CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-7494Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a wri… | Samba · samba | Exploited | 9.8 | 99% | 2017-05-30 |
| CVE-2023-36884Windows Search Remote Code Execution Vulnerability | Microsoft · Windows 10 Version 1507 | Exploited | 7.5 | 99% | 2023-07-11 |
| CVE-2024-38856Apache OFBiz - Improper Authorization & Remote Code Execution | Apache Software Foundation · Apache OFBiz | Exploited | 8.1 | 99% | 2024-08-05 |
| CVE-2024-21412Internet Shortcut Files Security Feature Bypass Vulnerability | Microsoft · Windows 10 Version 1809 | Exploited | 8.1 | 99% | 2024-02-13 |
| CVE-2011-0611Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLi… | Adobe · Flash Player | Exploited | 8.8 | 99% | 2011-04-13 |
| CVE-2017-9805Apache Struts2 S2-052 - Remote Code Execution | Apache Software Foundation · Apache Struts | Exploited | 8.1 | 99% | 2017-09-15 |
| CVE-2021-32030ASUS GT-AC2900 - Authentication Bypass | ASUS · Routers | Exploited | 9.8 | 99% | 2021-05-06 |
| CVE-2020-1472Netlogon Elevation of Privilege Vulnerability | Microsoft · Windows Server version 2004 | Exploited | 5.5 | 99% | 2020-08-17 |
| CVE-2026-75650Adobe Commerce/Magento <= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI | Adobe · Adobe Commerce | Exploited | 10.0 | 99% | 2026-09-07 |
| CVE-2017-0148The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Go… | Microsoft Corporation · Windows SMB | Exploited | 8.1 | 99% | 2017-03-17 |
| CVE-2022-0543Redis Sandbox Escape - Remote Code Execution | Debian · redis | Exploited | 10.0 | 99% | 2022-02-18 |
| CVE-2014-6287HTTP File Server <2.3c - Remote Command Execution | Rejetto · HTTP File Server (HFS) | Exploited | 9.8 | 99% | 2014-10-07 |
| CVE-2024-4885Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution | Progress Software Corporation · WhatsUp Gold | Exploited | 9.8 | 99% | 2024-06-25 |
| CVE-2023-28771Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4… | Zyxel · ZyWALL/USG series firmware | Exploited | 9.8 | 99% | 2023-04-25 |
| CVE-2020-1938Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability | Apache · Apache Tomcat | Exploited | 9.8 | 99% | 2020-02-24 |
| CVE-2020-14750Oracle WebLogic Server - Remote Command Execution | Oracle Corporation · WebLogic Server | Exploited | 9.8 | 99% | 2020-11-01 |
| CVE-2023-34048VMware vCenter Server - Out-of-Bounds Write | VMware · VMware vCenter Server | Exploited | 9.8 | 99% | 2023-10-25 |
| CVE-2022-30333RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_k… | RARLAB · UnRAR | Exploited | 9.8 | 99% | 2022-05-09 |
| CVE-2023-22515Atlassian Confluence - Privilege Escalation | Atlassian · Confluence Data Center | Exploited | 10.0 | 99% | 2023-10-04 |
| CVE-2017-0144The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Go… | Microsoft Corporation · Windows SMB | Exploited | 8.8 | 99% | 2017-03-17 |
| CVE-2020-0646A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'. | Microsoft · Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 | Exploited | 9.8 | 99% | 2020-01-14 |
| CVE-2024-27348Apache HugeGraph-Server - Remote Command Execution | Apache Software Foundation · Apache HugeGraph-Server | Exploited | 9.8 | 99% | 2024-04-22 |
| CVE-2022-24086Adobe Commerce (Magento) - Remote Code Execution | Adobe · Magento Commerce | Exploited | 9.8 | 99% | 2022-02-16 |
| CVE-2020-11978Apache Airflow <=1.10.10 - Remote Code Execution | Apache Software Foundation · Apache Airflow | Exploited | 8.8 | 99% | 2020-07-16 |
| CVE-2018-7602Drupal - Remote Code Execution | Drupal · core | Exploited | 8.1 | 99% | 2018-07-19 |
| CVE-2021-44529Ivanti EPM Cloud Services Appliance Code Injection | Ivanti · Ivanti EPM | Exploited | 9.8 | 99% | 2021-12-08 |
| CVE-2020-10199Sonatype Nexus Repository Manager 3 - Remote Code Execution | Sonatype · Nexus Repository | Exploited | 8.8 | 99% | 2020-04-01 |
| CVE-2020-0618Microsoft SQL Server Reporting Services - Remote Code Execution | Microsoft · Microsoft SQL Server | Exploited | 9.8 | 99% | 2020-02-11 |
| CVE-2019-16278nostromo 1.9.6 - Remote Code Execution | Nostromo · nhttpd | Exploited | 9.8 | 99% | 2019-10-14 |
| CVE-2025-68613n8n - Remote Code Execution via Expression Injection | n8n-io · n8n | Exploited | 10.0 | 99% | 2025-12-19 |
| CVE-2026-24061telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. | GNU · Inetutils | Exploited | 9.8 | 99% | 2026-01-21 |
| CVE-2017-3881Cisco IOS 12.2(55)SE11 - Remote Code Execution | Cisco · Cisco IOS and IOS XE Software | Exploited | 9.8 | 99% | 2017-03-17 |
| CVE-2020-7247OpenSMTPD 6.4.0-6.6.1 - Remote Code Execution | OpenBSD · OpenSMTPD | Exploited | 9.8 | 99% | 2020-01-29 |
| CVE-2021-40539Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution | Zoho · ManageEngine | Exploited | 9.8 | 99% | 2021-09-07 |
| CVE-2022-36804Atlassian Bitbucket - Remote Command Injection | Atlassian · Bitbucket Server | Exploited | 8.8 | 99% | 2022-08-25 |
| CVE-2019-3929Barco/AWIND OEM Presentation Platform - Remote Command Injection | Crestron · Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP… | Exploited | 9.8 | 99% | 2019-04-30 |
| CVE-2025-32433Erlang/OTP SSH Vulnerable to Pre-Authentication RCE | erlang · otp | Exploited | 10.0 | 99% | 2025-04-16 |
| CVE-2017-9791Apache Struts2 S2-053 - Remote Code Execution | Apache Software Foundation · Apache Struts | Exploited | 9.8 | 99% | 2017-07-10 |
| CVE-2022-3236Sophos Firewall <= 19.0 MR1 - Remote Code Execution | Sophos · Sophos Firewall | Exploited | 9.8 | 99% | 2022-09-23 |
| CVE-2023-47246SysAid Server - Remote Code Execution | SysAid · SysAid Server | Exploited | 9.8 | 99% | 2023-11-10 |
| CVE-2012-3152Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality… | Oracle · Fusion Middleware | Exploited | 9.1 | 99% | 2012-10-16 |
| CVE-2013-2465Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and Op… | Oracle · Java SE | Exploited | 9.8 | 99% | 2013-06-18 |
| CVE-2008-4250The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbit… | Microsoft · Windows | Exploited | 9.8 | 99% | 2008-10-23 |
| CVE-2026-1281Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection | Ivanti · Endpoint Manager Mobile | Exploited | 9.8 | 99% | 2026-01-29 |
| CVE-2022-27925Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal | Synacor · Zimbra Collaboration Suite (ZCS) | Exploited | 7.2 | 99% | 2022-04-20 |
| CVE-2026-1340Ivanti EPMM < 12.8.0.0 - Remote Code Execution | Ivanti · Endpoint Manager Mobile | Exploited | 9.8 | 99% | 2026-01-29 |
| CVE-2024-29059.NET Framework - Leaking ObjRefs via HTTP .NET Remoting | Microsoft · Microsoft .NET Framework 4.8 | Exploited | 7.5 | 99% | 2024-03-22 |
| CVE-2015-5119Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows… | Adobe · Flash Player | Exploited | 7.8 | 99% | 2015-07-08 |
| CVE-2024-8963Ivanti Cloud Services Appliance - Path Traversal | Ivanti · CSA (Cloud Services Appliance) | Exploited | 9.4 | 99% | 2024-09-19 |
| CVE-2024-50623Cleo Harmony < 5.8.0.21 - Arbitary File Read | Cleo · Multiple Products | Exploited | 9.8 | 99% | 2024-10-27 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.