CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-34102Adobe Commerce & Magento - CosmicSting | Adobe · Adobe Commerce | Exploited | 9.8 | 100% | 2024-06-13 |
| CVE-2017-10271Oracle WebLogic Server - Remote Command Execution | Oracle Corporation · WebLogic Server | Exploited | 7.5 | 100% | 2017-10-19 |
| CVE-2025-3248Langflow AI - Unauthenticated Remote Code Execution | langflow-ai · langflow | Exploited | 9.8 | 100% | 2025-04-07 |
| CVE-2024-13159Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcardRecursive | Ivanti · Endpoint Manager | Exploited | 9.8 | 100% | 2025-01-14 |
| CVE-2020-8515DrayTek - Remote Code Execution | DrayTek · Multiple Vigor Routers | Exploited | 9.8 | 100% | 2020-02-01 |
| CVE-2023-46604Apache ActiveMQ - Remote Code Execution | Apache Software Foundation · Apache ActiveMQ | Exploited | 10.0 | 100% | 2023-10-27 |
| CVE-2021-41773Apache 2.4.49 - Path Traversal and Remote Code Execution | Apache Software Foundation · Apache HTTP Server | Exploited | 7.5 | 100% | 2021-10-05 |
| CVE-2020-3452Cisco Adaptive Security Appliance (ASA)/Firepower Threat Defense (FTD) - Local File Inclusion | Cisco · Cisco Adaptive Security Appliance (ASA) Software | Exploited | 7.5 | 100% | 2020-07-22 |
| CVE-2024-27199TeamCity < 2023.11.4 - Authentication Bypass | JetBrains · TeamCity | Exploited | 7.3 | 100% | 2024-03-04 |
| CVE-2023-29300Adobe ColdFusion - Pre-Auth Remote Code Execution | Adobe · ColdFusion | Exploited | 9.8 | 100% | 2023-07-12 |
| CVE-2018-7600Drupal - Remote Code Execution | Drupal · Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 | Exploited | 9.8 | 100% | 2018-03-29 |
| CVE-2021-34523Microsoft Exchange Server Elevation of Privilege Vulnerability | Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 | Exploited | 9.0 | 100% | 2021-07-14 |
| CVE-2021-33044Dahua IPC/VTH/VTO - Authentication Bypass | Dahua · Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices | Exploited | 9.8 | 100% | 2021-09-15 |
| CVE-2020-9054Zyxel NAS Firmware 5.21- Remote Code Execution | ZyXEL · NAS326 | Exploited | 9.8 | 100% | 2020-03-04 |
| CVE-2024-4577PHP CGI - Argument Injection | PHP Group · PHP | Exploited | 9.8 | 100% | 2024-06-09 |
| CVE-2023-42793JetBrains TeamCity < 2023.05.4 - Remote Code Execution | JetBrains · TeamCity | Exploited | 9.8 | 100% | 2023-09-19 |
| CVE-2019-9670Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection | Synacor · Zimbra Collaboration Suite (ZCS) | Exploited | 9.8 | 100% | 2019-05-29 |
| CVE-2023-46805Ivanti ICS - Authentication Bypass | Ivanti · ICS | Exploited | 8.2 | 100% | 2024-01-12 |
| CVE-2023-29357Microsoft SharePoint - Authentication Bypass | Microsoft · Microsoft SharePoint Server 2019 | Exploited | 9.8 | 100% | 2023-06-13 |
| CVE-2023-22527Atlassian Confluence - Remote Code Execution | Atlassian · Confluence Data Center | Exploited | 10.0 | 100% | 2024-01-16 |
| CVE-2022-40684Fortinet - Authentication Bypass | Fortinet · Fortinet FortiOS, FortiProxy, FortiSwitchManager | Exploited | 9.8 | 100% | 2022-10-18 |
| CVE-2024-45195Apache OFBiz - Remote Code Execution | Apache Software Foundation · Apache OFBiz | Exploited | 9.8 | 100% | 2024-09-04 |
| CVE-2024-1709ConnectWise ScreenConnect 23.9.7 - Authentication Bypass | ConnectWise · ScreenConnect | Exploited | 10.0 | 100% | 2024-02-21 |
| CVE-2021-20090Buffalo WSR-2533DHPL2 - Path Traversal | Arcadyan · Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3 | Exploited | 9.8 | 100% | 2021-04-29 |
| CVE-2025-22457A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allow… | Ivanti · Connect Secure | Exploited | 9.0 | 100% | 2025-04-03 |
| CVE-2025-0282Ivanti Connect Secure - Stack-based Buffer Overflow | Ivanti · Connect Secure | Exploited | 9.0 | 100% | 2025-01-08 |
| CVE-2021-22204Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image | ExifTool · ExifTool | Exploited | 6.8 | 100% | 2021-04-23 |
| CVE-2025-59287Windows Server Update Service - Insecure Deserialization | Microsoft · Windows Server 2012 | Exploited | 9.8 | 100% | 2025-10-14 |
| CVE-2023-4863Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML pa… | Google · Chrome | Exploited | 8.8 | 100% | 2023-09-12 |
| CVE-2024-24919Check Point Quantum Gateway - Information Disclosure | checkpoint · Check Point Quantum Gateway, Spark Gateway and CloudGuard Network | Exploited | 8.6 | 100% | 2024-05-28 |
| CVE-2021-45046Apache Log4j2 - Remote Code Injection | Apache Software Foundation · Apache Log4j | Exploited | 9.0 | 100% | 2021-12-14 |
| CVE-2019-2725Oracle WebLogic Server - Remote Command Execution | Oracle Corporation · Tape Library ACSLS | Exploited | 7.5 | 100% | 2019-04-26 |
| CVE-2024-4879ServiceNow UI Macros - Template Injection | ServiceNow · Now Platform | Exploited | 9.8 | 100% | 2024-07-10 |
| CVE-2012-0158The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 G… | Microsoft · MSCOMCTL.OCX | Exploited | 8.8 | 100% | 2012-04-10 |
| CVE-2025-24893XWiki Platform - Remote Code Execution | xwiki · xwiki-platform | Exploited | 9.8 | 100% | 2025-02-20 |
| CVE-2014-8361The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023. | Realtek · SDK | Exploited | 9.8 | 100% | 2015-05-01 |
| CVE-2022-41082Microsoft Exchange Server Remote Code Execution Vulnerability | Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 | Exploited | 8.0 | 100% | 2022-10-03 |
| CVE-2025-31161CrushFTP - Authentication Bypass | CrushFTP · CrushFTP | Exploited | 9.8 | 100% | 2025-04-03 |
| CVE-2020-25506D-Link DNS-320 - Unauthenticated Remote Code Execution | D-Link · DNS-320 Device | Exploited | 9.8 | 100% | 2021-02-02 |
| CVE-2017-12617Apache Tomcat - Remote Code Execution | Apache Software Foundation · Apache Tomcat | Exploited | 8.1 | 100% | 2017-10-03 |
| CVE-2022-47986IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution | IBM · Aspera Faspex | Exploited | 9.8 | 100% | 2023-02-17 |
| CVE-2021-42013Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution | Apache Software Foundation · Apache HTTP Server | Exploited | 9.8 | 100% | 2021-10-07 |
| CVE-2021-3156Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line ar… | Sudo · Sudo | Exploited | 7.8 | 100% | 2021-01-26 |
| CVE-2019-10149A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command exe… | exim · exim | Exploited | 9.0 | 100% | 2019-06-05 |
| CVE-2018-2628Oracle WebLogic Server Deserialization - Remote Code Execution | Oracle Corporation · WebLogic Server | Exploited | 9.8 | 100% | 2018-04-19 |
| CVE-2024-38475Sonicwall - Pre-Authentication Arbitrary File Read | Apache Software Foundation · Apache HTTP Server | Exploited | 9.1 | 100% | 2024-07-01 |
| CVE-2022-41040Microsoft Exchange Server Elevation of Privilege Vulnerability | Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 | Exploited | 8.8 | 100% | 2022-10-03 |
| CVE-2020-0688A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption… | Microsoft · Microsoft Exchange Server 2013 | Exploited | 8.8 | 100% | 2020-02-11 |
| CVE-2022-1388F5 BIG-IP iControl - REST Auth Bypass RCE | F5 · BIG-IP | Exploited | 9.8 | 100% | 2022-05-05 |
| CVE-2023-38035Ivanti Sentry - Authentication Bypass | Ivanti · MobileIron Sentry | Exploited | 9.8 | 100% | 2023-08-21 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.