CVE-20XX-?
agent?

Drop everything.

Critical CVEs that are confirmed exploited or very likely to be. Newest first.

2,367 CVEs · updated 2026-11-10 14:01 UTC

  1. CVE-2017-18044

    A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted message can inject commands that will be executed on the target operating system. Exploitation of this vulnerability does not require authentication and can lead to SYSTEM level privilege on any system running the cvd daemon. This is a different vulnerability than CVE-2017-3195.

    Drop everything Injection Commvault

    9.8 CRITICAL 69% exploit odds Fix listed
  2. CVE-2014-6436

    Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers to bypass authentication in opportunistic circumstances and execute arbitrary commands with administrator privileges by leveraging an existing web portal login.

    Drop everything Auth & access Network gear Aztech Adsl dsl5018en \(1t1r\) Firmware

    9.8 CRITICAL 42% exploit odds No fix listed
  3. CVE-2018-5347

    Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.

    Drop everything Injection Server Seagate Personal Cloud Firmware

    9.8 CRITICAL 54% exploit odds No fix listed
  4. CVE-2017-17485

    FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

    Drop everything Code execution Fasterxml jackson-databind

    9.8 CRITICAL 50% exploit odds No fix listed
  5. CVE-2017-16720

    A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within the directory structure of the target device.

    Drop everything Disclosure Web app Advantech Webaccess

    9.8 CRITICAL 50% exploit odds No fix listed
  6. CVE-2014-7862

    The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.

    Drop everything Other Web app Zohocorp Desktop Central

    9.8 CRITICAL 81% exploit odds No fix listed
  7. CVE-2017-8046

    Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

    Drop everything Code execution VMware Spring Boot

    9.8 CRITICAL 75% exploit odds Fix listed
  8. CVE-2017-1000486

    Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

    Drop everything exploited Crypto Primetek Primefaces

    9.8 CRITICAL 94% exploit odds No fix listed
  9. CVE-2017-18017

    The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.

    Drop everything Memory safety OS & kernel Linux Kernel

    9.8 CRITICAL 53% exploit odds Fix listed
  10. CVE-2018-3810

    Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.

    Drop everything Auth & access Web app Oturia Smart Google Code Inserter

    9.8 CRITICAL 91% exploit odds No fix listed
  11. CVE-2018-3811

    SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in the context of the web server. The saveGoogleAdWords() function in smartgooglecode.php did not use prepared statements and did not sanitize the $_POST["oId"] variable before passing it as input into the SQL query.

    Drop everything Injection Web app Oturia Smart Google Code Inserter

    9.8 CRITICAL 42% exploit odds No fix listed
  12. CVE-2017-17932

    A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine/computer via a long string to TCP port 888.

    Drop everything Memory safety Server Allmediaserver

    9.8 CRITICAL 54% exploit odds No fix listed
  13. CVE-2014-8389

    cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware 1.81 21.08.2014, AirLive WL-2000CAM with firmware LM.1.6.18 14.10.2011, and AirLive POE-200CAM v2 with firmware LM.1.6.17.01 uses hard-coded credentials in the embedded Boa web server, which allows remote attackers to obtain user credentials via crafted HTTP requests.

    Drop everything Injection Device Airlive bu-3026 Firmware

    9.8 CRITICAL 51% exploit odds Fix listed
  14. CVE-2017-17411

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data before executing a system call. An attacker could leverage this vulnerability to execute code with root privileges. Was ZDI-CAN-4892.

    Drop everything Injection Network gear Linksys wvbr0 Firmware

    9.8 CRITICAL 88% exploit odds Fix listed
  15. CVE-2012-2576

    SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote attackers to execute arbitrary SQL commands via the loginName field.

    Drop everything Injection Web app Solarwinds Backup Profiler

    9.8 CRITICAL 60% exploit odds Fix listed
  16. CVE-2017-17105

    Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a cgi-bin/iptest.cgi?cmd=iptest.cgi&-time="1504225666237"&-url=$(reboot) request.

    Drop everything Injection Device Zivif pr115-204-p-rs Firmware

    9.8 CRITICAL 85% exploit odds No fix listed
  17. CVE-2017-17733

    Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.

    Drop everything Code execution Web app Maccms

    9.8 CRITICAL 44% exploit odds No fix listed
  18. CVE-2017-3191

    D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remote management login page can manipulate the POST request in such a manner as to access some administrator-only pages such as tools_admin.asp without credentials.

    Drop everything Auth & access Network gear D-Link dir-130 Firmware

    9.8 CRITICAL 63% exploit odds No fix listed
  19. CVE-2017-17560

    An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root.

    Drop everything Auth & access Server Westerndigital My Cloud pr4100 Firmware

    9.8 CRITICAL 73% exploit odds Fix listed
  20. CVE-2017-15944

    Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.

    Drop everything exploited Code execution Network gear Paloaltonetworks pan-os

    9.8 CRITICAL 98% exploit odds Fix listed
  21. CVE-2017-11283

    Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

    Drop everything Code execution Web app Adobe Coldfusion

    9.8 CRITICAL 43% exploit odds Fix listed
  22. CVE-2017-11284

    Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

    Drop everything Code execution Web app Adobe Coldfusion

    9.8 CRITICAL 43% exploit odds Fix listed
  23. CVE-2017-16943

    The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.

    Drop everything Memory safety Server Exim

    9.8 CRITICAL 47% exploit odds Fix listed
  24. CVE-2017-12635

    Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.

    Drop everything Auth & access Server Apache Couchdb

    9.8 CRITICAL 100% exploit odds No fix listed
  25. CVE-2015-7501

    Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

    Drop everything Code execution Library Redhat Data Grid

    9.8 CRITICAL 86% exploit odds Fix listed
  26. CVE-2012-5357

    Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.

    Drop everything Code execution Web app Ektron Content Management System

    9.8 CRITICAL 68% exploit odds Fix listed
  27. CVE-2017-15222

    Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.

    Drop everything Memory safety Nftp Project Nftp

    9.8 CRITICAL 60% exploit odds No fix listed
  28. CVE-2017-10366

    Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

    Drop everything Other Oracle Peoplesoft Enterprise Peopletools

    9.8 CRITICAL 43% exploit odds Fix listed
  29. CVE-2017-12629

    Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

    Drop everything Code execution Web app Apache Solr

    9.8 CRITICAL 92% exploit odds Fix listed
  30. CVE-2017-11771

    The Microsoft Windows Search component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly handle DNS responses, aka "Windows Search Remote Code Execution Vulnerability".

    Drop everything Code execution OS & kernel Microsoft Windows 10

    9.8 CRITICAL 52% exploit odds Fix listed
  31. CVE-2017-5791

    The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI.

    Drop everything Auth & access HP Intelligent Management Center Plat

    9.8 CRITICAL 69% exploit odds Fix listed
  32. CVE-2017-12149

    In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

    Drop everything exploited Code execution Server Redhat Jboss Enterprise Application Platform

    9.8 CRITICAL 91% exploit odds No fix listed
  33. CVE-2017-14491

    Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

    Drop everything Memory safety Thekelleys Dnsmasq

    9.8 CRITICAL 86% exploit odds Fix listed
  34. CVE-2017-14492

    Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.

    Drop everything Memory safety Network gear Canonical Ubuntu Linux

    9.8 CRITICAL 94% exploit odds Fix listed
  35. CVE-2017-14493

    Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.

    Drop everything Memory safety Canonical Ubuntu Linux

    9.8 CRITICAL 85% exploit odds Fix listed
  36. CVE-2017-14942

    Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg containing an admin:language=pt cookie.

    Drop everything Disclosure Network gear Intelbras Wrn 150 Firmware

    9.8 CRITICAL 61% exploit odds No fix listed
  37. CVE-2017-12240

    The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a buffer overflow condition in the DHCP relay subsystem of the affected software. An attacker could exploit this vulnerability by sending a crafted DHCP Version 4 (DHCPv4) packet to an affected system. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a DoS condition. Cisco Bug IDs: CSCsm45390, CSCuw77959.

    Drop everything exploited Memory safety Network gear Cisco iOS

    9.8 CRITICAL 14% exploit odds Fix listed
  38. CVE-2015-8249

    The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter.

    Drop everything Code execution Web app Manageengine Desktop Central

    9.8 CRITICAL 74% exploit odds Fix listed
  39. CVE-2017-14078

    SQL Injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrary code on vulnerable installations.

    Drop everything Injection Device Trendmicro Mobile Security

    9.8 CRITICAL 50% exploit odds Fix listed
  40. CVE-2015-1187

    The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.

    Drop everything exploited Auth & access Network gear Dlink dir-626l Firmware

    9.8 CRITICAL 83% exploit odds Fix listed
  41. CVE-2017-12611

    In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.

    Drop everything Other Web app Apache Struts

    9.8 CRITICAL 87% exploit odds Fix listed
  42. CVE-2014-8684

    CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.

    Drop everything Crypto Web app Codeigniter

    9.8 CRITICAL 72% exploit odds Fix listed
  43. CVE-2017-14143

    The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzone cookie.

    Drop everything Auth & access Web app Kaltura Server

    9.8 CRITICAL 77% exploit odds Fix listed
  44. CVE-2014-9618

    The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL.

    Drop everything Auth & access Web app Netsweeper

    9.8 CRITICAL 73% exploit odds No fix listed
  45. CVE-2017-14147

    An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory settings by simply browsing to the link http://[Default-Router-IP]/restoreinfo.cgi & execute it. Due to improper authentication on this page, the software accepts the request hence allowing attacker to reset the router to its default configurations which later could allow attacker to login to router by using default username/password.

    Drop everything Auth & access Network gear Fiberhome Adsl an1020-25 Firmware

    9.8 CRITICAL 66% exploit odds No fix listed
  46. CVE-2017-11317

    Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

    Drop everything exploited Crypto Web app Telerik Ui For asp.net Ajax

    9.8 CRITICAL 84% exploit odds Fix listed
  47. CVE-2017-11357

    Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

    Drop everything exploited Code execution Web app Progress Telerik Ui For asp.net Ajax

    9.8 CRITICAL 78% exploit odds Fix listed
  48. CVE-2015-2857

    Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter.

    Drop everything Injection Accellion File Transfer Appliance

    9.8 CRITICAL 84% exploit odds No fix listed
  49. CVE-2017-7546

    PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

    Drop everything Auth & access Server PostgreSQL

    9.8 CRITICAL 62% exploit odds Fix listed
  50. CVE-2015-7871

    Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.

    Drop everything Auth & access Ntp

    9.8 CRITICAL 82% exploit odds Fix listed

A CVE is listed as major when it is critical (CVSS 9.0 or higher) and either confirmed exploited in the wild with a real chance of more, or very likely to be exploited (EPSS 40% or more).