CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-0796Microsoft SMBv3 - Remote Code Execution | Microsoft · Windows 10 Version 1903 for 32-bit Systems | Exploited | 10.0 | 100% | 2020-03-12 |
| CVE-2023-23752Joomla! Webservice - Password Disclosure | Joomla! Project · Joomla! CMS | Exploited | 5.3 | 100% | 2023-02-16 |
| CVE-2023-38205Adobe ColdFusion - Access Control Bypass | Adobe · ColdFusion | Exploited | 7.5 | 100% | 2023-09-14 |
| CVE-2016-6277NETGEAR Routers - Remote Code Execution | NETGEAR · Multiple Routers | Exploited | 8.8 | 100% | 2016-12-14 |
| CVE-2022-1040Sophos Firewall <=18.5 MR3 - Remote Code Execution | Sophos · Sophos Firewall | Exploited | 9.8 | 100% | 2022-03-25 |
| CVE-2026-8037Progress ADC LoadMaster - Command Injection | Progress Software · LoadMaster | Exploited | 9.6 | 100% | 2026-06-04 |
| CVE-2025-32432CraftCMS - Remote Code Execution | craftcms · cms | Exploited | 10.0 | 100% | 2025-04-25 |
| CVE-2021-34527Windows Print Spooler Remote Code Execution Vulnerability | Microsoft · Windows 10 Version 1507 | Exploited | 8.8 | 100% | 2021-07-02 |
| CVE-2023-29298Adobe ColdFusion - Access Control Bypass | Adobe · ColdFusion | Exploited | 7.5 | 100% | 2023-07-12 |
| CVE-2024-0012PAN-OS Management Web Interface - Authentication Bypass | Palo Alto Networks · Cloud NGFW | Exploited | 9.3 | 100% | 2024-11-18 |
| CVE-2008-2992Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript fu… | Adobe · Acrobat and Reader | Exploited | 7.8 | 100% | 2008-11-04 |
| CVE-2019-11043PHP-FPM Path Info Buffer Underflow - Remote Code Execution | PHP · PHP | Exploited | 8.7 | 100% | 2019-10-28 |
| CVE-2021-31207Microsoft Exchange Server Security Feature Bypass Vulnerability | Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 | Exploited | 6.6 | 100% | 2021-05-11 |
| CVE-2023-20198Cisco IOS XE Web UI - Command Injection | Cisco · Cisco IOS XE Software | Exploited | 10.0 | 100% | 2023-10-16 |
| CVE-2020-13927Airflow Experimental <1.10.11 - REST API Auth Bypass | Apache · Apache Airflow | Exploited | 9.8 | 100% | 2020-11-10 |
| CVE-2025-61882Oracle E-Business Suite 12.2.3–12.2.14 – Remote Code Execution | Oracle Corporation · Oracle Concurrent Processing | Exploited | 9.8 | 100% | 2025-10-05 |
| CVE-2022-47966ManageEngine - Remote Command Execution | Zoho · ManageEngine | Exploited | 9.8 | 100% | 2023-01-18 |
| CVE-2023-3519Citrix NetScaler ADC and NetScaler Gateway - Remote Code Execution | Citrix · NetScaler ADC | Exploited | 9.8 | 100% | 2023-07-19 |
| CVE-2010-2861Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI | Adobe · ColdFusion | Exploited | 7.5 | 100% | 2010-08-11 |
| CVE-2026-39987Marimo <= 0.20.4 - Pre-Auth Terminal WebSocket RCE | marimo-team · marimo | Exploited | 9.3 | 100% | 2026-04-09 |
| CVE-2014-6278GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands vi… | GNU · GNU Bash | Exploited | 8.8 | 100% | 2014-09-30 |
| CVE-2020-15505MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution | Ivanti · MobileIron Multiple Products | Exploited | 9.8 | 100% | 2020-07-07 |
| CVE-2019-18935Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys… | Progress · Telerik UI for ASP.NET AJAX | Exploited | 9.8 | 100% | 2019-12-11 |
| CVE-2025-55182React Server Components - Remote Code Execution | Meta · react-server-dom-webpack | Exploited | 10.0 | 100% | 2025-12-03 |
| CVE-2021-22205GitLab CE/EE - Remote Code Execution | GitLab · GitLab | Exploited | 10.0 | 100% | 2021-04-23 |
| CVE-2019-16759vBulletin 5.0.0-5.5.4 - Remote Command Execution | vBulletin · vBulletin | Exploited | 9.8 | 100% | 2019-09-24 |
| CVE-2016-10033WordPress PHPMailer < 5.2.18 - Remote Code Execution | PHP · PHPMailer | Exploited | 9.8 | 100% | 2016-12-30 |
| CVE-2019-15107Webmin <= 1.920 - Unauthenticated Remote Command Execution | Webmin · Webmin | Exploited | 9.8 | 100% | 2019-08-16 |
| CVE-2017-12615Apache Tomcat Servers - Remote Code Execution | Apache Software Foundation · Apache Tomcat | Exploited | 8.1 | 100% | 2017-09-19 |
| CVE-2017-0147The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Go… | Microsoft Corporation · Windows SMB | Exploited | 7.5 | 100% | 2017-03-17 |
| CVE-2017-1000353Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerabil… | Jenkins · Jenkins | Exploited | 9.8 | 100% | 2018-01-29 |
| CVE-2021-22054VMWare Workspace ONE UEM - Server-Side Request Forgery | Omnissa · VMware Workspace ONE UEM console | Exploited | 7.5 | 100% | 2021-12-17 |
| CVE-2026-21589Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read | Atlassian · Bamboo Data Center | Exploited | 9.3 | 100% | 2026-10-05 |
| CVE-2025-48703CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution | centos-webpanel · CentOS Web Panel | Exploited | 9.0 | 100% | 2025-09-19 |
| CVE-2022-22965Spring - Remote Code Execution | VMware · Spring Framework | Exploited | 9.8 | 100% | 2022-04-01 |
| CVE-2024-5217ServiceNow - Incomplete Input Validation | ServiceNow · Now Platform | Exploited | 9.8 | 100% | 2024-07-10 |
| CVE-2024-9465Palo Alto Expedition - SQL Injection | Palo Alto Networks · Expedition | Exploited | 9.2 | 100% | 2024-10-09 |
| CVE-2024-28995SolarWinds Serv-U - Directory Traversal | SolarWinds · SolarWinds Serv-U | Exploited | 8.6 | 100% | 2024-06-06 |
| CVE-2025-49113Roundcube Webmail - Remote Code Execution | Roundcube · Webmail | Exploited | 9.9 | 100% | 2025-06-02 |
| CVE-2021-33045Dahua IPC/VTH/VTO - Authentication Bypass | Dahua · Some Dahua IP Camera, Video Intercom, NVR, XVR devices | Exploited | 9.8 | 100% | 2021-09-15 |
| CVE-2020-16846SaltStack <=3002 - Shell Injection | SaltStack · Salt | Exploited | 9.8 | 100% | 2020-11-06 |
| CVE-2015-5477named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries. | ISC · BIND | Exploited | 7.5 | 100% | 2015-07-29 |
| CVE-2024-4040CrushFTP VFS - Sandbox Escape LFR | CrushFTP · CrushFTP | Exploited | 9.8 | 100% | 2024-04-22 |
| CVE-2018-20062ThinkPHP 5.0.23 - Remote Code Execution | ThinkPHP · noneCms | Exploited | 9.8 | 100% | 2018-12-11 |
| CVE-2017-0199Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Window… | Microsoft Corporation · Office/WordPad | Exploited | 7.8 | 99% | 2017-04-12 |
| CVE-2015-3306ProFTPd - Remote Code Execution | ProFTPD · ProFTPD | Exploited | 10.0 | 99% | 2015-05-18 |
| CVE-2025-31324SAP NetWeaver Visual Composer Metadata Uploader - Deserialization | SAP_SE · SAP NetWeaver (Visual Composer development server) | Exploited | 10.0 | 99% | 2025-04-24 |
| CVE-2024-23692Rejetto HTTP File Server - Template injection | Rejetto · HTTP File Server | Exploited | 9.8 | 99% | 2024-05-31 |
| CVE-2018-0171Cisco Smart Install - Configuration Download | Cisco · Cisco IOS and IOS XE | Exploited | 7.5 | 99% | 2018-03-28 |
| CVE-2022-42475A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier an… | Fortinet · FortiProxy | Exploited | 9.3 | 99% | 2023-01-02 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.