CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-15961Adobe ColdFusion - Unrestricted File Upload Remote Code Execution | Adobe · ColdFusion | Exploited | 9.8 | 100% | 2018-09-25 |
| CVE-2018-10562Dasan GPON Devices - Remote Code Execution | Dasan · Gigabit Passive Optical Network (GPON) Routers | Exploited | 9.8 | 100% | 2018-05-04 |
| CVE-2017-11882Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code… | Microsoft Corporation · Microsoft Office | Exploited | 7.8 | 100% | 2017-11-15 |
| CVE-2022-30525Zyxel Firewall - OS Command Injection | Zyxel · USG FLEX 100(W) firmware | Exploited | 9.8 | 100% | 2022-05-12 |
| CVE-2021-3129Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution | Laravel · Ignition | Exploited | 9.8 | 100% | 2021-01-12 |
| CVE-2025-24813Apache Tomcat Path Equivalence - Remote Code Execution | Apache Software Foundation · Apache Tomcat | Exploited | 10.0 | 100% | 2025-03-10 |
| CVE-2020-10189ManageEngine Desktop Central Java Deserialization | Zoho · ManageEngine | Exploited | 9.8 | 100% | 2020-03-06 |
| CVE-2014-7169GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to wr… | GNU · Bourne-Again Shell (Bash) | Exploited | 9.8 | 100% | 2014-09-25 |
| CVE-2024-29824Ivanti EPM - Remote Code Execution | Ivanti · EPM | Exploited | 9.6 | 100% | 2024-05-31 |
| CVE-2024-27198TeamCity < 2023.11.4 - Authentication Bypass | JetBrains · TeamCity | Exploited | 9.8 | 100% | 2024-03-04 |
| CVE-2022-22963Spring Cloud - Remote Code Execution | VMware Tanzu · Spring Cloud Function | Exploited | 9.8 | 100% | 2022-04-01 |
| CVE-2021-26085Atlassian Confluence Server - Local File Inclusion | Atlassian · Confluence Server | Exploited | 5.3 | 100% | 2021-08-03 |
| CVE-2023-34362MOVEit Transfer - Remote Code Execution | Progress · MOVEit Transfer | Exploited | 9.8 | 100% | 2023-06-02 |
| CVE-2021-39226Grafana Snapshot - Authentication Bypass | grafana · grafana | Exploited | 9.8 | 100% | 2021-10-05 |
| CVE-2021-38647Microsoft Open Management Infrastructure - Remote Code Execution | Microsoft · Azure Automation State Configuration, DSC Extension | Exploited | 9.8 | 100% | 2021-09-15 |
| CVE-2022-24816GeoServer <1.2.2 - Remote Code Execution | geosolutions-it · jai-ext | Exploited | 10.0 | 100% | 2022-04-13 |
| CVE-2025-4427Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution | Ivanti · Endpoint Manager Mobile | Exploited | 5.3 | 100% | 2025-05-13 |
| CVE-2021-1497Cisco HyperFlex HX Data Platform - Remote Command Execution | Cisco · Cisco HyperFlex HX Data Platform | Exploited | 9.8 | 100% | 2021-05-06 |
| CVE-2025-25257Fortinet FortiWeb - SQL Injection | Fortinet · FortiWeb | Exploited | 9.6 | 100% | 2025-07-17 |
| CVE-2025-5777Citrix NetScaler Memory Disclosure - CitrixBleed 2 | NetScaler · ADC | Exploited | 9.3 | 100% | 2025-06-17 |
| CVE-2026-10520Ivanti Sentry - OS Command Injection | ivanti · Sentry | Exploited | 10.0 | 100% | 2026-06-09 |
| CVE-2024-32113Apache OFBiz Directory Traversal - Remote Code Execution | Apache Software Foundation · Apache OFBiz | Exploited | 9.1 | 100% | 2024-05-08 |
| CVE-2019-3396Atlassian Confluence Server - Path Traversal | Atlassian · Confluence Server | Exploited | 9.8 | 100% | 2019-03-25 |
| CVE-2019-0604A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… | Microsoft · Microsoft SharePoint Server | Exploited | 9.8 | 100% | 2019-03-06 |
| CVE-2021-20038SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution | SonicWall · SonicWall SMA100 | Exploited | 9.8 | 100% | 2021-12-08 |
| CVE-2024-45519Zimbra Collaboration Suite < 9.0.0 - Remote Code Execution | Synacor · Zimbra Collaboration Suite (ZCS) | Exploited | 10.0 | 100% | 2024-10-02 |
| CVE-2019-7481SonicWall SRA 4600 VPN - SQL Injection | SonicWall · SMA100 | Exploited | 7.5 | 100% | 2019-12-17 |
| CVE-2015-1427ElasticSearch - Remote Code Execution | Elastic · Elasticsearch | Exploited | 9.8 | 100% | 2015-02-17 |
| CVE-2020-7961Liferay Portal Unauthenticated < 7.2.1 CE GA2 - Remote Code Execution | Liferay · Liferay Portal | Exploited | 9.8 | 100% | 2020-03-20 |
| CVE-2023-21839Oracle WebLogic Server - Unauthorized Access | Oracle Corporation · WebLogic Server | Exploited | 7.5 | 100% | 2023-01-17 |
| CVE-2021-22986F5 iControl REST - Remote Command Execution | F5 · BIG-IP; BIG-IQ | Exploited | 9.8 | 100% | 2021-03-31 |
| CVE-2018-0296Cisco ASA - Local File Inclusion | Cisco · Cisco Adaptive Security Appliance unknown | Exploited | 7.5 | 100% | 2018-06-07 |
| CVE-2014-0497Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote att… | Adobe · Flash Player | Exploited | 8.8 | 100% | 2014-02-05 |
| CVE-2021-27065Microsoft Exchange Server Remote Code Execution Vulnerability | Microsoft · Microsoft Exchange Server 2013 Cumulative Update 21 | Exploited | 7.8 | 100% | 2021-03-02 |
| CVE-2019-1653Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure | Cisco · Cisco Small Business RV Series Router Firmware | Exploited | 7.5 | 100% | 2019-01-24 |
| CVE-2022-35405Zoho ManageEngine - Remote Code Execution | Zoho · ManageEngine | Exploited | 9.8 | 100% | 2022-07-19 |
| CVE-2021-35394RealTek AP Router SDK - Arbitrary Command Injection | Realtek · Jungle Software Development Kit (SDK) | Exploited | 9.8 | 100% | 2021-08-16 |
| CVE-2021-44515Zoho ManageEngine Desktop Central - Remote Code Execution | Zoho · Desktop Central | Exploited | 9.8 | 100% | 2021-12-12 |
| CVE-2021-36260Hikvision IP camera/NVR - Remote Command Execution | Hikvision · Security cameras web server | Exploited | 9.8 | 100% | 2021-09-22 |
| CVE-2021-31166HTTP Protocol Stack Remote Code Execution Vulnerability | Microsoft · Windows 10 Version 2004 | Exploited | 9.8 | 100% | 2021-05-11 |
| CVE-2021-21972VMware vSphere Client (HTML5) - Remote Code Execution | VMware · VMware vCenter Server | Exploited | 9.8 | 100% | 2021-02-24 |
| CVE-2025-49706Microsoft SharePoint Server - Authentication Bypass | Microsoft · Microsoft SharePoint Enterprise Server 2016 | Exploited | 6.5 | 100% | 2025-07-08 |
| CVE-2022-35914GLPI <=10.0.2 - Remote Command Execution | Teclib · GLPI | Exploited | 9.8 | 100% | 2022-09-19 |
| CVE-2022-46169Cacti <=1.2.22 - Remote Command Injection | Cacti · cacti | Exploited | 9.8 | 100% | 2022-12-05 |
| CVE-2021-37415Zoho ManageEngine ServiceDesk Plus - Authentication Bypass | Zoho · ManageEngine ServiceDesk Plus (SDP) | Exploited | 9.8 | 100% | 2021-09-01 |
| CVE-2025-10035GoAnywhere - Authentication Bypass | Fortra · GoAnywhere MFT | Exploited | 10.0 | 100% | 2025-09-18 |
| CVE-2017-7269Windows Server 2003 & IIS 6.0 - Remote Code Execution | Microsoft · Internet Information Services (IIS) | Exploited | 9.8 | 100% | 2017-03-27 |
| CVE-2023-38831RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may in… | RARLAB · WinRAR | Exploited | 7.8 | 100% | 2023-08-23 |
| CVE-2024-36401GeoServer RCE in Evaluating Property Name Expressions | geoserver · geoserver | Exploited | 9.8 | 100% | 2024-07-01 |
| CVE-2015-3113Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attac… | Adobe · Flash Player | Exploited | 7.8 | 100% | 2015-06-23 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.