CVE Tracker
Top older CVEs (2015–2025)
Old vulnerabilities that attackers still use. Ranked by the estimated chance of exploitation in the next 30 days.
EPSS is likelihood, a statistical probability, not a certainty. KEV means CISA has confirmed exploitation. PoC ref means NVD lists an exploit-tagged link for the CVE, or ThreatWire marks a PoC. Links are unverified and ThreatWire has not run any of them.
Sources: FIRST EPSS, NVD and the CISA KEV catalogue. EPSS scores of 16 Oct 2026. Data last updated 17 Oct 2026. Covers every older CVE in KEV plus older CVEs with EPSS of 90% or more; CVSS fills in over the next daily updates, and "No CVSS" means NVD data is not loaded yet. Search the full tracker
Top 50 by EPSS
Microsoft SharePoint. Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Ivanti Virtual Traffic Manager. Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
Palo Alto Networks PAN-OS. Palo Alto Networks PAN-OS Command Injection Vulnerability
Jenkins Jenkins Command Line Interface (CLI). Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Ivanti Connect Secure, Policy Secure, and Neurons. Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
Ivanti Connect Secure and Policy Secure. Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
Citrix NetScaler ADC and NetScaler Gateway. Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
IETF HTTP/2. HTTP/2 Rapid Reset Attack Vulnerability
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core. Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
Ivanti Endpoint Manager Mobile (EPMM). Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
Ignite Realtime Openfire. Ignite Realtime Openfire Path Traversal Vulnerability
PaperCut MF/NG. PaperCut MF/NG Improper Access Control Vulnerability
Atlassian Confluence Data Center and Server. Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
Sophos Web Appliance. Sophos Web Appliance Command Injection Vulnerability
TP-Link Archer AX21. TP-Link Archer AX-21 Command Injection Vulnerability
Fortra GoAnywhere MFT. Fortra GoAnywhere MFT Remote Code Execution Vulnerability
WSO2 Multiple Products. WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
Atlassian Confluence Server/Data Center. Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Apache Log4j2. Apache Log4j2 Remote Code Execution Vulnerability
Apache Apache. Apache HTTP Server-Side Request Forgery (SSRF)
ForgeRock Access Management (AM). ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
Microsoft Exchange Server. Microsoft Exchange Server Remote Code Execution Vulnerability
Atlassian Jira Server and Data Center. Atlassian Jira Server and Data Center Path Traversal Vulnerability
Atlassian Confluence Server and Data Center. Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
VMware vCenter Server. VMware vCenter Server File Upload Vulnerability
VMware vCenter Server. VMware vCenter Server Improper Input Validation Vulnerability
Cisco HyperFlex HX. Cisco HyperFlex HX Data Platform Command Injection Vulnerability
F5 BIG-IP. F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
Ivanti Pulse Connect Secure. Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
Microsoft Remote Desktop Services. Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Fortinet FortiOS. Fortinet FortiOS SSL VPN Path Traversal Vulnerability
PHPUnit PHPUnit. PHPUnit Command Injection Vulnerability
Apache Struts. Apache Struts Remote Code Execution Vulnerability
Microsoft HTTP.sys. Microsoft HTTP.sys Remote Code Execution Vulnerability
VMware Workspace ONE Access and Identity Manager. VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
Hikvision Multiple Products. Hikvision Multiple Products Improper Authentication Vulnerability
D-Link Multiple NAS Devices. D-Link Multiple NAS Devices Command Injection Vulnerability
Oracle WebLogic Server. Oracle WebLogic Server Remote Code Execution Vulnerability
Microsoft Exchange Server. Microsoft Exchange Server Remote Code Execution Vulnerability
D-Link Multiple Routers. D-Link Multiple Routers Command Injection Vulnerability
Microsoft SharePoint. Microsoft SharePoint Code Injection Vulnerability
CWP Control Web Panel. CWP Control Web Panel OS Command Injection Vulnerability
Adobe Commerce and Magento Open Source. Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
Oracle WebLogic Server. Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Langflow Langflow. Langflow Missing Authentication Vulnerability
DrayTek Multiple Vigor Routers. Multiple DrayTek Vigor Routers Web Management Page Vulnerability
Ivanti Endpoint Manager (EPM). Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Apache HTTP Server. Apache HTTP Server Path Traversal Vulnerability
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). Cisco ASA and FTD Read-Only Path Traversal Vulnerability