Latest vulnerabilities

2,887 results · Clear filters · Feed

• Critical —
  CVE-2013-4660 Public exploit EPSS 17%

  Deserialization Code Execution in js-yaml

  The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.

  js-yaml npm
  Jun 28, 2013
• Critical 9.8
  CVE-2013-2465 Exploited · Ransomware Public exploit EPSS 99%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 …

  Jun 18, 2013

  KEV Mar 28, 2022
• Critical 9.1
  CVE-2012-3363 Public exploit EPSS 49%

  Zend Framework XXE Vulnerability

  Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element …

  zendframework/zendframework1 zend-framework Ubuntu Packagist
  Feb 13, 2013
• Critical 9.8
  CVE-2013-0632 Exploited Public exploit EPSS 93%

  administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and po…

  Jan 17, 2013

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2013-0422 Exploited · Ransomware Public exploit EPSS 97%

  Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) usin…

  Jan 10, 2013

  KEV May 25, 2022
• Critical 9.8
  CVE-2013-0625 Exploited Public exploit EPSS 94%

  Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentica…

  Jan 9, 2013

  KEV Mar 7, 2022
• Critical 9.4
  CVE-2012-5864 Public exploit

  Sinapsi eSolar Improper Authentication

  These Sinapsi devices do not check if users that visit pages within the device have properly authenticated. By directly visiting the pages within the device, attackers can gain unauthorized access with administrative privileges.

  Sinapsi eSolar eSolar Light eSolar DUO
  Nov 23, 2012
• Critical 10.0
  CVE-2012-5863 Public exploit EPSS 25%

  Sinapsi eSolar OS Command Injection

  These Sinapsi devices do not check for special elements in commands sent to the system. By accessing certain pages with administrative privileges that do not require authentication within the device, attackers can execute arbitrary, unexpected, or dangerous c…

  Sinapsi eSolar Light eSolar DUO eSolar
  Nov 23, 2012
• Critical 10.0
  CVE-2012-5862 Public exploit EPSS 12%

  Sinapsi eSolar Hard-Coded Password

  These Sinapsi devices store hard-coded passwords in the PHP file of the device. By using the hard-coded passwords in the device, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.

  Sinapsi eSolar DUO eSolar eSolar Light
  Nov 23, 2012
• Critical 9.1
  CVE-2012-3152 Exploited Public exploit EPSS 99%

  Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and…

  Oct 16, 2012

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2012-5076 Exploited Public exploit EPSS 91%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allo…

  Oct 16, 2012

  KEV Mar 28, 2022
• Critical 9.8
  CVE-2012-4681 Exploited · Ransomware Public exploit EPSS 99%

  Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow…

  Aug 28, 2012

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2012-1723 Exploited · Ransomware Public exploit EPSS 94%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 u…

  Jun 16, 2012

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2012-0507 Exploited · Ransomware Public exploit EPSS 98%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 U…

  Jun 7, 2012

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2012-1823 Exploited Public exploit Scanner template EPSS 100%

  sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does no…

  May 11, 2012

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2012-0391 Exploited Public exploit EPSS 76%

  Apache Struts Remote Java Code Execution

  The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a craf…

  org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  Jan 8, 2012

  KEV Jan 21, 2022
• Critical 9.8
  CVE-2011-2013 Public exploit EPSS 32%

  Integer overflow in the TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, …

  Nov 8, 2011
• Critical 9.8
  CVE-2011-3544 Exploited Public exploit EPSS 97%

  Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and…

  Oct 19, 2011

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2011-0657 Public exploit EPSS 62%

  DNSAPI.dll in the DNS client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, W…

  Apr 13, 2011
• Critical 9.8
  CVE-2010-4344 Exploited Public exploit EPSS 72%

  Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to ex…

  exim4 Debian
  Dec 14, 2010

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2010-3765 Exploited Public exploit EPSS 83%

  Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, …

  Oct 27, 2010

  KEV Oct 6, 2025
• Critical 9.8
  CVE-2010-0840 Exploited Public exploit EPSS 96%

  Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18…

  Apr 1, 2010

  KEV May 25, 2022
• Critical 9.8
  CVE-2009-4488 Public exploit EPSS 13%

  Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers…

  varnish varnish Debian Ubuntu
  Jan 13, 2010
• Critical 9.8
  CVE-2009-4491 Public exploit EPSS 14%

  thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers…

  Jan 13, 2010
• Critical 9.8
  CVE-2009-3555 Public exploit EPSS 87%

  Apache Tomcat affected by vulnerability in TLS and SSL protocol

  The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Serv…

  openssl apache2 org.apache.tomcat:tomcat nss Debian Maven
  Nov 9, 2009
• Critical 9.8
  CVE-2009-2168 Public exploit EPSS 12%

  cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit wh…

  Jun 22, 2009
• Critical 9.8
  CVE-2009-1936 Public exploit EPSS 52%

  _functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called dire…

  Jun 5, 2009
• Critical 9.8
  CVE-2009-1151 Exploited Public exploit Scanner template EPSS 97%

  Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows rem…

  phpmyadmin Debian
  Mar 26, 2009

  KEV Mar 25, 2022
• Critical 9.8
  CVE-2004-2761 Public exploit EPSS 10%

  The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to c…

  Jan 5, 2009
• Critical 9.8
  CVE-2008-4250 Exploited Public exploit EPSS 99%

  The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2…

  Oct 23, 2008

  KEV May 20, 2026
• Critical 9.8
  CVE-2008-1511 Public exploit

  Multiple PHP remote file inclusion vulnerabilities in ooComments 1.0 allow remote attackers to execute arbitrary PHP co…

  Mar 25, 2008
• Critical 9.8
  CVE-2008-0081 Public exploit EPSS 58%

  Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows use…

  Jan 16, 2008
• Critical 9.8
  CVE-2007-5775 Public exploit EPSS 29%

  Unspecified vulnerability in BitDefender allows attackers to execute arbitrary code via unspecified vectors, aka EEYEB-…

  Nov 1, 2007
• Critical 9.8
  CVE-2007-3010 Exploited Public exploit Scanner template EPSS 97%

  masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows re…

  Sep 18, 2007

  KEV Apr 15, 2022
• Critical 9.8
  CVE-2007-4559 Public exploit EPSS 27%

  Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allow…

  python3.4 python3.5 python2.7 python3.6 Ubuntu Azure Linux
  Aug 28, 2007
• Critical 9.8
  CVE-2007-3798 Public exploit EPSS 70%

  Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute ar…

  tcpdump Debian
  Jul 16, 2007
• Critical 9.8
  CVE-2007-1383 Public exploit EPSS 15%

  Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitr…

  Mar 10, 2007
• Critical 9.8
  CVE-2006-6863 Public exploit EPSS 13%

  PHP remote file inclusion vulnerability in the Enigma2 plugin (Enigma2.php) in Enigma WordPress Bridge allows remote at…

  Jan 4, 2007
• Critical 9.8
  CVE-2006-5603 Public exploit

  SQL injection vulnerability in pop_mail.asp in Snitz Forums 2000 3.4.06 allows remote attackers to execute arbitrary SQ…

  Oct 30, 2006
• Critical 9.8
  CVE-2006-5021 Public exploit

  Multiple PHP remote file inclusion vulnerabilities in redgun RedBLoG 0.5 allow remote attackers to execute arbitrary PH…

  Sep 27, 2006