Azmir CVE · Critical

CVE-2026-97229 - gitlab gitlab

Tue, 13 Oct 2026 00:00:00 +0000

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.273 (percentile 0.9806) Vendor: gitlab Product: gitlab CISA KEV: Listed

CVE-2026-105134 - ahsay cloud_backup_suite

Sun, 04 Oct 2026 00:00:00 +0000

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.81763 (percentile 0.99645) Vendor: ahsay Product: cloud_backup_suite CISA KEV: Listed

CVE-2026-93952 - arista velocloud_orchestrator

Tue, 22 Sep 2026 00:00:00 +0000

CVE-2026-76460 - cisco identity_services_engine

Wed, 16 Sep 2026 00:00:00 +0000

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.75599 (percentile 0.9952) Vendor: cisco Product: identity_services_engine CISA KEV: Listed

CVE-2026-85706 - gitlab gitlab

Sat, 12 Sep 2026 00:00:00 +0000

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.97355 (percentile 0.99898) Vendor: gitlab Product: gitlab CISA KEV: Listed

CVE-2026-75650 - adobe commerce

Mon, 07 Sep 2026 00:00:00 +0000

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.03949 (percentile 0.90416) Vendor: adobe Product: commerce CISA KEV: Listed

CVE-2026-83548 - sonicwall sma8200v

Tue, 01 Sep 2026 00:00:00 +0000

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.08043 (percentile 0.94788) Vendor: sonicwall Product: sma8200v CISA KEV: Listed

CVE-2026-72898 - metabase metabase

Mon, 10 Aug 2026 00:00:00 +0000

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.98809 (percentile 0.99927) Vendor: metabase Product: metabase CISA KEV: Listed

CVE-2026-5430 - wso2 api_control_plane

Thu, 06 Aug 2026 00:00:00 +0000

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.2239 (percentile 0.97695) Vendor: wso2 Product: api_control_plane CISA KEV: Listed

CVE-2026-16812 - arista velocloud_orchestrator

Mon, 27 Jul 2026 00:00:00 +0000

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.0176 (percentile 0.77999) Vendor: arista Product: velocloud_orchestrator CISA KEV: Listed

CVE-2026-15409 - sonicwall sma6210_firmware

Tue, 14 Jul 2026 00:00:00 +0000

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.06795 (percentile 0.94002) Vendor: sonicwall Product: sma6210_firmware CISA KEV: Listed

CVE-2026-48282 - adobe coldfusion

Tue, 30 Jun 2026 00:00:00 +0000

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.42388 (percentile 0.98704) Vendor: adobe Product: coldfusion CISA KEV: Listed

CVE-2026-49869 - kestra kestra

Fri, 26 Jun 2026 00:00:00 +0000

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.02095 (percentile 0.81662) Vendor: kestra Product: kestra CISA KEV: Listed

CVE-2026-48558 - simple-help simplehelp

Fri, 12 Jun 2026 00:00:00 +0000

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.77659 (percentile 0.99564) Vendor: simple-help Product: simplehelp CISA KEV: Listed

CVE-2026-10520 - ivanti standalone_sentry

Tue, 09 Jun 2026 00:00:00 +0000

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.99915 (percentile 0.99968) Vendor: ivanti Product: standalone_sentry CISA KEV: Listed

CVE-2026-34908 - ui unifi_os_server

Fri, 22 May 2026 00:00:00 +0000

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.88293 (percentile 0.99769) Vendor: ui Product: unifi_os_server CISA KEV: Listed

CVE-2026-34909 - ui unifi_os_server

Fri, 22 May 2026 00:00:00 +0000

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.68033 (percentile 0.99324) Vendor: ui Product: unifi_os_server CISA KEV: Listed

CVE-2026-34910 - ui unifi_os_server

Fri, 22 May 2026 00:00:00 +0000

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.90032 (percentile 0.99794) Vendor: ui Product: unifi_os_server CISA KEV: Listed

CVE-2026-20182 - cisco catalyst_sd-wan_manager

Thu, 14 May 2026 00:00:00 +0000

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.91817 (percentile 0.99816) Vendor: cisco Product: catalyst_sd-wan_manager CISA KEV: Listed

CVE-2026-20131 - cisco secure_firewall_management_center

Wed, 04 Mar 2026 00:00:00 +0000

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.44431 (percentile 0.98764) Vendor: cisco Product: secure_firewall_management_center CISA KEV: Listed

CVE-2026-20079 - cisco secure_firewall_management_center

Wed, 04 Mar 2026 00:00:00 +0000

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.88658 (percentile 0.99774) Vendor: cisco Product: secure_firewall_management_center CISA KEV: Listed

CVE-2026-20127 - cisco catalyst_sd-wan_manager

Wed, 25 Feb 2026 00:00:00 +0000

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.89294 (percentile 0.99783) Vendor: cisco Product: catalyst_sd-wan_manager CISA KEV: Listed

CVE-2026-22769 - dell recoverpoint_for_virtual_machines

Tue, 17 Feb 2026 00:00:00 +0000

Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.13525 (percentile 0.96453) Vendor: dell Product: recoverpoint_for_virtual_machines CISA KEV: Listed

CVE-2026-21962 - oracle http_server

Tue, 20 Jan 2026 00:00:00 +0000

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.73192 (percentile 0.99457) Vendor: oracle Product: http_server CISA KEV: Listed

CVE-2025-52691 - smartertools smartermail

Mon, 29 Dec 2025 00:00:00 +0000

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.85655 (percentile 0.99725) Vendor: smartertools Product: smartermail CISA KEV: Listed

CVE-2025-20393 - cisco asyncos

Wed, 17 Dec 2025 00:00:00 +0000

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.32392 (percentile 0.98331) Vendor: cisco Product: asyncos CISA KEV: Listed

CVE-2025-55182 - facebook react

Wed, 03 Dec 2025 00:00:00 +0000

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.99802 (percentile 0.99958) Vendor: facebook Product: react CISA KEV: Listed

CVE-2025-43300 - apple ipados

Thu, 21 Aug 2025 00:00:00 +0000

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.65159 (percentile 0.99253) Vendor: apple Product: ipados CISA KEV: Listed

CVE-2025-54253 - adobe experience_manager_forms

Tue, 05 Aug 2025 00:00:00 +0000

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.8877 (percentile 0.99775) Vendor: adobe Product: experience_manager_forms CISA KEV: Listed

CVE-2025-20337 - cisco identity_services_engine

Wed, 16 Jul 2025 00:00:00 +0000

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.74499 (percentile 0.99496) Vendor: cisco Product: identity_services_engine CISA KEV: Listed

CVE-2025-47812 - wftpserver wing_ftp_server

Thu, 10 Jul 2025 00:00:00 +0000

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.93884 (percentile 0.99844) Vendor: wftpserver Product: wing_ftp_server CISA KEV: Listed

CVE-2025-20281 - cisco identity_services_engine

Wed, 25 Jun 2025 00:00:00 +0000

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.97601 (percentile 0.99902) Vendor: cisco Product: identity_services_engine CISA KEV: Listed

CVE-2025-32975 - quest kace_systems_management_appliance

Tue, 24 Jun 2025 00:00:00 +0000

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.02487 (percentile 0.84625) Vendor: quest Product: kace_systems_management_appliance CISA KEV: Listed

CVE-2025-32432 - craftcms craft_cms

Fri, 25 Apr 2025 00:00:00 +0000

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.99792 (percentile 0.99957) Vendor: craftcms Product: craft_cms CISA KEV: Listed

CVE-2025-34028 - commvault commvault

Tue, 22 Apr 2025 00:00:00 +0000

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.97604 (percentile 0.99902) Vendor: commvault Product: commvault CISA KEV: Listed

CVE-2025-32433 - cisco confd_basic

Wed, 16 Apr 2025 00:00:00 +0000

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.98924 (percentile 0.99928) Vendor: cisco Product: confd_basic CISA KEV: Listed

CVE-2025-24201 - apple safari

Tue, 11 Mar 2025 00:00:00 +0000

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.). Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.03847 (percentile 0.90137) Vendor: apple Product: safari CISA KEV: Listed

CVE-2025-24085 - apple ipados

Mon, 27 Jan 2025 00:00:00 +0000

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.1751 (percentile 0.97137) Vendor: apple Product: ipados CISA KEV: Listed

CVE-2024-4040 - crushftp crushftp

Mon, 22 Apr 2024 00:00:00 +0000

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.99539 (percentile 0.99946) Vendor: crushftp Product: crushftp CISA KEV: Listed

CVE-2024-3400 - paloaltonetworks pan-os

Fri, 12 Apr 2024 00:00:00 +0000

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.99999 (percentile 1) Vendor: paloaltonetworks Product: pan-os CISA KEV: Listed

CVE-2024-1709 - connectwise screenconnect

Wed, 21 Feb 2024 00:00:00 +0000

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.9998 (percentile 0.9998) Vendor: connectwise Product: screenconnect CISA KEV: Listed

CVE-2023-20198 - cisco ios_xe

Mon, 16 Oct 2023 00:00:00 +0000

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.99613 (percentile 0.99948) Vendor: cisco Product: ios_xe CISA KEV: Listed

CVE-2022-24816 - geosolutionsgroup jai-ext

Wed, 13 Apr 2022 00:00:00 +0000

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.99929 (percentile 0.99969) Vendor: geosolutionsgroup Product: jai-ext CISA KEV: Listed

CVE-2022-22947 - vmware spring_cloud_gateway

Thu, 03 Mar 2022 00:00:00 +0000

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.98253 (percentile 0.99916) Vendor: vmware Product: spring_cloud_gateway CISA KEV: Listed

CVE-2022-0543 - redis redis

Fri, 18 Feb 2022 00:00:00 +0000

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.99351 (percentile 0.99939) Vendor: redis Product: redis CISA KEV: Listed

CVE-2022-22536 - sap content_server

Wed, 09 Feb 2022 00:00:00 +0000

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.97945 (percentile 0.99909) Vendor: sap Product: content_server CISA KEV: Listed

CVE-2021-44228 - apache log4j

Fri, 10 Dec 2021 00:00:00 +0000

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.99999 (percentile 1) Vendor: apache Product: log4j CISA KEV: Listed

CVE-2021-35211 - solarwinds serv-u

Wed, 14 Jul 2021 00:00:00 +0000

Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.9116 (percentile 0.99809) Vendor: solarwinds Product: serv-u CISA KEV: Listed

CVE-2021-22205 - gitlab gitlab

Fri, 23 Apr 2021 00:00:00 +0000

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.99731 (percentile 0.99953) Vendor: gitlab Product: gitlab CISA KEV: Listed

CVE-2021-22893 - ivanti connect_secure

Fri, 23 Apr 2021 00:00:00 +0000

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.47172 (percentile 0.98836) Vendor: ivanti Product: connect_secure CISA KEV: Listed

CVE-2020-14871 - oracle solaris

Wed, 21 Oct 2020 00:00:00 +0000

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.80157 (percentile 0.99617) Vendor: oracle Product: solaris CISA KEV: Listed

CVE-2020-1350 - microsoft windows_server_2008

Tue, 14 Jul 2020 00:00:00 +0000

A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.96721 (percentile 0.99885) Vendor: microsoft Product: windows_server_2008 CISA KEV: Listed

CVE-2020-6287 - sap netweaver_application_server_java

Tue, 14 Jul 2020 00:00:00 +0000

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.94719 (percentile 0.99858) Vendor: sap Product: netweaver_application_server_java CISA KEV: Listed

CVE-2020-2021 - paloaltonetworks pan-os

Mon, 29 Jun 2020 00:00:00 +0000

When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.04362 (percentile 0.91251) Vendor: paloaltonetworks Product: pan-os CISA KEV: Listed

CVE-2020-0796 - microsoft windows_10_1903

Thu, 12 Mar 2020 00:00:00 +0000

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.9981 (percentile 0.99959) Vendor: microsoft Product: windows_10_1903 CISA KEV: Listed

CVE-2019-11708 - mozilla firefox

Tue, 23 Jul 2019 00:00:00 +0000

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.55874 (percentile 0.99044) Vendor: mozilla Product: firefox CISA KEV: Listed

CVE-2019-11510 - ivanti connect_secure

Wed, 08 May 2019 00:00:00 +0000

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability . Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.99999 (percentile 0.99995) Vendor: ivanti Product: connect_secure CISA KEV: Listed

CVE-2019-7609 - elastic kibana

Mon, 25 Mar 2019 00:00:00 +0000

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.95338 (percentile 0.99866) Vendor: elastic Product: kibana CISA KEV: Listed

CVE-2010-5326 - sap netweaver_application_server_java

Fri, 13 May 2016 00:00:00 +0000

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.1777 (percentile 0.97164) Vendor: sap Product: netweaver_application_server_java CISA KEV: Listed

CVE-2015-3306 - fedoraproject fedora

Mon, 18 May 2015 00:00:00 +0000

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Severity: 10 | CRITICAL (CVSS dbcve.org) EPSS: 0.99497 (percentile 0.99945) Vendor: fedoraproject Product: fedora CISA KEV: Listed

CVE-2026-114625 - arista velocloud_orchestrator

Thu, 22 Oct 2026 00:00:00 +0000

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched. Severity: 9.9 | CRITICAL (CVSS dbcve.org) EPSS: 0.01025 (percentile 0.63573) Vendor: arista Product: velocloud_orchestrator CISA KEV: Listed

CVE-2026-84869 - connectwise screenconnect

Tue, 08 Sep 2026 00:00:00 +0000

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted. Severity: 9.9 | CRITICAL (CVSS dbcve.org) EPSS: 0.00924 (percentile 0.60428) Vendor: connectwise Product: screenconnect CISA KEV: Listed

CVE-2025-20333 - cisco adaptive_security_appliance_software

Thu, 25 Sep 2025 00:00:00 +0000

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device. Severity: 9.9 | CRITICAL (CVSS dbcve.org) EPSS: 0.71207 (percentile 0.99409) Vendor: cisco Product: adaptive_security_appliance_software CISA KEV: Listed

CVE-2025-24016 - wazuh wazuh

Mon, 10 Feb 2025 00:00:00 +0000

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix. Severity: 9.9 | CRITICAL (CVSS dbcve.org) EPSS: 0.9384 (percentile 0.99844) Vendor: wazuh Product: wazuh CISA KEV: Listed

CVE-2024-57726 - simple-help simplehelp

Wed, 15 Jan 2025 00:00:00 +0000

SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role. Severity: 9.9 | CRITICAL (CVSS dbcve.org) EPSS: 0.66414 (percentile 0.99283) Vendor: simple-help Product: simplehelp CISA KEV: Listed

CVE-2023-48365 - qlik qlik_sense

Wed, 15 Nov 2023 00:00:00 +0000

Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265. Severity: 9.9 | CRITICAL (CVSS dbcve.org) EPSS: 0.47733 (percentile 0.98851) Vendor: qlik Product: qlik_sense CISA KEV: Listed

CVE-2023-41265 - qlik qlik_sense

Tue, 29 Aug 2023 00:00:00 +0000

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13. Severity: 9.9 | CRITICAL (CVSS dbcve.org) EPSS: 0.88215 (percentile 0.99767) Vendor: qlik Product: qlik_sense CISA KEV: Listed

CVE-2019-10758 - mongo-express_project mongo-express

Tue, 24 Dec 2019 00:00:00 +0000

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment. Severity: 9.9 | CRITICAL (CVSS dbcve.org) EPSS: 0.84726 (percentile 0.99707) Vendor: mongo-express_project Product: mongo-express CISA KEV: Listed

CVE-2019-1003029 - jenkins script_security

Fri, 08 Mar 2019 00:00:00 +0000

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. Severity: 9.9 | CRITICAL (CVSS dbcve.org) EPSS: 0.7444 (percentile 0.99493) Vendor: jenkins Product: script_security CISA KEV: Listed

CVE-2019-1003030 - jenkins pipeline\

Fri, 08 Mar 2019 00:00:00 +0000

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM. Severity: 9.9 | CRITICAL (CVSS dbcve.org) EPSS: 0.97058 (percentile 0.99891) Vendor: jenkins Product: pipeline\ CISA KEV: Listed

CVE-2026-111497 - nodejs node.js

Thu, 22 Oct 2026 00:00:00 +0000

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.82641 (percentile 0.99667) Vendor: nodejs Product: node.js CISA KEV: Listed

CVE-2026-109618 - php php

Wed, 21 Oct 2026 00:00:00 +0000

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.99999 (percentile 0.99998) Vendor: php Product: php CISA KEV: Listed

CVE-2026-102764 - beyondtrust remote_support

Thu, 15 Oct 2026 00:00:00 +0000

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.1895 (percentile 0.97299) Vendor: beyondtrust Product: remote_support CISA KEV: Listed

CVE-2026-76519 - cisco asyncos

Wed, 14 Oct 2026 00:00:00 +0000

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.02152 (percentile 0.82149) Vendor: cisco Product: asyncos CISA KEV: Listed

CVE-2026-110447 - collabora collabora_online_-_built-in_code_server

Wed, 14 Oct 2026 00:00:00 +0000

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.73307 (percentile 0.99461) Vendor: collabora Product: collabora_online_-_built-in_code_server CISA KEV: Listed

CVE-2026-104286 - fortinet fortimail

Thu, 01 Oct 2026 00:00:00 +0000

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.04573 (percentile 0.9162) Vendor: fortinet Product: fortimail CISA KEV: Listed

CVE-2026-102489 - zammad zammad

Wed, 30 Sep 2026 00:00:00 +0000

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.22478 (percentile 0.97706) Vendor: zammad Product: zammad CISA KEV: Listed

CVE-2026-76504 - cisco catalyst_sd-wan_manager

Wed, 30 Sep 2026 00:00:00 +0000

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.38928 (percentile 0.98589) Vendor: cisco Product: catalyst_sd-wan_manager CISA KEV: Listed

CVE-2026-88771 - citrix netscaler_application_delivery_controller

Sun, 27 Sep 2026 00:00:00 +0000

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.8216 (percentile 0.99655) Vendor: citrix Product: netscaler_application_delivery_controller CISA KEV: Listed

CVE-2026-94127 - f5 big-ip_access_policy_manager

Tue, 22 Sep 2026 00:00:00 +0000

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.2655 (percentile 0.98016) Vendor: f5 Product: big-ip_access_policy_manager CISA KEV: Listed

CVE-2026-93616 - checkpoint multi-domain_security_management

Tue, 22 Sep 2026 00:00:00 +0000

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.91605 (percentile 0.99813) Vendor: checkpoint Product: multi-domain_security_management CISA KEV: Listed

CVE-2026-76461 - cisco asyncos

Mon, 14 Sep 2026 00:00:00 +0000

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.29543 (percentile 0.98188) Vendor: cisco Product: asyncos CISA KEV: Listed

CVE-2026-85102 - checkpoint gaia_embedded

Wed, 09 Sep 2026 00:00:00 +0000

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.5414 (percentile 0.99008) Vendor: checkpoint Product: gaia_embedded CISA KEV: Listed

CVE-2026-86218 - n-able n-central

Sun, 06 Sep 2026 00:00:00 +0000

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.15385 (percentile 0.96785) Vendor: n-able Product: n-central CISA KEV: Listed

CVE-2026-86060 - mikrotik routeros

Sat, 05 Sep 2026 00:00:00 +0000

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.06392 (percentile 0.93671) Vendor: mikrotik Product: routeros CISA KEV: Listed

CVE-2026-82329 - jfrog artifactory

Fri, 28 Aug 2026 00:00:00 +0000

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.14372 (percentile 0.96617) Vendor: jfrog Product: artifactory CISA KEV: Listed

CVE-2026-81578 - papercut papercut_mf

Fri, 28 Aug 2026 00:00:00 +0000

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.84734 (percentile 0.99707) Vendor: papercut Product: papercut_mf CISA KEV: Listed

CVE-2026-60004 - gitea gitea

Wed, 26 Aug 2026 00:00:00 +0000

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.23988 (percentile 0.97841) Vendor: gitea Product: gitea CISA KEV: Listed

CVE-2026-72529 - trueconf trueconf_server

Wed, 19 Aug 2026 00:00:00 +0000

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.01464 (percentile 0.73648) Vendor: trueconf Product: trueconf_server CISA KEV: Listed

CVE-2026-19490 - citrix netscaler_application_delivery_controller

Wed, 19 Aug 2026 00:00:00 +0000

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.32653 (percentile 0.98343) Vendor: citrix Product: netscaler_application_delivery_controller CISA KEV: Listed

CVE-2026-65400 - apple macos

Thu, 06 Aug 2026 00:00:00 +0000

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.01723 (percentile 0.77514) Vendor: apple Product: macos CISA KEV: Listed

CVE-2026-59310 - vmware vcenter_server

Thu, 30 Jul 2026 00:00:00 +0000

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.02565 (percentile 0.85124) Vendor: vmware Product: vcenter_server CISA KEV: Listed

CVE-2026-63077 - jetbrains teamcity

Mon, 27 Jul 2026 00:00:00 +0000

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.93558 (percentile 0.99841) Vendor: jetbrains Product: teamcity CISA KEV: Listed

CVE-2026-16232 - checkpoint multi-domain_security_management

Wed, 22 Jul 2026 00:00:00 +0000

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.03517 (percentile 0.89221) Vendor: checkpoint Product: multi-domain_security_management CISA KEV: Listed

CVE-2026-63030 - wordpress wordpress

Fri, 17 Jul 2026 00:00:00 +0000

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.10649 (percentile 0.95799) Vendor: wordpress Product: wordpress CISA KEV: Listed

CVE-2026-9198 - langflow langflow

Fri, 17 Jul 2026 00:00:00 +0000

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.28658 (percentile 0.98138) Vendor: langflow Product: langflow CISA KEV: Listed

CVE-2026-9586 - sangoma switchvox

Fri, 17 Jul 2026 00:00:00 +0000

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.18979 (percentile 0.97301) Vendor: sangoma Product: switchvox CISA KEV: Listed

CVE-2026-58644 - microsoft sharepoint_server

Tue, 14 Jul 2026 00:00:00 +0000

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.15873 (percentile 0.96887) Vendor: microsoft Product: sharepoint_server CISA KEV: Listed

CVE-2026-56164 - microsoft sharepoint_server

Tue, 14 Jul 2026 00:00:00 +0000

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.01011 (percentile 0.63174) Vendor: microsoft Product: sharepoint_server CISA KEV: Listed

CVE-2026-50522 - microsoft sharepoint_server

Tue, 14 Jul 2026 00:00:00 +0000

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. Severity: 9.8 | CRITICAL (CVSS dbcve.org) EPSS: 0.03042 (percentile 0.87526) Vendor: microsoft Product: sharepoint_server CISA KEV: Listed