20603
CVEs
2694
Critical
11570
High
420
KEV
2200
PoC
5392
Unpatched C/H
61.4%
Patch Rate
6.8%
Avg EPSS
Severity Breakdown
CRITICAL
2694
HIGH
11570
MEDIUM
5986
LOW
346
Monthly CVE Trend
Affected Products (30)
Windows Server 2016
4942
Windows Server 2019
4718
Windows Server 2012
4033
Windows Server 2022
3196
Windows Server 2008
3091
Windows 10
2872
Windows 8 1
2102
Windows 7
2087
Windows 10 1809
2052
Windows 10 22h2
2018
Windows 10 21h2
2006
Windows Rt 8 1
1940
Windows 10 1607
1788
Windows Server 2025
1779
Windows 11 23h2
1638
Windows 11 22h2
1511
Windows 11 24h2
1334
Windows Server 2022 23h2
1311
Windows
1234
Windows 10 1507
1102
Internet Explorer
988
Windows 11 21H2
973
Flash Player
760
Office
748
Edge
725
Windows 11 25h2
643
365 Apps
614
Windows 11 26h1
509
Sharepoint Server
502
Windows 11
495
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2017-7269 | Remote code execution in Microsoft IIS 6.0 WebDAV service allows unauthenticated attackers to execute arbitrary code by sending a specially crafted PROPFIND request with a malicious 'If' header. Confirmed actively exploited (CISA KEV) since July-August 2016, predating public disclosure by 7+ months. EPSS score of 94.43% (100th percentile) reflects widespread exploitation against legacy Windows Server 2003 R2 systems still exposed to the internet. Multiple public exploits exist including Metasploit modules, and vendor patch has been available since March 2017. | CRITICAL | 9.8 | 94.4% | 238 |
KEV
PoC
|
| CVE-2015-5119 | Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitrary code via crafted Flash content exploiting a use-after-free flaw in the ByteArray class. Confirmed actively exploited (CISA KEV) in July 2015 following the Hacking Team data breach, which exposed weaponized exploit code targeting this vulnerability. With EPSS score of 93.21% (100th percentile) and publicly available proof-of-concept, this represents critical risk to unpatched Flash installations across Windows, OS X, and Linux platforms. Vendor-released patches available via Adobe APSB15-16. | CRITICAL | 9.8 | 93.2% | 237 |
KEV
PoC
|
| CVE-2015-3113 | Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in June 2015 by APT3 (a Chinese cyber espionage group) in phishing campaigns targeting aerospace and defense organizations. | CRITICAL | 9.8 | 92.4% | 236 |
KEV
PoC
|
| CVE-2011-2462 | Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote code execution, exploited as a zero-day in December 2011 through crafted PDF files. | CRITICAL | 9.8 | 91.9% | 236 |
KEV
PoC
No patch
|
| CVE-2020-0796 | A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 10.0 | 99.8% | 235 |
KEV
PoC
|
| CVE-2021-34473 | Microsoft Exchange Server contains a pre-authentication SSRF vulnerability known as 'ProxyShell' that allows unauthenticated attackers to access Exchange backend services and achieve remote code execution when chained with CVE-2021-34523 and CVE-2021-31207. | CRITICAL | 9.1 | 94.2% | 235 |
KEV
PoC
|
| CVE-2025-53770 | Microsoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over the network, with active exploitation confirmed and patches pending full release. | CRITICAL | 9.8 | 90.5% | 235 |
KEV
PoC
No patch
|
| CVE-2021-26855 | Microsoft Exchange Server contains a server-side request forgery (SSRF) vulnerability known as 'ProxyLogon' that allows unauthenticated attackers to access Exchange backend services, chain with other vulnerabilities for full server compromise. The most impactful Exchange vulnerability in history. | CRITICAL | 9.1 | 94.0% | 234 |
KEV
PoC
|
| CVE-2021-34523 | Microsoft Exchange Server contains a privilege escalation vulnerability in the PowerShell backend that allows authenticated Exchange users to escalate to Exchange admin, the second component of the ProxyShell attack chain. | CRITICAL | 9.0 | 93.9% | 234 |
KEV
PoC
|
| CVE-2021-38647 | Open Management Infrastructure Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 99.7% | 234 |
KEV
PoC
|
| CVE-2021-40444 | Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX controls in Office documents, exploited as a zero-day in targeted attacks before the September 2021 patch. | HIGH | 8.8 | 94.3% | 233 |
KEV
PoC
|
| CVE-2012-0158 | Remote code execution in Microsoft MSCOMCTL.OCX ActiveX controls allows unauthenticated attackers to execute arbitrary code via maliciously crafted Office documents, RTF files, or web pages. Actively exploited since April 2012 and confirmed in CISA KEV catalog. Despite being patched in 2012, EPSS score of 94.32% (100th percentile) indicates continued exploitation attempts against unpatched systems. Affects broad Microsoft product ecosystem including Office 2003-2010, SQL Server 2000-2008 R2, BizTalk, Commerce Server, Visual FoxPro, and Visual Basic 6.0 Runtime. | HIGH | 8.8 | 94.3% | 233 |
KEV
PoC
|
| CVE-2017-0144 | Remote code execution in Microsoft SMBv1 allows authenticated network attackers to execute arbitrary code on Windows systems via crafted packets. This vulnerability (part of the MS17-010 bulletin and known as 'EternalBlue') is confirmed actively exploited (CISA KEV) with EPSS score of 94.32%, indicating near-certain exploitation probability. Widely weaponized in 2017 WannaCry and NotPetya ransomware campaigns. Affects Windows Vista through Windows 10 1607 and Windows Server 2008-2016, plus Siemens medical imaging systems running vulnerable Windows embedded OS. Multiple public exploits available including DOUBLEPULSAR payload delivery framework. | HIGH | 8.8 | 94.3% | 233 |
KEV
PoC
|
| CVE-2011-0611 | Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute arbitrary code via malicious SWF content, actively exploited in targeted attacks in April 2011. | HIGH | 8.8 | 93.6% | 233 |
KEV
PoC
|
| CVE-2014-0322 | Internet Explorer 9 and 10 contain a use-after-free vulnerability in CMarkup object handling exploitable via crafted JavaScript, used in 'Operation SnowMan' watering hole attacks targeting US military and defense in early 2014. | HIGH | 8.8 | 93.2% | 232 |
KEV
PoC
|