Verdict

Weaponised and widely attempted

Reliable public exploit code exists, or mass exploitation attempts are probable. Patch inside days, not weeks. 637 vulnerabilities in this band.

Catalogue refreshed today

All 1,655 Used in ransomware 332 Weaponised 637 Confirmed exploited 686

CVE-2020-2555 Oracle Multiple Products Remote Code Execution Vulnerability Oracle · Multiple Products Weaponised CVSS 9.8 EPSS 97% 03 Nov 2021
CVE-2012-3152 Oracle Fusion Middleware Unspecified Vulnerability Oracle · Fusion Middleware Weaponised CVSS 9.1 EPSS 99% 03 Nov 2021
CVE-2020-14871 Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability Oracle · Solaris and Zettabyte File System (ZFS) Weaponised CVSS 10 EPSS 80% 03 Nov 2021
CVE-2015-4852 Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability Oracle · WebLogic Server Weaponised CVSS 9.8 EPSS 96% 03 Nov 2021
CVE-2020-14750 Oracle WebLogic Server Remote Code Execution Vulnerability Oracle · WebLogic Server Weaponised CVSS 9.8 EPSS 99% 03 Nov 2021
CVE-2020-14882 Oracle WebLogic Server Remote Code Execution Vulnerability Oracle · WebLogic Server Weaponised CVSS 9.8 EPSS 100% 03 Nov 2021
CVE-2020-14883 Oracle WebLogic Server Unspecified Vulnerability Oracle · WebLogic Server Weaponised CVSS 7.2 EPSS 98% 03 Nov 2021
CVE-2020-8644 PlaySMS Server-Side Template Injection Vulnerability PlaySMS · PlaySMS Weaponised CVSS 9.8 EPSS 87% 03 Nov 2021
CVE-2020-8243 Ivanti Pulse Connect Secure Code Execution Vulnerability Ivanti · Pulse Connect Secure Weaponised CVSS 7.2 EPSS 91% 03 Nov 2021
CVE-2020-8260 Ivanti Pulse Connect Secure Code Execution Vulnerability Ivanti · Pulse Connect Secure Weaponised CVSS 7.2 EPSS 96% 03 Nov 2021
CVE-2021-35395 Realtek AP-Router SDK Buffer Overflow Vulnerability Realtek · AP-Router SDK Weaponised CVSS 9.8 EPSS 98% 03 Nov 2021
CVE-2020-11652 SaltStack Salt Path Traversal Vulnerability SaltStack · Salt Weaponised CVSS 6.5 EPSS 86% 03 Nov 2021
CVE-2020-11651 SaltStack Salt Authentication Bypass Vulnerability SaltStack · Salt Weaponised CVSS 9.8 EPSS 96% 03 Nov 2021
CVE-2020-16846 SaltStack Salt Shell Injection Vulnerability SaltStack · Salt Weaponised CVSS 9.8 EPSS 100% 03 Nov 2021
CVE-2020-6287 SAP NetWeaver Missing Authentication for Critical Function Vulnerability SAP · NetWeaver Weaponised CVSS 10 EPSS 95% 03 Nov 2021
CVE-2020-6207 SAP Solution Manager Missing Authentication for Critical Function Vulnerability SAP · Solution Manager Weaponised CVSS 9.8 EPSS 98% 03 Nov 2021
CVE-2020-10148 SolarWinds Orion Authentication Bypass Vulnerability SolarWinds · Orion Weaponised CVSS 9.8 EPSS 92% 03 Nov 2021
CVE-2020-10199 Sonatype Nexus Repository Remote Code Execution Vulnerability Sonatype · Nexus Repository Weaponised CVSS 8.8 EPSS 99% 03 Nov 2021
CVE-2017-9248 Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability Progress · ASP.NET AJAX and Sitefinity Weaponised CVSS 9.8 EPSS 75% 03 Nov 2021
CVE-2021-31755 Tenda AC11 Router Stack Buffer Overflow Vulnerability Tenda · AC11 Router Weaponised CVSS 9.8 EPSS 86% 03 Nov 2021
CVE-2020-10987 Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability Tenda · AC1900 Router AC15 Model Weaponised CVSS 9.8 EPSS 80% 03 Nov 2021
CVE-2018-20062 ThinkPHP "noneCms" Remote Code Execution Vulnerability ThinkPHP · noneCms Weaponised CVSS 9.8 EPSS 100% 03 Nov 2021
CVE-2019-9082 ThinkPHP Remote Code Execution Vulnerability ThinkPHP · ThinkPHP Weaponised CVSS 8.8 EPSS 97% 03 Nov 2021
CVE-2019-20085 TVT NVMS-1000 Directory Traversal Vulnerability TVT · NVMS-1000 Weaponised CVSS 7.5 EPSS 96% 03 Nov 2021
CVE-2020-5849 Unraid Authentication Bypass Vulnerability Unraid · Unraid Weaponised CVSS 7.5 EPSS 93% 03 Nov 2021
CVE-2020-5847 Unraid Remote Code Execution Vulnerability Unraid · Unraid Weaponised CVSS 9.8 EPSS 96% 03 Nov 2021
CVE-2019-16759 vBulletin PHP Module Remote Code Execution Vulnerability vBulletin · vBulletin Weaponised CVSS 9.8 EPSS 100% 03 Nov 2021
CVE-2020-17496 vBulletin PHP Module Remote Code Execution Vulnerability vBulletin · vBulletin Weaponised CVSS 9.8 EPSS 88% 03 Nov 2021
CVE-2020-3950 VMware Multiple Products Privilege Escalation Vulnerability VMware · Multiple Products Weaponised CVSS 7.8 EPSS 7% 03 Nov 2021
CVE-2020-3952 VMware vCenter Server Information Disclosure Vulnerability VMware · vCenter Server Weaponised CVSS 9.8 EPSS 90% 03 Nov 2021
CVE-2020-25213 WordPress File Manager Plugin Remote Code Execution Vulnerability WordPress · File Manager Plugin Weaponised CVSS 10 EPSS 97% 03 Nov 2021
CVE-2020-11738 WordPress Snap Creek Duplicator Plugin File Download Vulnerability WordPress · Snap Creek Duplicator Plugin Weaponised CVSS 7.5 EPSS 98% 03 Nov 2021
CVE-2019-9978 WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability WordPress · Social Warfare Plugin Weaponised CVSS 6.1 EPSS 73% 03 Nov 2021
CVE-2021-27561 Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability Yealink · Device Management Weaponised CVSS 9.8 EPSS 83% 03 Nov 2021
CVE-2020-10189 Zoho ManageEngine Desktop Central File Upload Vulnerability Zoho · ManageEngine Weaponised CVSS 9.8 EPSS 100% 03 Nov 2021
CVE-2019-8394 Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability Zoho · ManageEngine Weaponised CVSS 6.5 EPSS 64% 03 Nov 2021
CVE-2020-29583 Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability Zyxel · Multiple Products Weaponised CVSS 9.8 EPSS 90% 03 Nov 2021