Aggregating NVD, CVE, and multi-source threat feeds, this list provides deep analysis of high-risk threats such as RCE. By integrating CVSS and EPSS models, the system dynamically tracks Exp (Exploit) resources and PoC availability to accurately assess Exploitability. Combined with official Patches and remediation strategies, it helps prioritize Vulnerability Management workflows, significantly shortening response cycles and securing your critical assets.
Assigner (CNA / source)：[email protected] Remove this filter
| CVE | Description | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|
| CVE-2021-34527 KEV | <p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>UPDATE July 7, 2021: The security update for Windows Server 2012, Windows Server 2016 and Windows 10, Version 1607 have been released. | 8.8 | 99.76% | 2021-07-02 | 2026-06-16 |
| CVE-2021-38647 KEV | Open Management Infrastructure Remote Code Execution Vulnerability | 9.8 | 99.72% | 2021-09-15 | 2026-06-17 |
| CVE-2021-31166 KEV | HTTP Protocol Stack Remote Code Execution Vulnerability | 9.8 | 99.72% | 2021-05-11 | 2026-06-16 |
| CVE-2017-0147 KEV | The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability." | 7.5 | 99.69% | 2017-03-16 | 2026-06-16 |
| CVE-2023-29357 KEV | Microsoft SharePoint Server Elevation of Privilege Vulnerability | 9.8 | 99.62% | 2023-06-13 | 2026-06-17 |
| CVE-2020-1472 KEV | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is ad | 5.5 | 99.51% | 2020-08-17 | 2026-06-16 |
| CVE-2022-30190 KEV | A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system | 7.8 | 99.37% | 2022-06-01 | 2026-06-17 |
| CVE-2017-0148 KEV | The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146. | 8.1 | 99.37% | 2017-03-16 | 2026-06-16 |
| CVE-2017-0144 KEV | The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148. | 8.8 | 99.23% | 2017-03-16 | 2026-06-16 |
| CVE-2020-0646 KEV | A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'. | 9.8 | 99.19% | 2020-01-14 | 2026-06-16 |
| CVE-2023-36884 KEV | Windows Search Remote Code Execution Vulnerability | 7.5 | 99.08% | 2023-07-11 | 2026-06-17 |
| CVE-2020-0618 KEV | A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'. | 8.8 | 99.05% | 2020-02-11 | 2026-06-16 |
| CVE-2008-4250 KEV | The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability." | 9.8 | 98.75% | 2008-10-23 | 2026-06-16 |
| CVE-2024-29059 KEV | .NET Framework Information Disclosure Vulnerability | 7.5 | 98.62% | 2024-03-22 | 2026-06-17 |
| CVE-2009-1122 | The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535. | 7.5 | 98.45% | 2009-06-10 | 2026-06-16 |
| CVE-2009-1535 | The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulner | 7.5 | 98.11% | 2009-06-10 | 2026-06-16 |
| CVE-2021-33766 KEV | Microsoft Exchange Server Information Disclosure Vulnerability | 7.3 | 97.50% | 2021-07-14 | 2026-06-16 |
| CVE-2023-23397 KEV | Microsoft Outlook Elevation of Privilege Vulnerability | 9.8 | 97.41% | 2023-03-14 | 2026-06-17 |
| CVE-2015-1641 KEV | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability." | 7.8 | 97.33% | 2015-04-14 | 2026-06-16 |
| CVE-2015-0014 | Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows Telnet Service Buffer Overflow Vulnerability." | 10.0 | 96.89% | 2015-01-13 | 2026-06-16 |