Skip to content
Noroxi

Türkiye-KEV

Türkiye-KEV

Vulnerabilities referenced in Türkiye's national advisories (USOM), most critical first. Ranked by our action score: CISA KEV (actively exploited in the wild), FIRST EPSS probability and exploit maturity together.

We are not inventing a new list: we rank the national advisories (published by USOM) by exploitation priority and enrich them with our CVE data. Each record links to its own Noroxi page; no exploit code or links are provided.

44,846 records referenced in national advisoriesTop 100 by action score RSSAll advisories (by date) Filter the list (?tr=1)

  • CVE-2025-55182
    100Now

    A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclu

    CriticalCVSS 10.0KEVWeaponizedEPSS 100%

    facebook · reactDec 3, 2025

  • CVE-2024-3400
    100Now

    PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

    CriticalCVSS 10.0KEVWeaponizedEPSS 100%

    paloaltonetworks · pan-osApr 12, 2024

  • CVE-2023-20198
    100Now

    Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software.

    CriticalCVSS 10.0KEVWeaponizedEPSS 100%

    cisco · ios xeOct 16, 2023

  • CVE-2022-0543
    100Now

    It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    redis · redisFeb 18, 2022

  • CVE-2021-44228
    100Now

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    CriticalCVSS 10.0KEVWeaponizedEPSS 100%

    apache · log4jDec 10, 2021

  • CVE-2021-22205
    100Now

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9.

    CriticalCVSS 10.0KEVWeaponizedEPSS 100%

    gitlab · gitlabApr 23, 2021

  • CVE-2020-0796
    100Now

    A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain reque

    CriticalCVSS 10.0KEVWeaponizedEPSS 100%

    microsoft · windows 10 1903Mar 12, 2020

  • CVE-2019-11510
    100Now

    In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attack

    CriticalCVSS 10.0KEVWeaponizedEPSS 100%

    ivanti · connect secureMay 8, 2019

  • CVE-2026-1340
    99Now

    A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    ivanti · endpoint manager mobileJan 29, 2026

  • CVE-2026-1281
    99Now

    A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    ivanti · endpoint manager mobileJan 29, 2026

  • CVE-2025-59287
    99Now

    Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    microsoft · windows server 2012Oct 14, 2025

  • CVE-2025-61882
    99Now

    Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    oracle · concurrent processingOct 5, 2025

  • CVE-2025-10035
    99Now

    Deserialization Vulnerability in GoAnywhere MFT's License Servlet

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    fortra · goanywhere managed file transferSep 18, 2025

  • CVE-2025-53770
    99Now

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    microsoft · sharepoint serverJul 19, 2025

  • CVE-2025-20281
    99Now

    Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 98%

    cisco · identity services engineJun 25, 2025

  • CVE-2025-31324
    99Now

    Missing Authorization check in SAP NetWeaver (Visual Composer development server)

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    sap · netweaverApr 24, 2025

  • CVE-2025-22457
    99Now

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    ivanti · connect secureApr 3, 2025

  • CVE-2024-9463
    99Now

    Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

    CriticalCVSS 9.9KEVWeaponizedEPSS 99%

    paloaltonetworks · expeditionOct 9, 2024

  • CVE-2024-45519
    99Now

    The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    synacor · zimbra collaboration suiteOct 2, 2024

  • CVE-2024-7593
    99Now

    Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated a

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    ivanti · virtual traffic managerAug 13, 2024

  • CVE-2024-38856
    99Now

    Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · ofbizAug 5, 2024

  • CVE-2024-34102
    99Now

    XXE can expose crypt key and other secrets granting full admin access

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    adobe · commerceJun 13, 2024

  • CVE-2024-32113
    99Now

    Apache OFBiz: Path traversal leading to RCE

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    apache · ofbizMay 8, 2024

  • CVE-2024-27348
    99Now

    Apache HugeGraph-Server: Command execution in gremlin

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · hugegraphApr 22, 2024

  • CVE-2023-48788
    99Now

    A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    fortinet · forticlient enterprise management serverMar 12, 2024

  • CVE-2023-22527
    99Now

    A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    atlassian · confluence data centerJan 16, 2024

  • CVE-2023-47246
    99Now

    In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat we

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    sysaid · sysaidNov 10, 2023

  • CVE-2023-22518
    99Now

    All versions of Confluence Data Center and Server are affected by this unexploited vulnerability.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    atlassian · confluence data centerOct 31, 2023

  • CVE-2023-46604
    99Now

    Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    apache · activemqOct 27, 2023

  • CVE-2023-34048
    99Now

    VMware vCenter Server Out-of-Bounds Write Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    vmware · vcenter serverOct 25, 2023

  • CVE-2023-22515
    99Now

    Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknow

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    atlassian · confluence data centerOct 4, 2023

  • CVE-2023-42793
    99Now

    In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    jetbrains · teamcitySep 19, 2023

  • CVE-2023-38035
    99Now

    A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass a

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    ivanti · mobileiron sentryAug 21, 2023

  • CVE-2023-35082
    99Now

    An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resou

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    ivanti · endpoint manager mobileAug 15, 2023

  • CVE-2023-35078
    99Now

    An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the appli

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    ivanti · endpoint manager mobileJul 25, 2023

  • CVE-2023-3519
    99Now

    Unauthenticated remote code execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    citrix · netscaler application delivery controllerJul 19, 2023

  • CVE-2023-29300
    99Now

    Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    adobe · coldfusionJul 12, 2023

  • CVE-2023-29357
    99Now

    Microsoft SharePoint Server Elevation of Privilege Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    microsoft · sharepoint serverJun 13, 2023

  • CVE-2023-34362
    99Now

    In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    progress · moveit cloudJun 2, 2023

  • CVE-2023-28771
    99Now

    Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    zyxel · atp100 firmwareApr 24, 2023

  • CVE-2023-27350
    99Now

    This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    papercut · papercut mfApr 20, 2023

  • CVE-2023-1671
    99Now

    A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    sophos · web applianceApr 4, 2023

  • CVE-2022-47966
    99Now

    Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache San

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    zohocorp · manageengine access manager plusJan 18, 2023

  • CVE-2022-42475
    99Now

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    fortinet · fortiosJan 2, 2023

  • CVE-2022-46169
    99Now

    Unauthenticated Command Injection

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    cacti · cactiDec 5, 2022

  • CVE-2022-21587
    99Now

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    oracle · e-business suiteOct 18, 2022

  • CVE-2022-3236
    99Now

    A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    sophos · firewallSep 23, 2022

  • CVE-2022-26134
    99Now

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    atlassian · confluence data centerJun 3, 2022

  • CVE-2022-30525
    99Now

    A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 f

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    zyxel · usg flex 100w firmwareMay 12, 2022

  • CVE-2022-1388
    99Now

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    f5 · big-ip access policy managerMay 5, 2022

  • CVE-2022-22954
    99Now

    VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    vmware · identity managerApr 11, 2022

  • CVE-2022-22965
    99Now

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    vmware · spring frameworkApr 1, 2022

  • CVE-2022-1040
    99Now

    An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    sophos · sfosMar 25, 2022

  • CVE-2022-24086
    99Now

    Adobe Commerce checkout improper input validation leads to remote code execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · commerceFeb 16, 2022

  • CVE-2021-44515
    99Now

    Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in th

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    zohocorp · manageengine desktop centralDec 12, 2021

  • CVE-2021-20038
    99Now

    A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthentic

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    sonicwall · sma 200 firmwareDec 8, 2021

  • CVE-2021-42013
    99Now

    Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    apache · http serverOct 7, 2021

  • CVE-2021-41773
    99Now

    Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    apache · http serverOct 5, 2021

  • CVE-2021-22005
    99Now

    The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    vmware · cloud foundationSep 23, 2021

  • CVE-2021-36260
    99Now

    A command injection vulnerability in the web server of some Hikvision product.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    hikvision · ds-2cd2026g2-iu\/sl firmwareSep 22, 2021

  • CVE-2021-38647
    99Now

    Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    microsoft · azure automation state configurationSep 15, 2021

  • CVE-2021-40539
    99Now

    Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execu

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    zohocorp · manageengine adselfservice plusSep 7, 2021

  • CVE-2021-26084
    99Now

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    atlassian · confluence data centerAug 30, 2021

  • CVE-2021-21985
    99Now

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check pl

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    vmware · vcenter serverMay 26, 2021

  • CVE-2021-1498
    99Now

    Cisco HyperFlex HX Command Injection Vulnerabilities

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    cisco · hyperflex hx data platformMay 6, 2021

  • CVE-2021-1497
    99Now

    Cisco HyperFlex HX Command Injection Vulnerabilities

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    cisco · hyperflex hx data platformMay 6, 2021

  • CVE-2021-22986
    99Now

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    f5 · big-ip access policy managerMar 31, 2021

  • CVE-2021-21972
    99Now

    The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    vmware · cloud foundationFeb 24, 2021

  • CVE-2021-3129
    99Now

    Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of i

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    laravel · laravelJan 12, 2021

  • CVE-2020-13927
    99Now

    The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security ri

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    apache · airflowNov 10, 2020

  • CVE-2020-16846
    99Now

    An issue was discovered in SaltStack Salt through 3002.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    saltstack · saltNov 6, 2020

  • CVE-2020-14882
    99Now

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    oracle · weblogic serverOct 21, 2020

  • CVE-2020-1350
    99Now

    A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows

    CriticalCVSS 10.0KEVWeaponizedEPSS 97%

    microsoft · windows server 2008Jul 14, 2020

  • CVE-2020-5902
    99Now

    In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Inte

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    f5 · big-ip access policy managerJul 1, 2020

  • CVE-2020-10189
    99Now

    Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    zohocorp · manageengine desktop centralMar 6, 2020

  • CVE-2020-9054
    99Now

    ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    zyxel · nas326 firmwareMar 4, 2020

  • CVE-2020-1938
    99Now

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · geodeFeb 24, 2020

  • CVE-2020-8515
    99Now

    DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code executi

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    draytek · vigor2960 firmwareFeb 1, 2020

  • CVE-2020-7247
    99Now

    smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary co

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    openbsd · opensmtpdJan 29, 2020

  • CVE-2019-19781
    99Now

    An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    citrix · application delivery controller firmwareDec 27, 2019

  • CVE-2019-18935
    99Now

    Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    telerik · ui for asp.net ajaxDec 11, 2019

  • CVE-2019-11043
    99Now

    Underflow in PHP-FPM can lead to RCE

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    php · phpOct 28, 2019

  • CVE-2019-16278
    99Now

    Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a c

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    nazgul · nostromo nhttpdOct 14, 2019

  • CVE-2019-16920
    99Now

    Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    dlink · dir-655 firmwareSep 27, 2019

  • CVE-2019-16759
    99Now

    vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring re

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    vbulletin · vbulletinSep 24, 2019

  • CVE-2019-10149
    99Now

    A flaw was found in Exim versions 4.87 to 4.91 (inclusive).

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    exim · eximJun 5, 2019

  • CVE-2018-13379
    99Now

    An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    fortinet · fortiproxyJun 4, 2019

  • CVE-2019-0708
    99Now

    A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    microsoft · windows 7May 16, 2019

  • CVE-2019-2725
    99Now

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    oracle · agile product lifecycle managementApr 26, 2019

  • CVE-2019-0604
    99Now

    A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    microsoft · sharepoint enterprise serverMar 5, 2019

  • CVE-2018-15961
    99Now

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file uploa

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    adobe · coldfusionSep 25, 2018

  • CVE-2017-7494
    99Now

    Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious cli

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    samba · sambaMay 30, 2017

  • CVE-2017-7269
    99Now

    Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows S

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    microsoft · internet information servicesMar 26, 2017

  • CVE-2017-3881
    99Now

    A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthe

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    cisco · iosMar 17, 2017

  • CVE-2017-5638
    99Now

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mes

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    apache · strutsMar 10, 2017

  • CVE-2016-10033
    99Now

    The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail c

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    phpmailer project · phpmailerDec 30, 2016

  • CVE-2013-2465
    99Now

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    oracle · jreJun 18, 2013

  • CVE-2026-20253
    98Now

    Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    splunk · splunkJun 10, 2026

  • CVE-2024-20439
    98Now

    A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by us

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    cisco · smart license utilitySep 4, 2024

  • CVE-2024-4358
    98Now

    Registration Authentication Bypass Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    telerik · report server 2024May 29, 2024