CVERadar

CVEs: Exploit-DB

582 CVEs with a public exploit on Exploit-DB, sorted by threat level then EPSS. Showing 1-120. Use search to combine filters.

CRITICAL 10RansomwareTop #29
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2019-11510

Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

Ivanti · Pulse Connect Secure · EPSS 100.00% · Threat 100
CRITICAL 10RansomwareTop #24
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-44228

Apache Log4j2 Remote Code Execution Vulnerability

Apache · Log4j2 · EPSS 100.00% · Threat 100
CRITICAL 10RansomwareTop #5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-3400

Palo Alto Networks PAN-OS Command Injection Vulnerability

Palo Alto Networks · PAN-OS · EPSS 100.00% · Threat 100
CRITICAL 10Ransomware
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-55182

Meta React Server Components Remote Code Execution Vulnerability

Meta · React Server Components · EPSS 99.80% · Threat 100
CRITICAL 9.8RansomwareTop #26
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2017-5638

Apache Struts Remote Code Execution Vulnerability

Apache · Struts · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #27
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-13379

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

Fortinet · FortiOS · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #28
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2019-0708

Microsoft Remote Desktop Services Remote Code Execution Vulnerability

Microsoft · Remote Desktop Services · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #30
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2019-19781

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #31
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2020-5902

F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

F5 · BIG-IP · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #35
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-26084

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Atlassian · Confluence Server and Data Center · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #37
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-35464

ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

ForgeRock · Access Management (AM) · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #18
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2022-26134

Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

Atlassian · Confluence Server/Data Center · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #16
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2023-27350

PaperCut MF/NG Improper Access Control Vulnerability

PaperCut · MF/NG · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #4
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-23897

Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Jenkins · Jenkins Command Line Interface (CLI) · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #1
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2025-53770

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft · SharePoint · EPSS 100.00% · Threat 99
CRITICAL 9.8RansomwareTop #51
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2025-3248

Langflow Missing Authentication Vulnerability

Langflow · Langflow · EPSS 99.99% · Threat 99
CRITICAL 9.8RansomwareTop #55
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-41773

Apache HTTP Server Path Traversal Vulnerability

Apache · HTTP Server · EPSS 99.99% · Threat 99
CRITICAL 9.8RansomwareTop #58
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-7600

Drupal Core Remote Code Execution Vulnerability

Drupal · Drupal Core · EPSS 99.99% · Threat 99
CRITICAL 9.8RansomwareTop #63
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2023-42793

JetBrains TeamCity Authentication Bypass Vulnerability

JetBrains · TeamCity · EPSS 99.99% · Threat 99
CRITICAL 9.8RansomwareTop #62
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2024-4577

PHP-CGI OS Command Injection Vulnerability

PHP Group · PHP · EPSS 99.99% · Threat 99
CRITICAL 9.8RansomwareTop #68
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2022-40684

Fortinet Multiple Products Authentication Bypass Vulnerability

Fortinet · Multiple Products · EPSS 99.98% · Threat 99
CRITICAL 9.8RansomwareTop #79
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-2725

Oracle WebLogic Server, Injection

Oracle · WebLogic Server · EPSS 99.98% · Threat 99
CRITICAL 9.8RansomwareTop #87
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-31161

CrushFTP Authentication Bypass Vulnerability

CrushFTP · CrushFTP · EPSS 99.97% · Threat 99
CRITICAL 9.8RansomwareTop #88
Exploited in the wild · CISA KEVExploit-DBATT&CK inferred
CVE-2022-47986

IBM Aspera Faspex Code Execution Vulnerability

IBM · Aspera Faspex · EPSS 99.97% · Threat 99
CRITICAL 9.8RansomwareTop #89
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-42013

Apache HTTP Server Path Traversal Vulnerability

Apache · HTTP Server · EPSS 99.96% · Threat 99
CRITICAL 9.8RansomwareTop #96
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2022-1388

F5 BIG-IP Missing Authentication Vulnerability

F5 · BIG-IP · EPSS 99.95% · Threat 99
CRITICAL 9.8RansomwareTop #99
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2018-10562

Dasan GPON Routers Command Injection Vulnerability

Dasan · Gigabit Passive Optical Network (GPON) Routers · EPSS 99.95% · Threat 99
CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2024-27198

JetBrains TeamCity Authentication Bypass Vulnerability

JetBrains · TeamCity · EPSS 99.94% · Threat 99
CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2024-23692

Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Rejetto · HTTP File Server · EPSS 99.48% · Threat 99
CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-51378

CyberPanel Incorrect Default Permissions Vulnerability

CyberPersons · CyberPanel · EPSS 94.75% · Threat 97
CRITICAL 9.3RansomwareTop #82
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-5777

Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

Citrix · NetScaler ADC and Gateway · EPSS 99.97% · Threat 96
CRITICAL 9.3Ransomware
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-41940

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

WebPros · cPanel & WHM and WP2 (WordPress Squared) · EPSS 98.53% · Threat 96
CRITICAL 9.1RansomwareTop #44
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-26855

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · EPSS 100.00% · Threat 95
CRITICAL 9RansomwareTop #72
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-0282

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Ivanti · Connect Secure, Policy Secure, and ZTA Gateways · EPSS 99.98% · Threat 95
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-32432

Craft CMS Code Injection Vulnerability

Craft CMS · Craft CMS · EPSS 99.79% · Threat 95
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2015-3306

ProFTPD Improper Access Control Vulnerability

ProFTPD · ProFTPD · EPSS 99.50% · Threat 95
CRITICAL 9.8Top #23
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2014-6271

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

GNU · Bourne-Again Shell (Bash) · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #22
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2015-1635

Microsoft HTTP.sys Remote Code Execution Vulnerability

Microsoft · HTTP.sys · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #21
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2017-9841

PHPUnit Command Injection Vulnerability

PHPUnit · PHPUnit · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #9
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2023-1671

Sophos Web Appliance Command Injection Vulnerability

Sophos · Web Appliance · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #40
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2012-1823

PHP-CGI Query String Parameter Vulnerability

PHP · PHP · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #41
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2013-2251

Apache Struts Improper Input Validation Vulnerability

Apache · Struts · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #42
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2020-14882

Oracle WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #47
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2022-44877

CWP Control Web Panel OS Command Injection Vulnerability

CWP · Control Web Panel · EPSS 100.00% · Threat 94
CRITICAL 9.8Top #53
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2020-8515

Multiple DrayTek Vigor Routers Web Management Page Vulnerability

DrayTek · Multiple Vigor Routers · EPSS 99.99% · Threat 94
CRITICAL 9.8Top #65
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-9670

Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 99.99% · Threat 94
HIGH 8.8RansomwareTop #81
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2012-0158

Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

Microsoft · MSCOMCTL.OCX · EPSS 99.98% · Threat 94
CRITICAL 9.8Top #83
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2014-8361

Realtek SDK Improper Input Validation Vulnerability

Realtek · SDK · EPSS 99.97% · Threat 94
HIGH 8.8RansomwareTop #91
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2020-0688

Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

Microsoft · Exchange Server · EPSS 99.96% · Threat 94
CRITICAL 9.8Top #92
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-10149

Exim Mail Transfer Agent (MTA) Improper Input Validation

Exim · Mail Transfer Agent (MTA) · EPSS 99.96% · Threat 94
CRITICAL 9.8Top #93
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2018-2628

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server · EPSS 99.96% · Threat 94
CRITICAL 9.8Top #98
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-15961

Adobe ColdFusion Unrestricted File Upload Vulnerability

Adobe · ColdFusion · EPSS 99.95% · Threat 94
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-24813

Apache Tomcat Path Equivalence Vulnerability

Apache · Tomcat · EPSS 99.93% · Threat 94
CRITICAL 9.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-25257

Fortinet FortiWeb SQL Injection Vulnerability

Fortinet · FortiWeb · EPSS 99.92% · Threat 94
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-24893

XWiki Platform Eval Injection Vulnerability

XWiki · Platform · EPSS 99.86% · Threat 94
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2016-10033

PHPMailer Command Injection Vulnerability

PHP · PHPMailer · EPSS 99.71% · Threat 94
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-1000353

Jenkins Remote Code Execution Vulnerability

Jenkins · Jenkins · EPSS 99.68% · Threat 94
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-27348

Apache HugeGraph-Server Improper Access Control Vulnerability

Apache · HugeGraph-Server · EPSS 99.21% · Threat 94
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-16278

Nostromo nhttpd Directory Traversal Vulnerability

Nostromo · nhttpd · EPSS 99.03% · Threat 94
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-24061

GNU InetUtils Argument Injection Vulnerability

GNU · InetUtils · EPSS 98.98% · Threat 94
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2008-4250

Microsoft Windows Buffer Overflow Vulnerability

Microsoft · Windows · EPSS 98.75% · Threat 94
CRITICAL 10
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2022-22536

SAP Multiple Products HTTP Request Smuggling Vulnerability

SAP · Multiple Products · EPSS 97.95% · Threat 94
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-57819

Sangoma FreePBX Authentication Bypass Vulnerability

Sangoma · FreePBX · EPSS 95.02% · Threat 94
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2024-4358

Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

Progress · Telerik Report Server · EPSS 97.48% · Threat 93
CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2025-47812

Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

Wing FTP Server · Wing FTP Server · EPSS 93.88% · Threat 93
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2018-14933

NUUO NVRmini Devices OS Command Injection Vulnerability

NUUO · NVRmini Devices · EPSS 94.76% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBCTID-mapped
CVE-2022-43939

Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

Hitachi Vantara · Pentaho Business Analytics (BA) Server · EPSS 92.27% · Threat 92
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-64446

Fortinet FortiWeb Path Traversal Vulnerability

Fortinet · FortiWeb · EPSS 91.97% · Threat 92
CRITICAL 9.3Top #80
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2024-4879

ServiceNow Improper Input Validation Vulnerability

ServiceNow · Utah, Vancouver, and Washington DC Now Platform · EPSS 99.98% · Threat 91
CRITICAL 9.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2017-3066

Adobe ColdFusion Deserialization Vulnerability

Adobe · ColdFusion · EPSS 90.60% · Threat 91
HIGH 8.8Top #15
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2023-1389

TP-Link Archer AX-21 Command Injection Vulnerability

TP-Link · Archer AX21 · EPSS 100.00% · Threat 89
HIGH 7.8RansomwareTop #100
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2017-11882

Microsoft Office Memory Corruption Vulnerability

Microsoft · Office · EPSS 99.94% · Threat 89
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2022-42889

CVE-2022-42889: Apache Commons Text performs variable interpolation, allowing properties to be dynamically…

apache · commons text · EPSS 99.93% · Threat 89
CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2022-37061

CVE-2022-37061: All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to …

flir · flir ax8 firmware · EPSS 99.61% · Threat 89
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2014-6278

GNU Bash OS Command Injection Vulnerability

GNU · GNU Bash · EPSS 99.59% · Threat 89
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-49113

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube · Webmail · EPSS 98.97% · Threat 89
CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2024-5910

Palo Alto Networks Expedition Missing Authentication Vulnerability

Palo Alto Networks · Expedition · EPSS 91.68% · Threat 89
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2010-3765

Mozilla Multiple Products Remote Code Execution Vulnerability

Mozilla · Multiple Products · EPSS 83.16% · Threat 89
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-6553

CVE-2023-6553: The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all ve…

backupbliss · backup migration · EPSS 97.85% · Threat 88
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-0204

CVE-2024-0204: Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized use…

fortra · goanywhere managed file transfer · EPSS 95.09% · Threat 88
HIGH 7.5RansomwareTop #49
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-10271

Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server · EPSS 99.99% · Threat 87
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-30258

CVE-2023-30258: Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote …

magnussolution · magnusbilling · EPSS 94.25% · Threat 87
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-8856

CVE-2024-8856: The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary …

revmakx · backup and staging by wp time capsule · EPSS 94.14% · Threat 87
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2010-0249

Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft · Internet Explorer · EPSS 91.94% · Threat 87
HIGH 7.2RansomwareTop #17
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2023-0669

Fortra GoAnywhere MFT Remote Code Execution Vulnerability

Fortra · GoAnywhere MFT · EPSS 100.00% · Threat 86
CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-1974

CVE-2025-1974: A security issue was discovered in Kubernetes where under certain conditions, an unauthent…

Unknown · · EPSS 99.38% · Threat 86
CRITICAL 10
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-25600

CVE-2024-25600: Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited …

Unknown · · EPSS 88.23% · Threat 86
CRITICAL 10
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-59528

CVE-2025-59528: Flowise is a drag & drop user interface to build a customized large language model flow. I…

flowiseai · flowise · EPSS 86.22% · Threat 86
HIGH 8.1Top #50
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2018-11776

Apache Struts Remote Code Execution Vulnerability

Apache · Struts · EPSS 99.99% · Threat 85
HIGH 8.1Top #85
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-12617

Apache Tomcat Remote Code Execution Vulnerability

Apache · Tomcat · EPSS 99.97% · Threat 85
CRITICAL 9.1
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-29927

CVE-2025-29927: Next.js is a React framework for building full-stack web applications. Starting in version…

vercel · next.js · EPSS 99.22% · Threat 85
HIGH 8.1
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2010-3962

Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability

Microsoft · Internet Explorer · EPSS 96.83% · Threat 85
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2013-3893

Microsoft Internet Explorer Resource Management Errors Vulnerability

Microsoft · Internet Explorer · EPSS 87.64% · Threat 85
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2009-3459

Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

Adobe · Acrobat and Reader · EPSS 86.65% · Threat 85
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-5360

CVE-2023-5360: The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly …

royal-elementor-addons · royal elementor addons · EPSS 86.35% · Threat 85
HIGH 7.8Top #73
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2021-22204

ExifTool Remote Code Execution Vulnerability

Perl · Exiftool · EPSS 99.98% · Threat 84
HIGH 7.8Top #90
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2021-3156

Sudo Heap-Based Buffer Overflow Vulnerability

Sudo · Sudo · EPSS 99.96% · Threat 84
HIGH 8.1
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2016-3081

Apache Struts Command Injection Vulnerability

Apache · Struts · EPSS 96.05% · Threat 84
CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2025-47916

CVE-2025-47916: Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template st…

invisioncommunity · invisioncommunity · EPSS 84.32% · Threat 84
HIGH 8.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2025-33073

Microsoft Windows SMB Client Improper Access Control Vulnerability

Microsoft · Windows · EPSS 82.70% · Threat 84
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-44000

CVE-2024-44000: Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cac…

litespeedtech · litespeed cache · EPSS 82.34% · Threat 84
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2010-0806

Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft · Internet Explorer · EPSS 82.24% · Threat 84
CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-10924

CVE-2024-10924: The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulner…

really-simple-plugins · really simple security · EPSS 82.22% · Threat 84
CRITICAL 10
Metasploit moduleExploit-DBATT&CK inferred
CVE-2024-20419

CVE-2024-20419: A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM …

cisco · smart software manager on-prem · EPSS 80.64% · Threat 84
HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2017-8291

Artifex Ghostscript Type Confusion Vulnerability

Artifex · Ghostscript · EPSS 96.97% · Threat 83
CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2018-1207

CVE-2018-1207: Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability …

dell · emc idrac7 · EPSS 90.09% · Threat 83
CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2024-2054

CVE-2024-2054: The Artica-Proxy administrative web application will deserialize arbitrary PHP objects sup…

articatech · artica proxy · EPSS 81.26% · Threat 83
CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-0770

Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Langflow · Langflow · EPSS 62.56% · Threat 83
HIGH 7.5Top #19
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2014-0160

OpenSSL Information Disclosure Vulnerability

OpenSSL · OpenSSL · EPSS 100.00% · Threat 82
HIGH 7.5Top #12
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2023-44487

HTTP/2 Rapid Reset Attack Vulnerability

IETF · HTTP/2 · EPSS 100.00% · Threat 82
HIGH 7.5Top #54
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2020-3452

Cisco ASA and FTD Read-Only Path Traversal Vulnerability

Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) · EPSS 99.99% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCCTID-mapped
CVE-2025-4427

Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) · EPSS 99.93% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-28995

SolarWinds Serv-U Path Traversal Vulnerability

SolarWinds · Serv-U · EPSS 99.61% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2015-5477

ISC BIND Data Processing Errors Vulnerability

ISC · BIND · EPSS 99.41% · Threat 82
HIGH 7.4
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-20767

Adobe ColdFusion Improper Access Control Vulnerability

Adobe · ColdFusion · EPSS 98.51% · Threat 82
HIGH 7.5
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2019-5418

Rails Ruby on Rails Path Traversal Vulnerability

Rails · Ruby on Rails · EPSS 98.51% · Threat 82
CRITICAL 9.2
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-10914

CVE-2024-10914: A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 2024102…

dlink · dns-320 firmware · EPSS 96.28% · Threat 82
HIGH 8.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-43284

CVE-2026-43284: In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-p…

linux · linux kernel · EPSS 94.19% · Threat 82
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2019-15949

Nagios XI Remote Code Execution Vulnerability

Nagios · Nagios XI · EPSS 77.04% · Threat 82
HIGH 8.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBATT&CK inferred
CVE-2008-0015

Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability

Microsoft · Windows · EPSS 76.58% · Threat 82