Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Watchlist

The CVE Watchlist, Under Review.

Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.

Synced hourly · figures as of Oct 19, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
753 vulnerabilities · highest score first
  • CVE-2026-97205Critical 9.2
    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.
    microsoft · azl3 httpd 2.4.68-1
    EPSS0.5%
    1 exploit
    Published Oct 14, 2026
  • CVE-2025-64155Critical 9.8
    An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an…
    fortinet · fortisiem
    EPSS43%
    1 exploit
    Published Jan 13, 2026
  • CVE-2025-59719Critical 9.8
    An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
    fortinet · fortiweb
    EPSS29%
    ·
    Published Dec 10, 2025
  • CVE-2024-0778Critical 9.8
    UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S up to 20210930.
    uniview · isc 2500-s firmware
    EPSS32%
    1 exploit
    Published Jan 22, 2024
  • CVE-2023-6612Critical 9.8
    It has been rated as critical.
    totolink · x5000r firmware
    EPSS31%
    1 exploit
    Published Dec 8, 2023
  • CVE-2023-50252Critical 9.8
    Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag.
    dompdf · php-svg-lib
    EPSS24%
    1 exploit
    Published Dec 12, 2023
  • CVE-2023-4473Critical 9.8
    A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable…
    zyxel · nas326 firmware
    EPSS41%
    ·
    Published Dec 1, 2023
  • CVE-2023-3710Critical 9.8
    Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004.
    honeywell · pm43 firmware
    EPSS49%
    1 exploit
    Published Sep 12, 2023
  • CVE-2023-36355Critical 9.9
    TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm.
    tp-link · tl-wr940n firmware
    EPSS32%
    2 exploits
    Published Jun 22, 2023
  • CVE-2023-35138Critical 9.8
    A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a…
    zyxel · nas326 firmware
    EPSS40%
    ·
    Published Dec 1, 2023
  • CVE-2023-30261Critical 9.8
    Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request.
    openwb · openwb
    EPSS32%
    1 exploit
    Published Jun 26, 2023
  • CVE-2023-26802Critical 9.8
    An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execute arbitrary commands via a crafted request.
    dcnglobal · dcbi-netlog-lab firmware
    EPSS49%
    1 exploit
    Published Mar 26, 2023
  • CVE-2023-2523Critical 9.8
    It has been rated as critical.
    e-office · e-office
    EPSS33%
    1 exploit
    Published May 4, 2023
  • CVE-2023-0562Critical 9.8
    It has been rated as critical.
    phpgurukul · bank locker management system
    EPSS44%
    1 exploit
    Published Jan 28, 2023
  • CVE-2022-45025Critical 9.8
    Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function.
    markdown preview enhanced project · markdown preview enhanced
    EPSS35%
    1 exploit
    Published Dec 6, 2022
  • CVE-2022-4257Critical 9.8
    It has been rated as critical.
    cdatatec · c-data web management system
    EPSS44%
    1 exploit
    Published Dec 1, 2022
  • CVE-2022-38352Critical 9.8
    ThinkPHP deserialization vulnerability
    thinkphp · thinkphp
    EPSS21%
    1 exploit
    Published Sep 16, 2022
  • CVE-2022-33107Critical 9.8
    Deserialization of Untrusted Data in topthink/framework
    thinkphp · thinkphp
    EPSS24%
    1 exploit
    Published Jun 30, 2022
  • CVE-2022-31125Critical 9.8
    A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functionality by sending a specially crafted HTTP request.
    roxy-wi · roxy-wi
    EPSS20%
    1 exploit
    Published Jul 6, 2022
  • CVE-2022-24108Critical 9.8
    The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of…
    skyoftech · so listing tabs
    EPSS33%
    1 exploit
    Published May 17, 2022
  • CVE-2021-44596Critical 9.8
    Wondershare LTD Dr.
    wondershare · dr.fone
    EPSS23%
    2 exploits
    Published Apr 29, 2022
  • CVE-2021-44567Critical 9.8
    SQL injection in francoisjacquet/rosariosis
    rosariosis · rosariosis
    EPSS23%
    1 exploit
    Published Feb 25, 2022
  • CVE-2021-43936Critical 9.8
    The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.
    webhmi · webhmi firmware
    EPSS36%
    2 exploits
    Published Dec 6, 2021
  • CVE-2021-42669Critical 9.8
    A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher_avatar.php.
    engineers online portal project · engineers online portal
    EPSS23%
    2 exploits
    Published Nov 5, 2021
  • CVE-2021-20045Critical 9.8
    A buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a remote unauthenticated attacker to potentially execute code as the 'nobody' user in the appliance.
    sonicwall · sma 200 firmware
    EPSS25%
    ·
    Published Jan 4, 2022
  • CVE-2019-7267Critical 9.8
    Linear eMerge 50P/5000P devices allow Cookie Path Traversal.
    nortekcontrol · linear emerge 5000p firmware
    EPSS21%
    1 exploit
    Published Jul 2, 2019
  • CVE-2019-19307Critical 9.8
    An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet.
    cesanta · mongoose
    EPSS42%
    1 exploit
    Published Nov 26, 2019
  • CVE-2019-16451Critical 9.8
    Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a heap overflow vulnerability.
    adobe · acrobat dc
    EPSS35%
    1 exploit
    Published Dec 19, 2019
  • CVE-2019-13360Critical 9.8
    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username.
    control-webpanel · webpanel
    EPSS24%
    2 exploits
    Published Jul 16, 2019
  • CVE-2018-7300Critical 9.8
    Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to write arbitrary files to the device's filesystem.
    eq-3 · homematic ccu2 firmware
    EPSS31%
    1 exploit
    Published Feb 22, 2018
  • CVE-2018-6396Critical 9.8
    SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla!
    google map landkarten project · google map landkarten
    EPSS24%
    2 exploits
    Published Feb 17, 2018
  • CVE-2018-20841Critical 9.8
    HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082 allow remote command execution via shell metacharacters in the mac parameter of a protocol.csp?function=set&fname=security&opt=mac_table request.
    hootoo · tripmate titan ht-tm05 firmware
    EPSS48%
    1 exploit
    Published Jun 11, 2019
  • CVE-2018-19126Critical 9.8
    PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.
    prestashop · prestashop
    EPSS23%
    2 exploits
    Published Nov 9, 2018
  • CVE-2018-13415Critical 9.8
    In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack.
    plex · media server
    EPSS31%
    2 exploits
    Published Aug 13, 2018
  • CVE-2018-11094Critical 9.8
    An issue was discovered on Intelbras NCLOUD 300 1.0 devices.
    intelbras · ncloud 300 firmware
    EPSS33%
    2 exploits
    Published May 15, 2018
  • CVE-2017-5815Critical 9.8
    A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
    hp · intelligent management center
    EPSS34%
    1 exploit
    Published Feb 15, 2018
  • CVE-2016-0801Critical 9.8
    The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal…
    google · android
    EPSS33%
    1 exploit
    Published Feb 7, 2016
  • CVE-2014-2994Critical 10.0
    Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to execute arbitrary code via an HTML file containing an IMG element with a long URL (src attribute).
    acunetix · web vulnerability scanner
    EPSS23%
    2 exploits
    Published Apr 27, 2014
  • CVE-2014-1770Critical 9.3
    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript code that interacts improperly with a CollectGarbage function call on a CMarkup object allocated by the CMarkup::CreateInitialMarkup…
    microsoft · internet explorer
    EPSS35%
    1 exploit
    Published May 22, 2014
  • CVE-2014-1303Critical 10.0
    webkitgtk: heap-based buffer overflow (WSA-2015-0001)
    apple · safari
    EPSS35%
    2 exploits
    Published Jan 26, 2015
  • CVE-2012-1205Critical 9.8
    Relocate Upload < 0.20 - Remote File Inclusion
    alanft · relocate-upload
    EPSS25%
    1 exploit
    Published Sep 18, 2011
  • CVE-2011-1255Critical 9.3
    The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized…
    microsoft · internet explorer
    EPSS42%
    1 exploit
    Published Jun 16, 2011
  • CVE-2010-2553Critical 9.3
    The Cinepak codec in Microsoft Windows XP SP2 and SP3, Windows Vista SP1 and SP2, and Windows 7 does not properly decompress media files, which allows remote attackers to execute arbitrary code via a crafted file, aka "Cinepak Codec Decompression Vulnerability."
    microsoft · windows 7
    EPSS31%
    2 exploits
    Published Aug 11, 2010
  • CVE-2010-0270Critical 10.0
    The SMB client in Microsoft Windows Server 2008 R2 and Windows 7 does not properly validate fields in SMB transaction responses, which allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and reboot)…
    microsoft · windows 7
    EPSS48%
    1 exploit
    Published Apr 14, 2010
  • CVE-2009-4462Critical 10.0
    Stack-based buffer overflow in the NetBiterConfig utility (NetBiterConfig.exe) 1.3.0 for Intellicom NetBiter WebSCADA allows remote attackers to execute arbitrary code via a long hn (hostname) parameter in a crafted HICP-protocol UDP packet.
    intellicom · netbiterconfig
    EPSS20%
    2 exploits
    Published Dec 30, 2009
  • CVE-2008-5518Critical 9.4
    Apache Geronimo Application Server multiple directory traversal vulnerabilities
    apache · geronimo
    EPSS36%
    1 exploit
    Published May 14, 2022
  • CVE-2007-0427Critical 9.3
    Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a help project (.HPJ) file with a long HLP field in the OPTIONS section.
    microsoft · html help workshop
    EPSS31%
    2 exploits
    Published Jan 22, 2007
  • CVE-2006-4812Critical 10.0
    Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function…
    php · php
    EPSS20%
    1 exploit
    Published Sep 30, 2006
  • CVE-2004-0989Critical 10.0
    Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that…
    xmlsoft · libxml
    EPSS22%
    1 exploit
    Published Mar 1, 2005
  • CVE-2004-0840Critical 10.0
    The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a…
    microsoft · exchange server
    EPSS30%
    ·
    Published Nov 3, 2004
Showing 351–400 of 753

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.

Figures as of Oct 19, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.