CVE-20XX-?
agent?

Drop everything.

Critical CVEs that are confirmed exploited or very likely to be. Newest first.

2,367 CVEs · updated 2026-11-10 15:49 UTC

  1. CVE-2014-2206

    Stack-based buffer overflow in GetGo Download Manager 4.9.0.1982, 4.8.2.1346, 4.4.5.502, and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a long HTTP Response Header.

    Drop everything Memory safety Getgosoft Getgo Download Manager

    10.0 HIGH 61% exploit odds No fix listed
  2. CVE-2013-4710

    Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.

    Drop everything Code execution Device Google Android

    9.3 HIGH 43% exploit odds No fix listed
  3. CVE-2014-0257

    Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint, aka "Type Traversal Vulnerability."

    Drop everything Code execution Server Microsoft .net Framework

    9.3 HIGH 70% exploit odds No fix listed
  4. CVE-2014-0980

    Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI file.

    Drop everything Memory safety Poster Software Publish It

    9.3 HIGH 40% exploit odds Fix listed
  5. CVE-2014-0497

    Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

    Drop everything exploited Code execution OS & kernel Adobe Flash Player

    9.8 CRITICAL 100% exploit odds Fix listed
  6. CVE-2014-0659

    The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data, and execute arbitrary commands, via requests to the test interface on TCP port 32764, aka Bug IDs CSCum37566, CSCum43693, CSCum43700, and CSCum43685.

    Drop everything Injection Network gear Cisco rvs4000 Firmware

    10.0 HIGH 74% exploit odds Fix listed
  7. CVE-2013-6955

    webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.

    Drop everything Code execution Synology Diskstation Manager

    10.0 HIGH 85% exploit odds No fix listed
  8. CVE-2013-2347

    The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary commands or cause a denial of service via a crafted EXEC_BAR packet to TCP port 5555, aka ZDI-CAN-1885.

    Drop everything Code execution HP Storage Data Protector

    10.0 HIGH 66% exploit odds Fix listed
  9. CVE-2013-6194

    Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1905.

    Drop everything Code execution HP Storage Data Protector

    10.0 HIGH 66% exploit odds Fix listed
  10. CVE-2012-0262

    op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter.

    Drop everything Injection op5 Monitor

    10.0 HIGH 73% exploit odds Fix listed
  11. CVE-2012-0261

    license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for an install action.

    Drop everything Injection Web app op5 Monitor

    10.0 HIGH 74% exploit odds Fix listed
  12. CVE-2013-4988

    Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCount value in an ICONDIR structure in an ICO file. NOTE: some of these details are obtained from third party information.

    Drop everything Memory safety Icofx

    9.3 HIGH 67% exploit odds Fix listed
  13. CVE-2013-2751

    Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute arbitrary Perl code via a crafted request, related to the "forgot password workflow."

    Drop everything Injection Network gear Netgear Raidiator

    10.0 HIGH 72% exploit odds Fix listed
  14. CVE-2013-5331

    Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380, and Adobe AIR SDK & Compiler before 3.9.0.1380 allow remote attackers to execute arbitrary code via crafted .swf content that leverages an unspecified "type confusion," as exploited in the wild in December 2013.

    Drop everything Injection OS & kernel Adobe Flash Player

    9.3 HIGH 72% exploit odds Fix listed
  15. CVE-2013-3623

    Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allow remote attackers to execute arbitrary code via the (1) sess_sid or (2) ACT parameter.

    Drop everything Memory safety Device Supermicro Intelligent Platform Management Firmware

    10.0 HIGH 72% exploit odds Fix listed
  16. CVE-2013-4837

    Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1832.

    Drop everything Code execution HP Loadrunner

    10.0 HIGH 63% exploit odds Fix listed
  17. CVE-2013-4822

    Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIMS) allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1606.

    Drop everything Code execution HP Imc Branch Intelligent Management System Software Module

    10.0 HIGH 63% exploit odds Fix listed
  18. CVE-2013-2578

    cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the ServerName parameter and (2) other unspecified parameters.

    Drop everything Injection Device TP-Link tl-sc3130

    10.0 HIGH 74% exploit odds No fix listed
  19. CVE-2013-3128

    The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5, allow remote attackers to execute arbitrary code via a crafted OpenType font (OTF) file, aka "OpenType Font Parsing Vulnerability."

    Drop everything Code execution OS & kernel Microsoft Windows 7

    9.3 HIGH 50% exploit odds Fix listed
  20. CVE-2013-2068

    Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.

    Drop everything Disclosure Server Redhat Cloudforms Management Engine

    9.4 HIGH 59% exploit odds Fix listed
  21. CVE-2013-5486

    Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036. NOTE: this can be leveraged to execute arbitrary commands by using the JBoss autodeploy functionality.

    Drop everything Injection Network gear Cisco Prime Data Center Network Manager

    10.0 HIGH 76% exploit odds Fix listed
  22. CVE-2013-4810

    HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874.

    Drop everything exploited Injection HP Application Lifecycle Management

    9.8 CRITICAL 79% exploit odds Fix listed
  23. CVE-2013-4811

    UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.

    Drop everything Code execution Server HP Identity Driven Manager

    10.0 HIGH 71% exploit odds Fix listed
  24. CVE-2013-4812

    UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.

    Drop everything Code execution Server HP Identity Driven Manager

    10.0 HIGH 52% exploit odds Fix listed
  25. CVE-2013-3205

    Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

    Drop everything Memory safety Browser & mail Microsoft Internet Explorer

    9.3 HIGH 66% exploit odds No fix listed
  26. CVE-2013-4983

    The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to end-user/index.php.

    Drop everything Injection Web app Sophos Web Appliance Firmware

    10.0 HIGH 90% exploit odds Fix listed
  27. CVE-2013-3346

    Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2721, CVE-2013-2722, CVE-2013-2723, CVE-2013-2725, CVE-2013-2726, CVE-2013-2731, CVE-2013-2732, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, and CVE-2013-3341.

    Drop everything exploited Memory safety Adobe Acrobat

    9.8 CRITICAL 79% exploit odds Fix listed
  28. CVE-2013-3184

    Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

    Drop everything Memory safety Browser & mail Microsoft Internet Explorer

    9.3 HIGH 58% exploit odds No fix listed
  29. CVE-2013-1710

    The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation.

    Drop everything XSS Browser & mail Mozilla Seamonkey

    10.0 HIGH 42% exploit odds Fix listed
  30. CVE-2013-5019

    Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resource name in an HTTP request.

    Drop everything Memory safety Vector Ultra Mini Httpd

    10.0 HIGH 64% exploit odds No fix listed
  31. CVE-2013-2367

    Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1678.

    Drop everything Code execution HP Sitescope

    10.0 HIGH 69% exploit odds Fix listed
  32. CVE-2013-4798

    Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1705.

    Drop everything Code execution HP Loadrunner

    10.0 HIGH 67% exploit odds Fix listed
  33. CVE-2013-2251

    Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

    Drop everything exploited Code execution Web app Apache Archiva

    9.8 CRITICAL 100% exploit odds Fix listed
  34. CVE-2013-2134

    Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.

    Drop everything Injection Web app Apache Struts

    9.3 HIGH 70% exploit odds Fix listed
  35. CVE-2013-1965

    Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

    Drop everything Injection Web app Apache Struts

    9.3 HIGH 94% exploit odds Fix listed
  36. CVE-2013-1966

    Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

    Drop everything Injection Web app Apache Struts

    9.3 HIGH 74% exploit odds Fix listed
  37. CVE-2013-4784

    The HP Integrated Lights-Out (iLO) BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.

    Drop everything Auth & access Device HP Integrated lights-out Bmc

    10.0 HIGH 50% exploit odds No fix listed
  38. CVE-2013-2343

    Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1510.

    Drop everything Code execution HP Lefthand p4000 Virtual San Appliance

    10.0 HIGH 62% exploit odds Fix listed
  39. CVE-2013-2465

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

    Drop everything exploited Other Oracle Jre

    9.8 CRITICAL 99% exploit odds Fix listed
  40. CVE-2013-2460

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component.

    Drop everything Other Library Oracle Jre

    9.3 HIGH 70% exploit odds Fix listed
  41. CVE-2013-3576

    ginkgosnmp.inc in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en.

    Drop everything Injection Web app HP System Management Homepage

    9.0 HIGH 67% exploit odds No fix listed
  42. CVE-2013-2325

    Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1633.

    Drop everything Code execution HP Storage Data Protector

    10.0 HIGH 61% exploit odds Fix listed
  43. CVE-2013-2326

    Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1634.

    Drop everything Code execution HP Storage Data Protector

    10.0 HIGH 61% exploit odds Fix listed
  44. CVE-2013-2327

    Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1635.

    Drop everything Code execution HP Storage Data Protector

    10.0 HIGH 61% exploit odds Fix listed
  45. CVE-2013-2328

    Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1636.

    Drop everything Code execution HP Storage Data Protector

    10.0 HIGH 61% exploit odds Fix listed
  46. CVE-2013-2329

    Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1637.

    Drop everything Code execution HP Storage Data Protector

    10.0 HIGH 61% exploit odds Fix listed
  47. CVE-2013-2330

    Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1638.

    Drop everything Code execution HP Storage Data Protector

    10.0 HIGH 61% exploit odds Fix listed
  48. CVE-2013-2331

    Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1652.

    Drop everything Code execution HP Storage Data Protector

    10.0 HIGH 61% exploit odds Fix listed
  49. CVE-2013-2332

    Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1654.

    Drop everything Code execution HP Storage Data Protector

    10.0 HIGH 61% exploit odds Fix listed
  50. CVE-2013-2333

    Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1680.

    Drop everything Code execution HP Storage Data Protector

    10.0 HIGH 90% exploit odds Fix listed

A CVE is listed as major when it is critical (CVSS 9.0 or higher) and either confirmed exploited in the wild with a real chance of more, or very likely to be exploited (EPSS 40% or more).