CVE-20XX-?
agent?

Being exploited right now.

CVEs that CISA lists as exploited in real attacks, newest additions first.

58 CVEs · updated 2026-11-12 20:03 UTC

Reset all
  1. CVE-2020-1350

    A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.

    Drop everything exploited Code execution OS & kernel Microsoft Windows Server 2008

    10.0 CRITICAL 97% exploit odds Fix listed
  2. CVE-2025-59287

    Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

    Drop everything exploited Code execution OS & kernel Microsoft Windows Server 2012

    9.8 CRITICAL 100% exploit odds Fix listed
  3. CVE-2014-0497

    Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

    Drop everything exploited Code execution OS & kernel Adobe Flash Player

    9.8 CRITICAL 100% exploit odds Fix listed
  4. CVE-2015-0311

    Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.

    Drop everything exploited Code execution OS & kernel Adobe Flash Player

    9.8 CRITICAL 86% exploit odds Fix listed
  5. CVE-2017-8543

    Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".

    Drop everything exploited Code execution OS & kernel Microsoft Windows 10 1507

    9.8 CRITICAL 74% exploit odds Fix listed
  6. CVE-2023-48365

    Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.

    Drop everything exploited Code execution OS & kernel Qlik Sense

    9.6 CRITICAL 48% exploit odds Fix listed
  7. CVE-2021-34527

    A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. UPDATE July 7, 2021: The security update for Windows Server 2012, Windows Server 2016 and Windows 10, Version 1607 have been released. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability. In addition to installing the updates, in order to secure your system, you must confirm that the following registry settings are set to 0 (zero) or are not defined (Note: These registry keys do not exist by default, and therefore are already at the secure setting.), also that your Group Policy setting are correct (see FAQ): HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint NoWarningNoElevationOnInstall = 0 (DWORD) or not defined (default setting) UpdatePromptSettings = 0 (DWORD) or not defined (default setting) Having NoWarningNoElevationOnInstall set to 1 makes your system vulnerable by design. UPDATE July 6, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability. See also KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates. Note that the security updates released on and after July 6, 2021 contain protections for CVE-2021-1675 and the additional remote code execution exploit in the Windows Print Spooler service known as “PrintNightmare”, documented in CVE-2021-34527.

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    8.8 HIGH 100% exploit odds Fix listed
  8. CVE-2011-0611

    Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.

    exploited Code execution OS & kernel Adobe Flash Player

    8.8 HIGH 99% exploit odds Fix listed
  9. CVE-2017-0144

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

    exploited Code execution OS & kernel Microsoft Server Message Block

    8.8 HIGH 99% exploit odds Fix listed
  10. CVE-2020-5741

    Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

    exploited Code execution OS & kernel Plex Media Server

    7.2 HIGH 73% exploit odds No fix listed
  11. CVE-2017-0143

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

    exploited Code execution OS & kernel Microsoft Server Message Block

    8.8 HIGH 93% exploit odds Fix listed
  12. CVE-2017-8464

    Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."

    exploited Code execution OS & kernel Microsoft Windows 10 1511

    8.8 HIGH 90% exploit odds Fix listed
  13. CVE-2017-0146

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.

    exploited Code execution OS & kernel Microsoft Server Message Block

    8.8 HIGH 90% exploit odds Fix listed
  14. CVE-2017-0145

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148.

    exploited Code execution OS & kernel Microsoft Server Message Block

    8.8 HIGH 90% exploit odds Fix listed
  15. CVE-2025-33053

    External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    8.8 HIGH 87% exploit odds Fix listed
  16. CVE-2017-0148

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.

    exploited Code execution OS & kernel Microsoft Server Message Block

    8.1 HIGH 99% exploit odds Fix listed
  17. CVE-2011-3402

    Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."

    exploited Code execution OS & kernel Microsoft Windows 7

    8.8 HIGH 78% exploit odds Fix listed
  18. CVE-2017-0199

    Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

    exploited Code execution OS & kernel Microsoft Office

    7.8 HIGH 99% exploit odds Fix listed
  19. CVE-2022-30190

    A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 99% exploit odds Fix listed
  20. CVE-2018-0824

    A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    8.8 HIGH 73% exploit odds Fix listed
  21. CVE-2018-8414

    A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.

    exploited Code execution OS & kernel Microsoft Windows 10 1703

    8.8 HIGH 73% exploit odds Fix listed
  22. CVE-2023-36884

    Windows Search Remote Code Execution Vulnerability

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.5 HIGH 99% exploit odds Fix listed
  23. CVE-2010-2568

    Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

    exploited Code execution OS & kernel Microsoft Windows 7

    7.8 HIGH 90% exploit odds Fix listed
  24. CVE-2016-7256

    atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Open Type Font Remote Code Execution Vulnerability."

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    8.8 HIGH 65% exploit odds Fix listed
  25. CVE-2021-1675

    Windows Print Spooler Remote Code Execution Vulnerability

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 85% exploit odds Fix listed
  26. CVE-2014-4114

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."

    exploited Code execution OS & kernel Microsoft Windows 7

    7.8 HIGH 82% exploit odds Fix listed
  27. CVE-2014-6352

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.

    exploited Code execution OS & kernel Microsoft Windows 7

    7.8 HIGH 77% exploit odds Fix listed
  28. CVE-2009-1537

    Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."

    exploited Code execution OS & kernel Microsoft Directx

    8.8 HIGH 51% exploit odds Fix listed
  29. CVE-2017-0213

    Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.3 HIGH 84% exploit odds Fix listed
  30. CVE-2012-1535

    Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.

    exploited Code execution OS & kernel Adobe Flash Player

    7.8 HIGH 70% exploit odds Fix listed
  31. CVE-2016-0185

    Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka "Windows Media Center Remote Code Execution Vulnerability."

    exploited Code execution OS & kernel Microsoft Windows 7

    7.8 HIGH 70% exploit odds Fix listed
  32. CVE-2016-3393

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component RCE Vulnerability."

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 68% exploit odds Fix listed
  33. CVE-2022-34713

    Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 68% exploit odds Fix listed
  34. CVE-2021-36934

    An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.

    exploited Code execution OS & kernel Microsoft Windows 10 1809

    7.8 HIGH 67% exploit odds Fix listed
  35. CVE-2024-43572

    Microsoft Management Console Remote Code Execution Vulnerability

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 67% exploit odds Fix listed
  36. CVE-2015-7645

    Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

    exploited Code execution OS & kernel Adobe Flash Player

    7.8 HIGH 65% exploit odds Fix listed
  37. CVE-2021-26828

    OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

    exploited Code execution OS & kernel Scadabr

    8.8 HIGH 39% exploit odds Fix listed
  38. CVE-2011-0609

    Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.

    exploited Code execution OS & kernel Adobe Flash Player

    7.8 HIGH 64% exploit odds Fix listed
  39. CVE-2021-1870

    A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

    exploited Code execution OS & kernel Apple Ipados

    9.8 CRITICAL 8% exploit odds Fix listed
  40. CVE-2021-1871

    A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

    exploited Code execution OS & kernel Apple Ipados

    9.8 CRITICAL 7% exploit odds Fix listed
  41. CVE-2019-1579

    Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

    exploited Code execution OS & kernel Paloaltonetworks pan-os

    8.1 HIGH 44% exploit odds Fix listed
  42. CVE-2015-1671

    The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."

    exploited Code execution OS & kernel Microsoft .net Framework

    7.8 HIGH 49% exploit odds Fix listed
  43. CVE-2023-41993

    The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

    exploited Code execution OS & kernel Apple Ipados

    8.8 HIGH 24% exploit odds Fix listed
  44. CVE-2019-0903

    A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    8.8 HIGH 22% exploit odds Fix listed
  45. CVE-2021-1647

    Microsoft Defender Remote Code Execution Vulnerability

    exploited Code execution OS & kernel Microsoft Windows Defender

    7.8 HIGH 40% exploit odds Fix listed
  46. CVE-2020-1040

    A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1032, CVE-2020-1036, CVE-2020-1041, CVE-2020-1042, CVE-2020-1043.

    exploited Code execution OS & kernel Microsoft Windows Server 2008

    9.0 CRITICAL 8% exploit odds Fix listed
  47. CVE-2020-3118

    A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).

    exploited Code execution OS & kernel Cisco iOS Xr

    8.8 HIGH 12% exploit odds Fix listed
  48. CVE-2013-0648

    Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

    exploited Code execution OS & kernel Adobe Flash Player

    8.8 HIGH 11% exploit odds Fix listed
  49. CVE-2025-30397

    Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.5 HIGH 27% exploit odds Fix listed
  50. CVE-2022-22047

    Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability

    exploited Code execution OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 18% exploit odds Fix listed

These CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using them in real attacks. Each entry shows severity, exploit odds, fix status and a timeline.