All CVEs, page 4
1724 CVEs, sorted by threat level then EPSS. Showing 361-480. Use search to combine filters.
HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-21182Oracle WebLogic Server Unspecified Vulnerability
Oracle · WebLogic Server · EPSS 74.16% · Threat 75CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2024-12084CVE-2024-12084: A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to impr…
samba · rsync · EPSS 72.51% · Threat 75CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2024-49112CVE-2024-49112: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
microsoft · windows 10 1507 · EPSS 72.17% · Threat 75HIGH 7.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-21509Microsoft Office Security Feature Bypass Vulnerability
Microsoft · Office · EPSS 70.80% · Threat 75HIGH 7.2Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-57728SimpleHelp Path Traversal Vulnerability
SimpleHelp · SimpleHelp · EPSS 64.47% · Threat 75CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2026-0740CVE-2026-0740: The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file upload…
Unknown · · EPSS 62.90% · Threat 75HIGH 8.8
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-2441Google Chromium CSS Use-After-Free Vulnerability
Google · Chromium · EPSS 54.96% · Threat 75CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2025-27007CVE-2025-27007: Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allo…
Unknown · · EPSS 54.19% · Threat 75HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2020-25079D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability
D-Link · DCS-2530L and DCS-2670L Devices · EPSS 54.01% · Threat 75CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2025-32375CVE-2025-32375: BentoML is a Python library for building online serving systems optimized for AI apps and …
bentoml · bentoml · EPSS 52.41% · Threat 75CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-21042Samsung Mobile Devices Out-of-Bounds Write Vulnerability
Samsung · Mobile Devices · EPSS 35.58% · Threat 75CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-20393Cisco Multiple Products Improper Input Validation Vulnerability
Cisco · Multiple Products · EPSS 32.39% · Threat 75CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-43300Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
Apple · iOS, iPadOS, and macOS · EPSS 32.03% · Threat 75HIGH 8.8
Public PoCATT&CK inferred
CVE-2022-41678CVE-2022-41678: Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execut…
apache · activemq · EPSS 85.81% · Threat 74HIGH 7.2
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-44221SonicWall SMA100 Appliances OS Command Injection Vulnerability
SonicWall · SMA100 Appliances · EPSS 76.25% · Threat 74CRITICAL 9.8
Exploit-DBATT&CK inferred
CVE-2024-11972CVE-2024-11972: The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST AP…
themehunk · hunk companion · EPSS 59.05% · Threat 74HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2009-1537Microsoft DirectX NULL Byte Overwrite Vulnerability
Microsoft · DirectX · EPSS 51.36% · Threat 74CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2025-7441CVE-2025-7441: The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all version…
Unknown · · EPSS 49.89% · Threat 74HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-85046Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8 · EPSS 48.88% · Threat 74HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-68645Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS) · EPSS 48.87% · Threat 74CRITICAL 10
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-56290Joomlack Page Builder Improper Access Control Vulnerability
Joomlack · Page Builder · EPSS 30.87% · Threat 74CRITICAL 9.3Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-14733WatchGuard Firebox Out of Bounds Write Vulnerability
WatchGuard · Firebox · EPSS 26.51% · Threat 74MEDIUM 6.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-43451Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
Microsoft · Windows · EPSS 84.27% · Threat 73HIGH 8.1
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-3102CVE-2025-3102: The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an …
Unknown · · EPSS 76.24% · Threat 73CRITICAL 9.5
Public PoCATT&CK inferred
CVE-2024-53677CVE-2024-53677: File upload logic in Apache Struts is flawed. An attacker can manipulate file upload param…
apache · struts · EPSS 70.46% · Threat 73HIGH 8.6
Metasploit moduleATT&CK inferred
CVE-2024-48766CVE-2024-48766: NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP clie…
netalertx · netalertx · EPSS 67.91% · Threat 73CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-25256CVE-2025-25256: An improper neutralization of special elements used in an OS command ('OS Command Injectio…
fortinet · fortisiem · EPSS 65.30% · Threat 73HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2023-4911GNU C Library Buffer Overflow Vulnerability
GNU · GNU C Library · EPSS 63.77% · Threat 73CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2024-51568CVE-2024-51568: CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the…
cyberpanel · cyberpanel · EPSS 47.67% · Threat 73CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2024-48760CVE-2024-48760: An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the fil…
gestioip · gestioip · EPSS 45.78% · Threat 73CRITICAL 9.3
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-105134Ahsay AhsayCBS Command Injection Vulnerability
Ahsay · AhsayCBS · EPSS 38.31% · Threat 73CRITICAL 9.3
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2026-39987Marimo Remote Code Execution Vulnerability
Marimo · Marimo · EPSS 37.87% · Threat 73CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-32756Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
Fortinet · Multiple Products · EPSS 30.94% · Threat 73CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-76461Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco · Secure Email Gateway · EPSS 29.54% · Threat 73CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-20963Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft · SharePoint · EPSS 29.20% · Threat 73CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2014-3931Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability
Looking Glass · Multi-Router Looking Glass (MRLG) · EPSS 28.98% · Threat 73CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-9198IBM Langflow Code Injection Vulnerability
IBM · Langflow · EPSS 28.66% · Threat 73CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-11120GeoVision Devices OS Command Injection Vulnerability
GeoVision · Multiple Devices · EPSS 28.39% · Threat 73MEDIUM 6.5
Metasploit moduleATT&CK inferred
CVE-2025-53771CVE-2025-53771: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to …
microsoft · sharepoint server · EPSS 99.89% · Threat 72MEDIUM 6.9
Metasploit moduleATT&CK inferred
CVE-2024-11320CVE-2024-11320: Arbitrary commands execution on the server by exploiting a command injection vulnerability…
pandorafms · pandora fms · EPSS 91.20% · Threat 72HIGH 7.2
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2024-25641CVE-2024-25641: Cacti provides an operational monitoring and fault management framework. Prior to version …
cacti · cacti · EPSS 86.30% · Threat 72CRITICAL 9.3
Public PoCATT&CK inferred
CVE-2024-27954CVE-2024-27954: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili…
Unknown · · EPSS 72.77% · Threat 72HIGH 8.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-4367CVE-2024-4367: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaSc…
mozilla · firefox · EPSS 70.66% · Threat 72HIGH 7.5
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2025-31125Vite Vitejs Improper Access Control Vulnerability
Vite · Vitejs · EPSS 65.76% · Threat 72CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2023-45878CVE-2023-45878: GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_vis…
gibbonedu · gibbon · EPSS 63.11% · Threat 72CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2024-55556CVE-2024-55556: A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the…
Unknown · · EPSS 43.91% · Threat 72CRITICAL 9.8
Metasploit moduleExploit-DBATT&CK inferred
CVE-2020-36847CVE-2020-36847: The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versio…
simplefilelist · simple file list · EPSS 43.52% · Threat 72HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2007-0671Microsoft Office Excel Remote Code Execution Vulnerability
Microsoft · Office · EPSS 43.24% · Threat 72HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2009-0238Microsoft Office Remote Code Execution
Microsoft · Office · EPSS 42.94% · Threat 72CRITICAL 10Ransomware
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
SonicWall · SMA1000 Appliances · EPSS 6.79% · Threat 72MEDIUM 5.3Top #2
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2021-26086Atlassian Jira Server and Data Center Path Traversal Vulnerability
Atlassian · Jira Server and Data Center · EPSS 100.00% · Threat 71MEDIUM 6.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2020-11023JQuery Cross-Site Scripting (XSS) Vulnerability
JQuery · JQuery · EPSS 84.89% · Threat 71HIGH 8.6
Metasploit moduleATT&CK inferred
CVE-2024-12971CVE-2024-12971: Improper Neutralization of Special Elements used in a Command vulnerability allows OS Comm…
artica · pandora fms · EPSS 61.49% · Threat 71HIGH 8.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-2945CVE-2025-2945: Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deploymen…
pgadmin · pgadmin 4 · EPSS 56.30% · Threat 71HIGH 7.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2025-32463Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Sudo · Sudo · EPSS 55.50% · Threat 71HIGH 7.2Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-38094Microsoft SharePoint Deserialization Vulnerability
Microsoft · SharePoint · EPSS 50.89% · Threat 71CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-58434CVE-2025-58434: Flowise is a drag & drop user interface to build a customized large language model flow. I…
flowiseai · flowise · EPSS 50.54% · Threat 71HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2023-33538TP-Link Multiple Routers Command Injection Vulnerability
TP-Link · Multiple Routers · EPSS 41.61% · Threat 71CRITICAL 9.8
Metasploit moduleATT&CK inferred
CVE-2026-0769CVE-2026-0769: Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. Th…
langflow · langflow · EPSS 41.22% · Threat 71CRITICAL 9.8
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-27520CVE-2025-27520: BentoML is a Python library for building online serving systems optimized for AI apps and …
bentoml · bentoml · EPSS 40.62% · Threat 71HIGH 8.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-39780ASUS RT-AX55 Routers OS Command Injection Vulnerability
ASUS · RT-AX55 Routers · EPSS 39.51% · Threat 71HIGH 8.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2021-26828OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability
OpenPLC · ScadaBR · EPSS 39.10% · Threat 71CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-0300Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
Palo Alto Networks · PAN-OS · EPSS 31.72% · Threat 71CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-4632Samsung MagicINFO 9 Server Path Traversal Vulnerability
Samsung · MagicINFO 9 Server · EPSS 24.07% · Threat 71CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-60004Gitea Code Injection Vulnerability
Gitea · Gitea · EPSS 23.99% · Threat 71CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-54948Trend Micro Apex One OS Command Injection Vulnerability
Trend Micro · Apex One · EPSS 23.92% · Threat 71CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-37079Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
Broadcom · VMware vCenter Server · EPSS 22.38% · Threat 71CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-48939iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
iCagenda · iCagenda · EPSS 20.07% · Threat 71HIGH 7
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-04117-Zip Mark of the Web Bypass Vulnerability
7-Zip · 7-Zip · EPSS 67.07% · Threat 70CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-1661CVE-2025-1661: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerabl…
pluginus · husky - products filter professional for woocommerce · EPSS 56.38% · Threat 70HIGH 8.7
Metasploit modulePublic PoCATT&CK inferred
CVE-2025-24367CVE-2025-24367: Cacti is an open source performance and fault management framework. An authenticated Cacti…
cacti · cacti · EPSS 54.02% · Threat 70CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-29306CVE-2025-29306: An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case…
foxcms · foxcms · EPSS 46.58% · Threat 70CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2025-31200Apple Multiple Products Memory Corruption Vulnerability
Apple · Multiple Products · EPSS 20.90% · Threat 70CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2021-3199ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE · Docs · EPSS 20.14% · Threat 70CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2016-7836SKYSEA Client View Improper Authentication Vulnerability
SKYSEA · Client View · EPSS 19.23% · Threat 70CRITICAL 10
Exploited in the wild · CISA KEVExploit-DBPublic PoCCTID-mapped
CVE-2025-24085Apple Multiple Products Use-After-Free Vulnerability
Apple · Multiple Products · EPSS 17.51% · Threat 70CRITICAL 10
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-48907Widget Factory Joomla Content Editor Improper Access Control Vulnerability
Widget Factory · Joomla Content Editor · EPSS 16.19% · Threat 70CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-34908Ubiquiti UniFi OS Improper Access Control Vulnerability
Ubiquiti · UniFi OS · EPSS 15.21% · Threat 70CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVCTID-mapped
CVE-2020-29574CyberoamOS (CROS) SQL Injection Vulnerability
Sophos · CyberoamOS · EPSS 4.70% · Threat 70CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-11667Zyxel Multiple Firewalls Path Traversal Vulnerability
Zyxel · Multiple Firewalls · EPSS 2.93% · Threat 70CRITICAL 9.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-59310Broadcom VMware vCenter Path Traversal Vulnerability
Broadcom · VMware vCenter · EPSS 2.56% · Threat 70HIGH 7.5
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-25181Advantive VeraCore SQL Injection Vulnerability
Advantive · VeraCore · EPSS 55.55% · Threat 69CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2024-50498CVE-2024-50498: Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Q…
lubus · wp query console · EPSS 52.91% · Threat 69HIGH 7.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2023-32434Apple Multiple Products Integer Overflow Vulnerability
Apple · Multiple Products · EPSS 51.52% · Threat 69CRITICAL 9.3
Metasploit moduleATT&CK inferred
CVE-2026-2329CVE-2026-2329: An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoi…
grandstream · gxp1610 firmware · EPSS 41.72% · Threat 69HIGH 8.6
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2025-9377TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability
TP-Link · Multiple Routers · EPSS 37.73% · Threat 69HIGH 8.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2022-40799D-Link DNR-322L Download of Code Without Integrity Check Vulnerability
D-Link · DNR-322L · EPSS 33.65% · Threat 69CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-4257CVE-2026-4257: The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template I…
Unknown · · EPSS 32.78% · Threat 69HIGH 8.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2024-57968Advantive VeraCore Unrestricted File Upload Vulnerability
Advantive · VeraCore · EPSS 32.28% · Threat 69CRITICAL 9.3
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-33017Langflow Code Injection Vulnerability
Langflow · Langflow · EPSS 24.75% · Threat 69CRITICAL 9.6
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-7971Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8 · EPSS 21.10% · Threat 69CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2024-38813VMware vCenter Server Privilege Escalation Vulnerability
VMware · vCenter Server · EPSS 17.36% · Threat 69CRITICAL 9.8
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-58644Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft · SharePoint · EPSS 15.87% · Threat 69CRITICAL 9.8
Exploited in the wild · CISA KEVMetasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-9082Drupal Core SQL Injection Vulnerability
Drupal · Core · EPSS 15.70% · Threat 69CRITICAL 10
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-56291Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
Balbooa · Forms · EPSS 14.85% · Threat 69CRITICAL 10
Exploited in the wild · CISA KEVATT&CK inferred
CVE-2026-22769Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability
Dell · RecoverPoint for Virtual Machines (RP4VMs) · EPSS 13.53% · Threat 69CRITICAL 10
Exploited in the wild · CISA KEVMetasploit modulePublic PoCATT&CK inferred
CVE-2026-86218N-able N-central Static Code Injection Vulnerability
N-able · N-central · EPSS 13.35% · Threat 69CRITICAL 9.1Ransomware
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-42999SAP NetWeaver Deserialization Vulnerability
SAP · NetWeaver · EPSS 12.85% · Threat 69HIGH 7.5
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-23334CVE-2024-23334: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using…
aiohttp · aiohttp · EPSS 76.88% · Threat 68CRITICAL 9.1
Public PoCATT&CK inferred
CVE-2026-19478CVE-2026-19478: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.…
gitlab · gitlab · EPSS 60.20% · Threat 68HIGH 8.1
Metasploit moduleATT&CK inferred
CVE-2025-48828CVE-2025-48828: Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing …
vbulletin · vbulletin · EPSS 57.30% · Threat 68CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-5394CVE-2025-5394: The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnera…
Unknown · · EPSS 51.29% · Threat 68CRITICAL 9.8
Exploit-DBPublic PoCATT&CK inferred
CVE-2024-42640CVE-2024-42640: angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execut…
Unknown · · EPSS 40.21% · Threat 68CRITICAL 9.8
Metasploit moduleExploit-DBPublic PoCATT&CK inferred
CVE-2026-3891CVE-2026-3891: The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due t…
Unknown · · EPSS 29.73% · Threat 68HIGH 8.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-2533PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability
PaperCut · NG/MF · EPSS 28.83% · Threat 68CRITICAL 9.3
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-19490Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
Citrix · NetScaler · EPSS 23.16% · Threat 68CRITICAL 9.6
Exploited in the wild · CISA KEVPublic PoCCTID-mapped
CVE-2024-4947Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8 · EPSS 15.24% · Threat 68CRITICAL 9.8
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-82329JFrog Artifactory Improper Authentication Vulnerability
JFrog · Artifactory · EPSS 14.37% · Threat 68HIGH 8.8Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2024-49039Microsoft Windows Task Scheduler Privilege Escalation Vulnerability
Microsoft · Windows · EPSS 14.18% · Threat 68CRITICAL 9.8
Exploited in the wild · CISA KEVCTID-mapped
CVE-2025-31201Apple Multiple Products Arbitrary Read and Write Vulnerability
Apple · Multiple Products · EPSS 13.86% · Threat 68CRITICAL 9.6Ransomware
Exploited in the wild · CISA KEVPublic PoCATT&CK inferred
CVE-2026-45321TanStack Unspecified Vulnerability
TanStack · TanStack · EPSS 1.05% · Threat 68MEDIUM 6.1
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-4123CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client …
grafana · grafana · EPSS 97.08% · Threat 67HIGH 7.5
Public PoCATT&CK inferred
CVE-2024-49113CVE-2024-49113: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
microsoft · windows 10 1507 · EPSS 83.78% · Threat 67HIGH 7.5
Exploit-DBPublic PoCATT&CK inferred
CVE-2025-30208CVE-2025-30208: Vite, a provider of frontend development tooling, has a vulnerability in versions prior to…
vitejs · vite · EPSS 74.77% · Threat 67MEDIUM 6.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2024-37383RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
Roundcube · Webmail · EPSS 73.30% · Threat 67MEDIUM 6.1
Exploited in the wild · CISA KEVExploit-DBPublic PoCATT&CK inferred
CVE-2019-9978WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
WordPress · Social Warfare Plugin · EPSS 72.95% · Threat 67HIGH 7.2
Exploited in the wild · CISA KEVMetasploit moduleATT&CK inferred
CVE-2025-58034Fortinet FortiWeb OS Command Injection Vulnerability
Fortinet · FortiWeb · EPSS 54.72% · Threat 67HIGH 7.2
Exploited in the wild · CISA KEVCTID-mapped
CVE-2023-20118Cisco Small Business RV Series Routers Command Injection Vulnerability
Cisco · Small Business RV Series Routers · EPSS 54.11% · Threat 67CRITICAL 9.8
Public PoCATT&CK inferred
CVE-2025-64095CVE-2025-64095: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the M…
dnnsoftware · dotnetnuke · EPSS 46.97% · Threat 67CRITICAL 9.9
Public PoCATT&CK inferred
CVE-2024-8672