CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-9841PHPUnit - Remote Code Execution | PHPUnit · PHPUnit | Exploited | 9.8 | 100% | 2017-06-27 |
| CVE-2017-5638Apache Struts 2 - Remote Command Execution | Apache Software Foundation · Apache Struts | Exploited | 9.8 | 100% | 2017-03-11 |
| CVE-2017-7921Hikvision - Authentication Bypass | Hikvision · Hikvision Cameras | Exploited | 9.8 | 100% | 2017-05-06 |
| CVE-2017-10271Oracle WebLogic Server - Remote Command Execution | Oracle Corporation · WebLogic Server | Exploited | 7.5 | 100% | 2017-10-19 |
| CVE-2017-12617Apache Tomcat - Remote Code Execution | Apache Software Foundation · Apache Tomcat | Exploited | 8.1 | 100% | 2017-10-03 |
| CVE-2017-11882Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code… | Microsoft Corporation · Microsoft Office | Exploited | 7.8 | 100% | 2017-11-15 |
| CVE-2017-7269Windows Server 2003 & IIS 6.0 - Remote Code Execution | Microsoft · Internet Information Services (IIS) | Exploited | 9.8 | 100% | 2017-03-27 |
| CVE-2017-12615Apache Tomcat Servers - Remote Code Execution | Apache Software Foundation · Apache Tomcat | Exploited | 8.1 | 100% | 2017-09-19 |
| CVE-2017-0147The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Go… | Microsoft Corporation · Windows SMB | Exploited | 7.5 | 100% | 2017-03-17 |
| CVE-2017-0199Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Window… | Microsoft Corporation · Office/WordPad | Exploited | 7.8 | 99% | 2017-04-12 |
| CVE-2017-7494Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a wri… | Samba · samba | Exploited | 9.8 | 99% | 2017-05-30 |
| CVE-2017-9805Apache Struts2 S2-052 - Remote Code Execution | Apache Software Foundation · Apache Struts | Exploited | 8.1 | 99% | 2017-09-15 |
| CVE-2017-0148The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Go… | Microsoft Corporation · Windows SMB | Exploited | 8.1 | 99% | 2017-03-17 |
| CVE-2017-0144The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Go… | Microsoft Corporation · Windows SMB | Exploited | 8.8 | 99% | 2017-03-17 |
| CVE-2017-3881Cisco IOS 12.2(55)SE11 - Remote Code Execution | Cisco · Cisco IOS and IOS XE Software | Exploited | 9.8 | 99% | 2017-03-17 |
| CVE-2017-9791Apache Struts2 S2-053 - Remote Code Execution | Apache Software Foundation · Apache Struts | Exploited | 9.8 | 99% | 2017-07-10 |
| CVE-2017-15944Palo Alto Network PAN-OS - Remote Code Execution | Palo Alto Networks · PAN-OS | Exploited | 9.8 | 98% | 2017-12-11 |
| CVE-2016-1555NETGEAR WNAP320 Access Point Firmware - Remote Command Injection | NETGEAR · Wireless Access Point (WAP) Devices | Exploited | 9.8 | 98% | 2017-04-21 |
| CVE-2017-17562Embedthis GoAhead <3.6.5 - Remote Code Execution | Embedthis · GoAhead | Exploited | 8.1 | 97% | 2017-12-12 |
| CVE-2017-8291Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps do… | Artifex · Ghostscript | Exploited | 7.8 | 97% | 2017-04-27 |
| CVE-2017-3506Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution | Oracle Corporation · WebLogic Server | Exploited | 7.4 | 96% | 2017-04-24 |
| CVE-2017-12637SAP NetWeaver Application Server Java 7.5 - Local File Inclusion | SAP · NetWeaver | Exploited | 7.5 | 95% | 2017-08-07 |
| CVE-2017-9822DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution | DotNetNuke · DotNetNuke CMS Fixed in 9.1.1 | Exploited | 8.8 | 95% | 2017-07-20 |
| CVE-2017-0143The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Go… | Microsoft Corporation · Windows SMB | Exploited | 8.8 | 93% | 2017-03-17 |
| CVE-2017-5689Intel Active Management - Authentication Bypass | Intel Corporation · Intel Active Mangement Technology, Intel Small Business Technology, Intel Stand… | Exploited | 9.8 | 92% | 2017-05-02 |
| CVE-2017-12149Jboss Application Server - Remote Code Execution | Red Hat, Inc. · jbossas | Exploited | 9.8 | 91% | 2017-10-04 |
| CVE-2017-3066Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeD… | Adobe · Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11… | Exploited | 9.8 | 91% | 2017-04-27 |
| CVE-2016-8735Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListene… | Apache Software Foundation · Apache Tomcat | Exploited | 9.8 | 90% | 2017-04-06 |
| CVE-2017-8464Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607,… | Microsoft Corporation · Windows Shell | Exploited | 8.8 | 90% | 2017-06-15 |
| CVE-2017-8570Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CV… | Microsoft Corporation · Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1… | Exploited | 7.8 | 90% | 2017-07-11 |
| CVE-2017-0146The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Go… | Microsoft Corporation · Windows SMB | Exploited | 8.8 | 90% | 2017-03-17 |
| CVE-2017-0145The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Go… | Microsoft Corporation · Windows SMB | Exploited | 8.8 | 90% | 2017-03-17 |
| CVE-2017-5521NETGEAR Routers - Authentication Bypass | NETGEAR · Multiple Devices | Exploited | 8.1 | 89% | 2017-01-17 |
| CVE-2017-8759Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework… | Microsoft Corporation · Microsoft .NET Framework | Exploited | 7.8 | 89% | 2017-09-13 |
| CVE-2017-0213Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511… | Microsoft Corporation · Windows COM | Exploited | 7.3 | 84% | 2017-05-12 |
| CVE-2017-11317Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbit… | Telerik · User Interface (UI) for ASP.NET AJAX | Exploited | 9.8 | 84% | 2017-08-23 |
| CVE-2016-10174The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited b… | NETGEAR · WNR2000v5 Router | Exploited | 9.8 | 83% | 2017-01-30 |
| CVE-2015-1187The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp. | D-Link and TRENDnet · Multiple Devices | Exploited | 9.8 | 83% | 2017-09-21 |
| CVE-2017-11826Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 20… | Microsoft Corporation · Microsoft Office | Exploited | 7.8 | 82% | 2017-10-13 |
| CVE-2017-0262Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office R… | Microsoft Corporation · Microsoft Office | Exploited | 7.8 | 81% | 2017-05-12 |
| CVE-2017-0037Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in msh… | Microsoft Corporation · Internet Browser | Exploited | 8.1 | 80% | 2017-02-26 |
| CVE-2017-0261Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office R… | Microsoft Corporation · Microsoft Office | Exploited | 7.8 | 78% | 2017-05-12 |
| CVE-2017-11357Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or… | Telerik · User Interface (UI) for ASP.NET AJAX | Exploited | 9.8 | 78% | 2017-08-23 |
| CVE-2017-9248Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryption… | Progress · ASP.NET AJAX and Sitefinity | Exploited | 9.8 | 75% | 2017-07-03 |
| CVE-2017-8543Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1,… | Microsoft Corporation · Microsoft Windows | Exploited | 9.8 | 74% | 2017-06-15 |
| CVE-2017-6316Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge (the former name… | Citrix · NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server | Exploited | 9.8 | 73% | 2017-07-20 |
| CVE-2017-6334dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_na… | NETGEAR · DGN2200 Devices | Exploited | 8.8 | 73% | 2017-03-06 |
| CVE-2017-8540The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows… | Microsoft Corporation · Malware Protection Engine | Exploited | 7.8 | 72% | 2017-05-26 |
| CVE-2017-6736The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to re… | Cisco · IOS | Exploited | 8.8 | 70% | 2017-07-17 |
| CVE-2017-6077ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr… | NETGEAR · Wireless Router DGN2200 | Exploited | 9.8 | 69% | 2017-02-22 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.