Notable CVEs

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an unde

Server-Side Request Forgery (SSRF)

OIDC authentication bypass via unsigned JWT / improper cryptographic signature verification

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downl

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect S

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker control

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus o

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object,

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely har

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatu

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote comm

OS Command Injection RCE

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote a

Insecure deserialization unauthenticated RCE

Microsoft Outlook Remote Code Execution Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.1

SQL Injection via unsanitized Authorization header in proxy API key check

Unauthenticated arbitrary file upload leading to Remote Code Execution (RCE)

Unauthenticated arbitrary file upload leading to Remote Code Execution (RCE)

Deserialization of untrusted data RCE

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonap

Type confusion heap corruption RCE

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary co

Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to af

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/adm

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attacker

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers

The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malic

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. Th

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the mana

Citrix Workspace App before 1904 for Windows has Incorrect Access Control.

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable v

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary comma

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by lever

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

Unauthenticated remote code execution

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the mal

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails t

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exist

Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditi

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This

A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an att

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses Se

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows re

Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via un

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and b

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exe

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), coul

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allow

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code

Deserialization of untrusted data RCE

Unauthenticated Remote Code Execution via Python code injection (exec)

Improper Authentication / Authentication Bypass leading to Unauthenticated RCE

Arbitrary File Upload leading to Remote Code Execution (PHP code upload and execution)

Deserialization of untrusted data RCE (CWE-502 / CWE-20)

SpEL injection / remote code execution via property binder

Missing Authentication for Critical Function (CWE-306) - Unauthenticated arbitrary file create/truncate via PostgreSQL sidecar service endpoint, leading to pre-auth RCE

Missing Authentication for Critical Function (CWE-306) leading to unauthenticated RCE / full takeover via HTTP

Unauthenticated OS Command Injection (CWE-78)

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and

OS Command Injection RCE (unauthenticated, pre-auth) via API command endpoints

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

Microsoft Exchange Server Remote Code Execution Vulnerability

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confi

Microsoft Exchange Server Remote Code Execution Vulnerability

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to in

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests

Microsoft Exchange Server Elevation of Privilege Vulnerability

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenti

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remot

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Authenticated RCE via Jolokia JMX-HTTP bridge — Code Injection through Spring XML remote application context loading (CWE-20, CWE-94, CWE-78)

Microsoft Exchange Server Elevation of Privilege Vulnerability

OS Command Injection (CWE-78)

OS Command Injection

OS Command Injection (CWE-78)

Type Confusion heap corruption RCE

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vu

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; a

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; a

Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption)

Internet Explorer Memory Corruption Vulnerability

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security

Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: H

CORS misconfiguration leading to credential theft, account takeover, and remote code execution

Deserialization of untrusted data RCE (CWE-502)

Command Injection / Arbitrary OS Command Execution (CWE-77, CWE-78) via MCP stdio transport subprocess spawning

Buffer overflow / memory corruption via maliciously crafted web content (CWE-119, CWE-120)

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthe

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote atta

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Secu

Server-Side Request Forgery (SSRF) with privilege escalation to root

Symlink follow / CWE-61 UNIX symbolic link following leading to privilege escalation or path escape on shared hosting (CloudLinux/CageFS bypass)

A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access cert

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to th

Cross-Site Scripting (XSS) leading to spoofing

kernel local privilege escalation / improper resource transfer (out-of-place vs in-place crypto buffer operation)

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users accord

Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a cra

Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unk

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with s

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to re

The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to re

The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. T

Open Management Infrastructure Elevation of Privilege Vulnerability

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

Open Management Infrastructure Elevation of Privilege Vulnerability

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has alre

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBo

Path Traversal (Unauthenticated Arbitrary File Read)

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53

.NET and Visual Studio Denial of Service Vulnerability

The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to c

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to r

A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a d

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows u

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHe

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRA

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an o

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure custom

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Microsoft Publisher Security Feature Bypass Vulnerability

Microsoft Exchange Server Information Disclosure Vulnerability

Improper Input Validation leading to Remote Code Execution

Post-authentication Code Injection RCE (OS Command Execution)

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.

Microsoft Exchange Server Remote Code Execution Vulnerability

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled ob

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to up

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially c

Open Management Infrastructure Elevation of Privilege Vulnerability

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents

Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories wi

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.

Path Traversal / Arbitrary File Write (CWE-22)

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote atta

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower T

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme pas

A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote at

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbo

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for th

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged ac

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker t

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGat

Microsoft Defender Denial of Service Vulnerability

Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allo

Sandbox Escape via Host Object Access (Code Injection)

Missing Authentication for Critical Function (CWE-306) - Unauthenticated REST API Access leading to privilege escalation to Site Admin

Static Password Reset Token / Account Takeover via Replay Attack (CWE-640)

Unauthenticated RCE via exposed MCP bridge endpoint (OS Command Injection / Missing Authentication)

Path Traversal leading to arbitrary code execution (CWE-22)

JSON body parameter injection leading to NoSQL injection (query filter manipulation / unauthenticated data exfiltration and mass update)

Authentication bypass via path traversal in StripPrefix middleware (CWE-288, CWE-22)

Camel message header injection via CoAP URI query parameters leading to RCE (CWE-915 Mass Assignment)

Improper Access Control / Attribute Filter Bypass leading to Arbitrary Code Execution

Path Traversal via URL parameter injection leading to Server-Side Request Forgery (SSRF)

Sandbox escape via incorrect boundary conditions in Graphics WebRender

SQL Injection leading to RCE (JWT secret exfiltration via owner parameter)

Sandbox escape via builtin allowlist bypass leading to RCE

Unrestricted File Upload (Remote Code Execution)

Path Traversal Arbitrary File Write and OS Command Injection RCE via LLM Prompt Injection

Java deserialization RCE via H2 native query OTHER column type

Authenticated RCE and Node VM sandbox escape via Puppeteer/Playwright browser binary path injection (Command Injection)

Server-Side Request Forgery (SSRF) leading to Privilege Escalation

Improper Access Control / Authentication Bypass (Privilege Escalation via Session Forgery)

Git argument injection RCE (CWE-94 - improper handling of user-controlled input in git commands)

Error-based SQL injection via ORDER BY parameter

Case-sensitive header filter bypass leading to remote code execution and arbitrary file write

Remote Command Execution (RCE) via Command Injection (CWE-77)

Unauthenticated arbitrary file read/write via missing authentication on Airserv API (CWE-306)

Insecure Deserialization / Remote Code Execution via pickle.load()

heap-based buffer overflow / buffer over-read in inflate

Unsafe deserialization (pickle.loads) RCE over unauthenticated gRPC

Server-Side Request Forgery (SSRF)

improper pointer arithmetic memory corruption

Fastjson deserialization Remote Code Execution (RCE)

Arbitrary File Upload RCE (CWE-434)

Unrestricted File Upload RCE (CWE-434)

Stack overflow out-of-bounds write (CWE-787) leading to arbitrary code execution in ash shell

SAE side-channel attack via cache access patterns (CWE-203 Observable Discrepancy)

Integer overflow and heap-based buffer overflow in ZIP file creation (CWE-190)

Server Side Request Forgery (SSRF) / Remote File Inclusion (RFI) / Local File Inclusion (LFI)

Improper Access Control - smartcard keys added to ssh-agent without per-hop destination constraints

Arbitrary File Upload leading to Remote Code Execution (RCE)

Missing authentication / unauthenticated remote command execution (CWE-276 incorrect default permissions)

Insecure Permissions / Command Filter Bypass RCE

EAP-pwd side-channel attack via cache access patterns (CWE-203 Observable Timing Discrepancy)

SQL Injection (CWE-89)

SQL Injection

SQL Injection

Unrestricted File Upload (CWE-434)

SQL Injection Authentication Bypass

AST injection via NumberLiteral node leading to Remote Code Execution (RCE)

Dependency Confusion / Uncontrolled Search Path Element (npm package squatting leading to RCE)

OS Command Injection via excessive database privileges (CWE-78)

PHP object deserialization RCE (unserialize)

Server-Side Request Forgery (SSRF) leading to arbitrary code execution via crafted payload

Remote Code Execution via arbitrary code injection (CWE-94)

Arbitrary File Write via Path Traversal (CWE-22)

OS command injection via stdin shell injection (CWE-78)

XML External Entity (XXE) Injection

OS Command Injection via shell metacharacters

SQL Injection (CWE-89)

Sandbox breakout via inspect function leading to arbitrary command execution (RCE)

Default Root Credentials

Prototype Pollution

Privilege Escalation via crafted login script (Improper Privilege Management)

Unsafe Java deserialization RCE via RMI instrumentation endpoint

Unrestricted File Upload leading to Remote Code Execution (CWE-434)

SQL Injection / Command Injection (CWE-89, CWE-78)

Traffic Injection / Improper Verification of Communication Channel Source

Code Injection via protobuf definition "type" field (CWE-94)

Unauthenticated Arbitrary File Upload leading to Remote Code Execution (RCE)

SQL Injection

Out-of-bounds heap write (OOB write) in planar bitmap RLE decoder

Arbitrary File Upload leading to Remote Code Execution

Sandbox escape via async generator yield* expression host exception catch RCE

SQL Injection

SQL Injection (CWE-89) via unsanitised front-end controller task parameter concatenation

AST sandbox escape leading to arbitrary code execution (CWE-94, CWE-913)

Arbitrary File Upload RCE (CWE-434)

JWT algorithm confusion / "alg:none" signature bypass (CWE-347 Improper Verification of Cryptographic Signature)

Account Takeover via Weak/Improper Password Reset (CWE-640)

argument injection via kubectl structured tools (CWE-88)

Cross-Site Scripting (XSS)

Hard-coded / Default Credentials (CWE-798)

Unauthenticated arbitrary file upload leading to Remote Code Execution (RCE)

Unauthenticated Remote Code Execution via unsandboxed GraalVM script evaluation

Remote Code Execution via unvalidated user-supplied model path with trust_remote_code=True

Authentication Bypass (CWE-306) — Missing Authentication for Critical Function on /api/dump and /api/restore endpoints

Unsafe deserialization RCE via dill.loads() in gRPC registry server

Unauthenticated Python pickle deserialization RCE

SCXML eval injection RCE (CWE-95/CWE-94)

Incomplete input validation / unrestricted file upload leading to RCE (authentication bypass + path traversal + PHP extension bypass)

Path traversal leading to unauthenticated remote code execution via malicious file upload

Integer overflow leading to heap memory corruption (RCE / information leak)

Authentication Bypass via Empty API Key Header

Heap buffer overflow (slab-out-of-bounds write) in NFSv4.0 LOCK replay cache

Incorrect Authorization / Authentication Bypass via crafted REST requests

Integer overflow leading to heap buffer overflow (CWE-190, CWE-122)

Server-Side Request Forgery (SSRF)

Arbitrary File Overwrite via Path Traversal (CWE-22)

Default Credentials / Weak Password Policy (CWE-521)

SQL Injection Authentication Bypass

Privilege Escalation via Authentication Bypass / Default Credentials

Insecure File Permissions / Arbitrary File Read and Download

Cross-Site Scripting (XSS)

Arbitrary File Upload RCE via crafted Zip file

SQL Injection

SQL Injection

PHP deserialization RCE (CWE-502)

Weak Password Requirements / Password Complexity Bypass (CWE-521)

Path Traversal / Directory Traversal leading to RCE via .htaccess and file upload bypass

Arbitrary File Upload leading to Remote Code Execution (RCE)

Directory Traversal / Path Traversal leading to Remote Code Execution

Default Credentials (MySQL)

JSON-RPC API Remote Code Execution (CWE-94 Code Injection)

Electron RunAsNode Arbitrary Code Execution

Arbitrary Code Execution via PHP component (CWE-94 Code Injection)

Remote Code Execution (RCE) via file management parameter injection

Unrestricted File Upload RCE (CWE-434)

Prototype Pollution

Out-of-bounds write (OOB memory access) leading to Remote Code Execution via crafted JavaScript file

Use After Free (UAF) Remote Code Execution via crafted JavaScript

SQL Injection

Insecure file/directory permissions leading to sensitive information disclosure and privilege escalation (CWE-732)

Command Injection via SOAP API (CWE-77)

SQL Injection

Insufficient integrity verification of native modules (CWE-354)

Arbitrary File Upload leading to Remote Code Execution (SVG upload)

Arbitrary File Upload (Unrestricted File Upload RCE)

Command Injection via crafted HTTP request

SQL Injection (CWE-89) in login form user parameter

Remote Code Execution via local file system access (CWE-94 Code Injection)

Lack of rate limiting on password reset endpoint enabling brute-force account takeover

Authentication Bypass via Remember Me function

SQL Injection

SQL Injection

SQL Injection

SQL Injection

SQL Injection (CWE-89)

SQL Injection

SQL Injection

Insecure Direct Object Reference (IDOR) / Broken Access Control

PHP Code Injection via config.php modification

Heap buffer overflow after free (CWE-787)

SQL Injection

SQL Injection

Arbitrary Code Execution via Malicious Plug-in

SQL Injection

SQL Injection

Arbitrary File Upload leading to Remote Code Execution (CWE-434)

Code Injection via arbitrary .htaccess file edit

Improper Privilege Management / Privileged API Abuse (CWE-269)

Remote Code Execution (RCE)

Server Side Request Forgery (SSRF)

Unrestricted File Upload (Remote Shell Upload / RCE)

Unrestricted File Upload (CWE-434)

PHP Object Injection / Deserialization RCE (CWE-502)

SQL Injection (CWE-89)

Server-Side Request Forgery (SSRF) leading to Remote Code Execution

Authentication Spoofing via Custom GINA/CP Module leading to RCE / Privilege Escalation (CWE-290)

SQL Injection Authentication Bypass

Sandbox Escape with Arbitrary Code Execution

Sandbox escape via SuppressedError leading to arbitrary code execution

Sandbox Escape / Arbitrary Code Execution (bypass of CVE-2023-37466 fix)

Sandbox Breakout / Arbitrary Code Execution

Java deserialization RCE via JMS ObjectMessage

Unauthenticated Remote Code Execution via OS Command Injection in RC endpoint (CWE-78, CWE-306, CWE-94)

Missing Authentication for Critical Function / Unauthenticated Global Configuration Mutation (CWE-306, CWE-15)

Memory safety bugs / Buffer overflow / Dangling pointer (CWE-120, CWE-825) leading to potential arbitrary code execution

Arbitrary Code Execution via unsanitized Function constructor injection (CWE-94, CWE-88)

Heap buffer overflow via unvalidated bitmap dimensions in NSCodec surface bits processing

Improper Authorization / Missing Authentication for Critical Function (WorkflowTemplate endpoint unauthenticated information disclosure)

OS Command Injection / Case-sensitive bypass RCE (CWE-78, CWE-178, CWE-76)

Type Confusion (CWE-843) via JIT miscompilation in JavaScript WebAssembly engine

Use-after-free in JavaScript Garbage Collector (CWE-416)

Privilege Escalation (Improper Privilege Management)

Use-after-free in JavaScript Engine (CWE-416)

Use-after-free in JavaScript Engine (SpiderMonkey)

Integer overflow in JavaScript Standard Library

Incorrect boundary conditions (out-of-bounds read/write) in image decoding library

Incorrect boundary conditions in WebRTC Audio/Video component

Heap buffer overflow (CWE-122) in ClearCodec bands decode path (client-side RCE/DoS)

Heap buffer overflow (CWE-122) in RDPGFX ClearCodec decode path leading to DoS/RCE

Heap buffer overflow (CWE-122) in GDI SurfaceToSurface RDP client-side

Heap buffer overflow (out-of-bounds read/write) in ClearCodec via unvalidated destination rectangle

Heap buffer overflow via missing bounds validation in planar bitmap decompression (RLE decode)

Heap buffer overflow in NDR array parsing (CWE-787 out-of-bounds write)

heap-based out-of-bounds write (CWE-122) via improper index validation (CWE-1285)

JSON deserialization RCE via malicious PATCH request

Local File Inclusion (LFI) and OS Command Injection via graph_theme parameter and rrdtool IPC serialization

RSASSA-PSS signature manipulation / memory corruption (CWE-119)

RSA PKCS1 v1.5 decryption ciphertext modification memory corruption

Host header validation bypass enabling cache poisoning, SSRF, and session hijacking

Unrestricted Lua interpreter RCE via unsandboxed luaL_openlibs()

Expression Language (EL) Injection / Server-Side Template Injection RCE (CWE-917)

Missing Authorization and Sensitive Data Exposure via Server-Side Apply dry-run (Secret plaintext leak)

Sandbox escape via DOM Navigation component (CWE-693: Protection Mechanism Failure)

SAML authentication bypass / cross-tenant account takeover (improper authentication CWE-287)

Reflected Cross-Site Scripting (XSS)

Reflected Cross-Site Scripting (XSS)

Persistent Cross-Site Scripting (Stored XSS) and Cross-Site Request Forgery (CSRF) leading to admin privilege escalation

Insufficient input validation sandbox escape

Improper Origin Validation / Cross-Origin Request Forgery (CORF) leading to arbitrary command execution via Claude Code sub-agent

Unsafe deserialization (pickle) unauthenticated RCE

Improper file system permissions allowing guest VM filesystem modification leading to arbitrary code execution (CWE-732, CWE-281)

HTTP/2 :path pseudo-header improper input validation leading to authorization bypass (CWE-285, CWE-551)

Out-of-bounds read via malloc(0) on crafted tar header

Authenticated Remote Code Execution via Expression Language Injection (CWE-94, CWE-917)

JWK Header Injection / JWT Signature Verification Bypass

Mark-of-the-Web (MotW) bypass via attachment save

Out-of-bounds read (OOB read) in prefix-compressed string reconstruction

Unauthenticated Arbitrary File Deletion (Missing Authorization)

Unsalted MD5 password hashing enabling offline credential cracking

Server-Side Request Forgery (SSRF)

AES-GCM IV/nonce reuse cryptographic vulnerability leading to plaintext recovery (CWE-323)

Out-of-bounds write via improper array index validation (CWE-129)

Authentication token exposure in HTTP response body (CWE-201) leading to account takeover

JWT authentication bypass via JWE-wrapped PlainJWT (improper signature verification, CWE-347)

Server-Side Request Forgery (SSRF) via SVG Image Upload

out-of-bounds read (CWE-125)

Mark-of-the-Web (MotW) bypass - missing zone identifier tag on downloaded files

Missing Authorization (Unauthorized Course Deletion)

Unprivileged Matter Device Control (Excessive Privilege / CWE-250)

Incorrect Access Control / Logic Flaw - Unauthorized Unlimited Member Recharge

SQL Injection

SQL Injection

Server-Side Request Forgery (SSRF)

Arbitrary File Deletion (Path Traversal / CWE-22)

Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)

Out-of-bounds read (OOB read) via undersized buffer allocation in image copy path

Privilege escalation via krbCanonicalName uniqueness bypass (host to domain)

Symlink path traversal / arbitrary file read-write via tar extraction (CWE-59, CWE-22)

Authentication Bypass via OIDC Userinfo Cache Key Collision (CWE-287, CWE-222)

Permission Model bypass via relative symlink path traversal (arbitrary file read/write)

Out-of-bounds read via unchecked server-supplied array index (CWE-125, CWE-129)

global-buffer-overflow via Base64 decoding out-of-bounds read/write (CWE-125, CWE-787, CWE-758)

Heap out-of-bounds read (OOB read) in smartcard NDR buffer parsing

Chained SQL Injection and Code Injection leading to Remote Code Execution (RCE)

Path Traversal (CWE-22) in createFileSessionStorage

Improper Signature Verification (RSA PKCS#1 v1.5)

Improper Input Validation - Unauthenticated SQL Injection leading to Authentication Bypass

Stack-based buffer overflow (CWE-121) remote memory corruption / process crash

Server-Side Template Injection (SSTI) / Expression Language Injection security bypass

Stored Cross-Site Scripting (XSS) in project creation workflow

Arbitrary File Overwrite via Path Traversal (CWE-22 / CWE-73) leading to arbitrary code execution or information exposure

Cross-Site Scripting (XSS) leading to Remote Code Execution via crafted Node titles

OS Command Injection via unescaped shell metacharacters in print job description (CWE-78)

In-place decryption on shared skb frags (write-what-where / buffer misuse via shared pipe pages)

Stack buffer overflow via oversized IV in CMS AEAD parameter parsing (CWE-787, CWE-120)

Shadow paging use-after-free via unexpected MMU page role mismatch

Use-After-Free (UAF) Remote Code Execution via unblock client flow

Double Free RCE via HTTP/2 protocol

Time-of-Check Time-of-Use (TOCTOU) race condition local privilege escalation

Server-Side Request Forgery (SSRF) via WebSocket upgrade request proxying

File descriptor leak leading to container escape / host filesystem namespace access

Heap buffer overflow via PCRE capture in rewrite module (potential RCE)

Heap buffer overflow via PCRE regex capture groups in rewrite module (RCE)

out-of-bounds write heap corruption RCE

Use-after-Free (UAF) in HTTP/3 QUIC QPACK encoder stream handling leading to worker process restart or RCE

Use-After-Free (CWE-416) via inverted genmask check in catchall map element activation leading to local privilege escalation

Integer overflow and out-of-bounds write (CWE-190, CWE-787) in net/sched pedit partial COW leading to page cache corruption

Out-of-bounds write / arbitrary write via lost shared-frag marker during SKB coalescing (CWE-787, CWE-123)

Local Privilege Escalation (LPE) via incorrect Polkit allow_active authorization (CWE-863 Incorrect Authorization)

PHP filter chain arbitrary file read via mPDF PDF export (CWE-74 injection)

Out-of-bounds Write / Memory Corruption during deflate compression (CWE-787)

Memory Allocation with Excessive Size Value leading to Denial of Service (CWE-789, CWE-409)

OS Command Injection via unsanitized configuration parameter write (CWE-20, CWE-78, CWE-116)

Improper Privilege Management (CWE-269) via ptrace dumpability logic bypass

Improper Input Validation / Dangling Pointer (Use-After-Free) via userspace-supplied cifs.spnego key descriptions

Local Privilege Escalation via SUID-root XFS image resize through udisks (CWE-250)

HTTP Host header validation bypass / HTTP Request Smuggling (CWE-444, CWE-1289)

SQL Injection (CWE-89)

Server-Side Request Forgery (SSRF)

Cross-Site Scripting (XSS) leading to Remote Code Execution via malicious module upload

Pre-authentication denial of service via uncontrolled memory allocation (ping/pong packet queue exhaustion)

Incorrect authorization / host-based sudoers bypass (CWE-863)