Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 20, 2026
755 vulnerabilities · highest score first
- CVE-2003-0899Critical 9.8Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '' characters, which trigger the overflow when the characters are expanded to "<" and…acme · thttpdEPSS22%2 exploitsPublished Nov 3, 2003
- CVE-2001-0144Critical 10.0CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow.ssh · sshEPSS32%2 exploitsPublished Mar 12, 2001
- CVE-2026-76268Critical 9.8Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprisesplunk · splunkEPSS1.6%1 exploitPublished Oct 7, 2026
- CVE-2024-38200Critical 9.1Microsoft Office Spoofing Vulnerabilitymicrosoft · officeEPSS20%1 exploitPublished Aug 13, 2024
- CVE-2023-33404Critical 9.8An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code.blogengine · blogengine.netEPSS26%1 exploitPublished Jun 26, 2023
- CVE-2023-31465Critical 9.8By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call.fsmlabs · timekeeperEPSS46%1 exploitPublished Jul 26, 2023
- CVE-2023-2648Critical 9.8It has been classified as critical.weaver · e-officeEPSS28%1 exploitPublished May 11, 2023
- CVE-2022-38621Critical 9.8Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page.doufox · doufoxEPSS25%1 exploitPublished Sep 16, 2022
- CVE-2022-37159Critical 9.8Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.claroline · clarolineEPSS27%1 exploitPublished Aug 25, 2022
- CVE-2022-26265Critical 9.8Remote Code Execution in Contao Managed Editioncontao · contaoEPSS30%1 exploitPublished Mar 20, 2022
- CVE-2020-21224Critical 9.8A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0.inspur · clusterengineEPSS39%1 exploitPublished Feb 22, 2021
- CVE-2020-11819Critical 9.8In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.rukovoditel · rukovoditelEPSS27%2 exploitsPublished Apr 16, 2020
- CVE-2019-12988Critical 9.8Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6).citrix · netscaler sd-wanEPSS43%·Published Jul 16, 2019
- CVE-2019-12987Critical 9.8Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).citrix · netscaler sd-wanEPSS43%·Published Jul 16, 2019
- CVE-2016-1606Critical 9.8Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code via (1) the NetworkName property value to ObjectXSNAConfig.ObjectXSNAConfig in iconfig.dll, (2) the CPName property value to…microfocus · rumbaEPSS46%1 exploitPublished Jul 2, 2016
- CVE-2015-2432Critical 9.3ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a…microsoft · windows 7EPSS30%1 exploitPublished Aug 14, 2015
- CVE-2014-7235Critical 10.0htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as…freepbx · freepbxEPSS43%1 exploitPublished Oct 7, 2014
- CVE-2014-1785Critical 9.3Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,…microsoft · internet explorerEPSS30%2 exploitsPublished Jun 11, 2014
- CVE-2013-1309Critical 9.3Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than…microsoft · internet explorerEPSS39%1 exploitPublished May 15, 2013
- CVE-2011-1248Critical 9.3WINS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, R2, and R2 SP1 does not properly handle socket send exceptions, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets, related to…microsoft · windows server 2003EPSS48%1 exploitPublished May 13, 2011
- CVE-2010-2330Critical 9.3Stack-based buffer overflow in iSharer File Sharing Wizard 1.5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Content-Length header.upredsun · isharer file sharing wizardEPSS28%1 exploitPublished Jun 18, 2010
- CVE-2010-1938Critical 9.3Off-by-one error in the opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a…nrl · opieEPSS22%1 exploitPublished May 28, 2010
- CVE-2010-1248Critical 9.3Buffer overflow in Microsoft Office Excel 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via an Excel file with a malformed HFPicture (0x866) record, aka "Excel HFPicture Memory Corruption Vulnerability."microsoft · excelEPSS27%2 exploitsPublished Jun 8, 2010
- CVE-2010-0028Critical 9.3Integer overflow in Microsoft Paint in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted JPEG (.JPG) file, aka "MS Paint Integer Overflow Vulnerability."microsoft · windows 2000EPSS48%1 exploitPublished Feb 10, 2010
- CVE-2009-3244Critical 9.3Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe Shockwave Player 11.5.1.601 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long PlayerVersion property value.adobe · shockwave playerEPSS20%2 exploitsPublished Sep 18, 2009
- CVE-2009-2754Critical 10.0Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC Legato NetWorker, allows…emc · legato networkerEPSS40%1 exploitPublished Mar 5, 2010
- CVE-2009-2514Critical 9.3win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not correctly parse font code during construction of a directory-entry table, which allows remote attackers to execute arbitrary code via a crafted Embedded OpenType (EOT) font, aka…microsoft · windows 2000EPSS47%1 exploitPublished Nov 11, 2009
- CVE-2009-0520Critical 9.3flash-plugin: Buffer overflow (arbitrary code execution) via crafted SWF file.adobe · flash playerEPSS28%1 exploitPublished Feb 24, 2009
- CVE-2006-0287Critical 10.0Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# OHS02.oracle · application serverEPSS29%1 exploitPublished Jan 18, 2006
- CVE-2004-0990Critical 10.0Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the…gd graphics library · gdlibEPSS28%1 exploitPublished Mar 1, 2005
- CVE-2004-0600Critical 10.0Buffer overflow in the Samba Web Administration Tool (SWAT) in Samba 3.0.2 to 3.0.4 allows remote attackers to execute arbitrary code via an invalid base-64 character during HTTP basic authentication.samba · sambaEPSS29%1 exploitPublished Jul 27, 2004
- CVE-2003-1026Critical 9.3Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by…microsoft · internet explorerEPSS39%1 exploitPublished Jan 20, 2004
- CVE-2003-0209Critical 10.0Integer overflow in the TCP stream reassembly module (stream4) for Snort 2.0 and earlier allows remote attackers to execute arbitrary code via large sequence numbers in packets, which enable a heap-based buffer overflow.sourcefire · snortEPSS39%1 exploitPublished May 5, 2003
- CVE-2002-0721Critical 10.0Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and possibly remote attackers, to run stored procedures with administrator privileges via (1)…microsoft · sql serverEPSS46%1 exploitPublished Sep 5, 2002
- CVE-2000-0854Critical 10.0When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL's such as riched20.dll and msi.dll, which could allow an attacker to execute arbitrary commands by inserting a Trojan Horse DLL into the same directory as the document.microsoft · officeEPSS37%1 exploitPublished Nov 14, 2000
- CVE-1999-0009Critical 10.0Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases.isc · bindEPSS29%2 exploitsPublished Apr 8, 1998
- CVE-2026-111058Critical 9.8Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python.Published Oct 19, 2026
- CVE-2026-111057Critical 10.0From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals.Published Oct 19, 2026
- CVE-2025-58443Critical 9.9Versions 1.5.10.1673 and below contain an authentication bypass vulnerability.fogproject · fogprojectEPSS21%1 exploitPublished Sep 6, 2025
- CVE-2025-34036Critical 10.0An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82.tvt · td-2004ts-cl-c firmwareEPSS31%1 exploitPublished Jun 23, 2025
- CVE-2025-20282Critical 10.0A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root.cisco · identity services engineEPSS39%·Published Jun 26, 2025
- CVE-2024-57045Critical 9.8A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication.dlink · dir-859 a3 firmwareEPSS32%1 exploitPublished Feb 18, 2025
- CVE-2024-39914Critical 9.8Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php.fogproject · fogprojectEPSS23%1 exploitPublished Jul 12, 2024
- CVE-2024-27747Critical 9.8File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component.mayurik · petrol pump managementEPSS24%2 exploitsPublished Mar 1, 2024
- CVE-2023-6579Critical 9.8A vulnerability, which was classified as critical, has been found in osCommerce 4.oscommerce · oscommerceEPSS24%1 exploitPublished Dec 7, 2023
- CVE-2023-4873Critical 9.8A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906.byzoro · smart s45f firmwareEPSS22%1 exploitPublished Sep 10, 2023
- CVE-2023-44974Critical 9.8An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.emlog · emlogEPSS20%1 exploitPublished Oct 3, 2023
- CVE-2023-4474Critical 9.8The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL…zyxel · nas326 firmwareEPSS30%·Published Dec 1, 2023
- CVE-2023-34747Critical 9.8File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.ujcms · ujcmsEPSS20%1 exploitPublished Jun 14, 2023
- CVE-2023-34600Critical 9.8Adiscon LogAnalyzer v4.1.13 and before is vulnerable to SQL Injection.adiscon · loganalyzerEPSS24%1 exploitPublished Jun 20, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2003-0899 | Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '' characters, which trigger the overflow when the characters are expanded to "<" and… acme · thttpd | Critical 9.8 | 22% | 2 exploits | |
| CVE-2001-0144 | CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow. ssh · ssh | Critical 10.0 | 32% | 2 exploits | |
| CVE-2026-76268 | Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise splunk · splunk | Critical 9.8 | 1.6% | 1 exploit | |
| CVE-2024-38200 | Microsoft Office Spoofing Vulnerability microsoft · office | Critical 9.1 | 20% | 1 exploit | |
| CVE-2023-33404 | An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code. blogengine · blogengine.net | Critical 9.8 | 26% | 1 exploit | |
| CVE-2023-31465 | By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. fsmlabs · timekeeper | Critical 9.8 | 46% | 1 exploit | |
| CVE-2023-2648 | It has been classified as critical. weaver · e-office | Critical 9.8 | 28% | 1 exploit | |
| CVE-2022-38621 | Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page. doufox · doufox | Critical 9.8 | 25% | 1 exploit | |
| CVE-2022-37159 | Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload. claroline · claroline | Critical 9.8 | 27% | 1 exploit | |
| CVE-2022-26265 | Remote Code Execution in Contao Managed Edition contao · contao | Critical 9.8 | 30% | 1 exploit | |
| CVE-2020-21224 | A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. inspur · clusterengine | Critical 9.8 | 39% | 1 exploit | |
| CVE-2020-11819 | In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution. rukovoditel · rukovoditel | Critical 9.8 | 27% | 2 exploits | |
| CVE-2019-12988 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6). citrix · netscaler sd-wan | Critical 9.8 | 43% | · | |
| CVE-2019-12987 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6). citrix · netscaler sd-wan | Critical 9.8 | 43% | · | |
| CVE-2016-1606 | Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code via (1) the NetworkName property value to ObjectXSNAConfig.ObjectXSNAConfig in iconfig.dll, (2) the CPName property value to… microfocus · rumba | Critical 9.8 | 46% | 1 exploit | |
| CVE-2015-2432 | ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a… microsoft · windows 7 | Critical 9.3 | 30% | 1 exploit | |
| CVE-2014-7235 | htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as… freepbx · freepbx | Critical 10.0 | 43% | 1 exploit | |
| CVE-2014-1785 | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,… microsoft · internet explorer | Critical 9.3 | 30% | 2 exploits | |
| CVE-2013-1309 | Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than… microsoft · internet explorer | Critical 9.3 | 39% | 1 exploit | |
| CVE-2011-1248 | WINS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, R2, and R2 SP1 does not properly handle socket send exceptions, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets, related to… microsoft · windows server 2003 | Critical 9.3 | 48% | 1 exploit | |
| CVE-2010-2330 | Stack-based buffer overflow in iSharer File Sharing Wizard 1.5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Content-Length header. upredsun · isharer file sharing wizard | Critical 9.3 | 28% | 1 exploit | |
| CVE-2010-1938 | Off-by-one error in the opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a… nrl · opie | Critical 9.3 | 22% | 1 exploit | |
| CVE-2010-1248 | Buffer overflow in Microsoft Office Excel 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via an Excel file with a malformed HFPicture (0x866) record, aka "Excel HFPicture Memory Corruption Vulnerability." microsoft · excel | Critical 9.3 | 27% | 2 exploits | |
| CVE-2010-0028 | Integer overflow in Microsoft Paint in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted JPEG (.JPG) file, aka "MS Paint Integer Overflow Vulnerability." microsoft · windows 2000 | Critical 9.3 | 48% | 1 exploit | |
| CVE-2009-3244 | Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe Shockwave Player 11.5.1.601 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long PlayerVersion property value. adobe · shockwave player | Critical 9.3 | 20% | 2 exploits | |
| CVE-2009-2754 | Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC Legato NetWorker, allows… emc · legato networker | Critical 10.0 | 40% | 1 exploit | |
| CVE-2009-2514 | win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not correctly parse font code during construction of a directory-entry table, which allows remote attackers to execute arbitrary code via a crafted Embedded OpenType (EOT) font, aka… microsoft · windows 2000 | Critical 9.3 | 47% | 1 exploit | |
| CVE-2009-0520 | flash-plugin: Buffer overflow (arbitrary code execution) via crafted SWF file. adobe · flash player | Critical 9.3 | 28% | 1 exploit | |
| CVE-2006-0287 | Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# OHS02. oracle · application server | Critical 10.0 | 29% | 1 exploit | |
| CVE-2004-0990 | Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the… gd graphics library · gdlib | Critical 10.0 | 28% | 1 exploit | |
| CVE-2004-0600 | Buffer overflow in the Samba Web Administration Tool (SWAT) in Samba 3.0.2 to 3.0.4 allows remote attackers to execute arbitrary code via an invalid base-64 character during HTTP basic authentication. samba · samba | Critical 10.0 | 29% | 1 exploit | |
| CVE-2003-1026 | Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by… microsoft · internet explorer | Critical 9.3 | 39% | 1 exploit | |
| CVE-2003-0209 | Integer overflow in the TCP stream reassembly module (stream4) for Snort 2.0 and earlier allows remote attackers to execute arbitrary code via large sequence numbers in packets, which enable a heap-based buffer overflow. sourcefire · snort | Critical 10.0 | 39% | 1 exploit | |
| CVE-2002-0721 | Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and possibly remote attackers, to run stored procedures with administrator privileges via (1)… microsoft · sql server | Critical 10.0 | 46% | 1 exploit | |
| CVE-2000-0854 | When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL's such as riched20.dll and msi.dll, which could allow an attacker to execute arbitrary commands by inserting a Trojan Horse DLL into the same directory as the document. microsoft · office | Critical 10.0 | 37% | 1 exploit | |
| CVE-1999-0009 | Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases. isc · bind | Critical 10.0 | 29% | 2 exploits | |
| CVE-2026-111058 | Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. | Critical 9.8 | · | 1 exploit | |
| CVE-2026-111057 | From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. | Critical 10.0 | · | 1 exploit | |
| CVE-2025-58443 | Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. fogproject · fogproject | Critical 9.9 | 21% | 1 exploit | |
| CVE-2025-34036 | An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. tvt · td-2004ts-cl-c firmware | Critical 10.0 | 31% | 1 exploit | |
| CVE-2025-20282 | A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. cisco · identity services engine | Critical 10.0 | 39% | · | |
| CVE-2024-57045 | A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. dlink · dir-859 a3 firmware | Critical 9.8 | 32% | 1 exploit | |
| CVE-2024-39914 | Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. fogproject · fogproject | Critical 9.8 | 23% | 1 exploit | |
| CVE-2024-27747 | File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component. mayurik · petrol pump management | Critical 9.8 | 24% | 2 exploits | |
| CVE-2023-6579 | A vulnerability, which was classified as critical, has been found in osCommerce 4. oscommerce · oscommerce | Critical 9.8 | 24% | 1 exploit | |
| CVE-2023-4873 | A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906. byzoro · smart s45f firmware | Critical 9.8 | 22% | 1 exploit | |
| CVE-2023-44974 | An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file. emlog · emlog | Critical 9.8 | 20% | 1 exploit | |
| CVE-2023-4474 | The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL… zyxel · nas326 firmware | Critical 9.8 | 30% | · | |
| CVE-2023-34747 | File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload. ujcms · ujcms | Critical 9.8 | 20% | 1 exploit | |
| CVE-2023-34600 | Adiscon LogAnalyzer v4.1.13 and before is vulnerable to SQL Injection. adiscon · loganalyzer | Critical 9.8 | 24% | 1 exploit |
Showing 401–450 of 755
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.