Actively exploited vulnerabilitiesThe CISA KEV catalog lists vulnerabilities that are being exploited in real attacks, not ones that might be. It is the list to start from when deciding what to patch first.

Search · CVE

Search

• CVE-2006-2492High8.8 May 19, 2006

  Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.

  microsoft 2 affected products
• CVE-2006-1547High7.5 Mar 30, 2006

  ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

  apache 2 affected products
• CVE-2005-2773Critical9.8 Sep 2, 2005

  HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.

  hp 1 affected products
• CVE-2004-1464Medium5.9 Dec 31, 2004

  Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reverse Telnet port.

  cisco 1 affected products
• CVE-2004-0210High7.8 Aug 6, 2004

  The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow.

  microsoft 3 affected products
• CVE-2002-0367High7.8 Jun 25, 2002

  smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.

  microsoft 2 affected products
• CVE-2026-0322

  Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
• CVE-2026-96951

  Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

This product uses the NVD API but is not endorsed or certified by the NVD.