CVE-20XX-?
agent?

OS & kernel CVEs.

Published CVEs that affect os & kernel software, ranked by exploit odds.

726 CVEs · updated 2026-11-06 21:11 UTC

Reset all
  1. CVE-2025-59287

    Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

    Drop everything exploited Code execution OS & kernel Microsoft Windows Server 2012

    9.8 CRITICAL 100% exploit odds Fix listed
  2. CVE-2014-0497

    Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

    Drop everything exploited Code execution OS & kernel Adobe Flash Player

    9.8 CRITICAL 100% exploit odds Fix listed
  3. CVE-2021-34527

    A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. UPDATE July 7, 2021: The security update for Windows Server 2012, Windows Server 2016 and Windows 10, Version 1607 have been released. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability. In addition to installing the updates, in order to secure your system, you must confirm that the following registry settings are set to 0 (zero) or are not defined (Note: These registry keys do not exist by default, and therefore are already at the secure setting.), also that your Group Policy setting are correct (see FAQ): HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint NoWarningNoElevationOnInstall = 0 (DWORD) or not defined (default setting) UpdatePromptSettings = 0 (DWORD) or not defined (default setting) Having NoWarningNoElevationOnInstall set to 1 makes your system vulnerable by design. UPDATE July 6, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability. See also KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates. Note that the security updates released on and after July 6, 2021 contain protections for CVE-2021-1675 and the additional remote code execution exploit in the Windows Print Spooler service known as “PrintNightmare”, documented in CVE-2021-34527.

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    8.8 HIGH 100% exploit odds Fix listed
  4. CVE-2017-0199

    Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

    exploited Code execution OS & kernel Microsoft Office

    7.8 HIGH 99% exploit odds Fix listed
  5. CVE-2023-36884

    Windows Search Remote Code Execution Vulnerability

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.5 HIGH 99% exploit odds Fix listed
  6. CVE-2011-0611

    Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.

    exploited Code execution OS & kernel Adobe Flash Player

    8.8 HIGH 99% exploit odds Fix listed
  7. CVE-2017-0148

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.

    exploited Code execution OS & kernel Microsoft Server Message Block

    8.1 HIGH 99% exploit odds Fix listed
  8. CVE-2017-0144

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

    exploited Code execution OS & kernel Microsoft Server Message Block

    8.8 HIGH 99% exploit odds Fix listed
  9. CVE-2022-30190

    A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 99% exploit odds Fix listed
  10. CVE-2020-7209

    LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.

    Drop everything Code execution OS & kernel HP Linuxki

    9.8 CRITICAL 99% exploit odds Fix listed
  11. CVE-2020-1350

    A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.

    Drop everything exploited Code execution OS & kernel Microsoft Windows Server 2008

    10.0 CRITICAL 97% exploit odds Fix listed
  12. CVE-2023-21554

    Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

    Drop everything Code execution OS & kernel Microsoft Windows 10 1607

    9.8 CRITICAL 95% exploit odds Fix listed
  13. CVE-2023-24941

    Windows Network File System Remote Code Execution Vulnerability

    Drop everything Code execution OS & kernel Microsoft Windows Server 2012

    9.8 CRITICAL 95% exploit odds Fix listed
  14. CVE-2017-0143

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

    exploited Code execution OS & kernel Microsoft Server Message Block

    8.8 HIGH 93% exploit odds Fix listed
  15. CVE-2022-21907

    HTTP Protocol Stack Remote Code Execution Vulnerability

    Drop everything Code execution OS & kernel Microsoft Windows 10

    9.8 CRITICAL 93% exploit odds No fix listed
  16. CVE-2020-27131

    Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. These vulnerabilities are due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit these vulnerabilities by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the device with the privileges of NT AUTHORITY\SYSTEM on the Windows target host. Cisco has not released software updates that address these vulnerabilities.

    Code execution OS & kernel Cisco Security Manager

    8.1 HIGH 92% exploit odds Fix listed
  17. CVE-2022-26809

    Remote Procedure Call Runtime Remote Code Execution Vulnerability

    Drop everything Code execution OS & kernel Microsoft Windows 10

    9.8 CRITICAL 91% exploit odds No fix listed
  18. CVE-2017-8464

    Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."

    exploited Code execution OS & kernel Microsoft Windows 10 1511

    8.8 HIGH 90% exploit odds Fix listed
  19. CVE-2017-0146

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.

    exploited Code execution OS & kernel Microsoft Server Message Block

    8.8 HIGH 90% exploit odds Fix listed
  20. CVE-2017-0145

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148.

    exploited Code execution OS & kernel Microsoft Server Message Block

    8.8 HIGH 90% exploit odds Fix listed
  21. CVE-2010-2568

    Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

    exploited Code execution OS & kernel Microsoft Windows 7

    7.8 HIGH 90% exploit odds Fix listed
  22. CVE-2022-30216

    Windows Server Service Tampering Vulnerability

    Code execution OS & kernel Microsoft Windows 10

    8.8 HIGH 89% exploit odds No fix listed
  23. CVE-2025-33053

    External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    8.8 HIGH 87% exploit odds Fix listed
  24. CVE-2022-37958

    SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability

    Code execution OS & kernel Microsoft Windows 10

    8.1 HIGH 86% exploit odds No fix listed
  25. CVE-2015-0311

    Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.

    Drop everything exploited Code execution OS & kernel Adobe Flash Player

    9.8 CRITICAL 86% exploit odds Fix listed
  26. CVE-2021-1675

    Windows Print Spooler Remote Code Execution Vulnerability

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 85% exploit odds Fix listed
  27. CVE-2017-0213

    Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.3 HIGH 84% exploit odds Fix listed
  28. CVE-2014-4114

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."

    exploited Code execution OS & kernel Microsoft Windows 7

    7.8 HIGH 82% exploit odds Fix listed
  29. CVE-2022-21972

    Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability

    Code execution OS & kernel Microsoft Windows 10

    8.1 HIGH 79% exploit odds Fix listed
  30. CVE-2011-3402

    Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."

    exploited Code execution OS & kernel Microsoft Windows 7

    8.8 HIGH 78% exploit odds Fix listed
  31. CVE-2020-0609

    A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0610.

    Drop everything Code execution OS & kernel Microsoft Windows Server 2012

    9.8 CRITICAL 78% exploit odds Fix listed
  32. CVE-2014-6352

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.

    exploited Code execution OS & kernel Microsoft Windows 7

    7.8 HIGH 77% exploit odds Fix listed
  33. CVE-2022-34721

    Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability

    Drop everything Code execution OS & kernel Microsoft Windows 10

    9.8 CRITICAL 76% exploit odds No fix listed
  34. CVE-2025-9491

    Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373.

    Code execution OS & kernel Microsoft Windows 11 23h2

    4.6 MEDIUM 76% exploit odds No fix listed
  35. CVE-2022-26937

    Windows Network File System Remote Code Execution Vulnerability

    Drop everything Code execution OS & kernel Microsoft Windows Server

    9.8 CRITICAL 76% exploit odds Fix listed
  36. CVE-2019-1358

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1359.

    Code execution OS & kernel Microsoft Windows 10

    7.8 HIGH 76% exploit odds Fix listed
  37. CVE-2014-9390

    Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

    Drop everything Code execution OS & kernel git-scm Git

    9.8 CRITICAL 76% exploit odds Fix listed
  38. CVE-2020-1421

    A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'LNK Remote Code Execution Vulnerability'.

    Code execution OS & kernel Microsoft Windows 10

    8.8 HIGH 75% exploit odds Fix listed
  39. CVE-2017-8543

    Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".

    Drop everything exploited Code execution OS & kernel Microsoft Windows 10 1507

    9.8 CRITICAL 74% exploit odds Fix listed
  40. CVE-2018-0824

    A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    8.8 HIGH 73% exploit odds Fix listed
  41. CVE-2020-5741

    Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

    exploited Code execution OS & kernel Plex Media Server

    7.2 HIGH 73% exploit odds No fix listed
  42. CVE-2018-8414

    A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.

    exploited Code execution OS & kernel Microsoft Windows 10 1703

    8.8 HIGH 73% exploit odds Fix listed
  43. CVE-2022-30136

    Windows Network File System Remote Code Execution Vulnerability

    Drop everything Code execution OS & kernel Microsoft Windows Server 2012

    9.8 CRITICAL 73% exploit odds Fix listed
  44. CVE-2024-38063

    Windows TCP/IP Remote Code Execution Vulnerability

    Drop everything Code execution OS & kernel Microsoft Windows 10 1507

    9.8 CRITICAL 71% exploit odds Fix listed
  45. CVE-2012-1535

    Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.

    exploited Code execution OS & kernel Adobe Flash Player

    7.8 HIGH 70% exploit odds Fix listed
  46. CVE-2022-23270

    Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability

    Code execution OS & kernel Microsoft Windows 10

    8.1 HIGH 70% exploit odds Fix listed
  47. CVE-2016-0185

    Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka "Windows Media Center Remote Code Execution Vulnerability."

    exploited Code execution OS & kernel Microsoft Windows 7

    7.8 HIGH 70% exploit odds Fix listed
  48. CVE-2012-4284

    A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary, which could let a remote malicious user execute arbitrary code

    Drop everything Code execution OS & kernel Sparklabs Viscosity

    9.8 CRITICAL 70% exploit odds Fix listed
  49. CVE-2022-30287

    Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.

    Code execution OS & kernel Horde Groupware

    8.0 HIGH 69% exploit odds Fix listed
  50. CVE-2016-3393

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component RCE Vulnerability."

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 68% exploit odds Fix listed

CVEs that affect os & kernel, sorted by how likely they are to be exploited (EPSS).