption, as demonstrated by a certain .tif (TIFF) file. kodak · image viewer | Critical 9.3 | 41% | 1 exploit | |
| CVE-2007-2216 | The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to… microsoft · internet explorer | Critical 9.3 | 41% | 1 exploit | |
| CVE-2007-0216 | wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section length headers, aka "Microsoft Works File Converter Input Validation… microsoft · office | Critical 9.3 | 38% | 1 exploit | |
| CVE-1999-0911 | Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories. proftpd project · proftpd | Critical 10.0 | 38% | 2 exploits | |
| CVE-1999-0368 | Buffer overflows in wuarchive ftpd (wu-ftpd) and ProFTPD lead to remote root access, a.k.a. proftpd project · proftpd | Critical 10.0 | 40% | 2 exploits | |
| CVE-2026-97205 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. microsoft · azl3 httpd 2.4.68-1 | Critical 9.2 | 0.5% | 1 exploit | |
| CVE-2025-64155 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an… fortinet · fortisiem | Critical 9.8 | 43% | 1 exploit |
Showing 301–350 of 751
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.