Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
916 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2020-3952 |
— | — | 0.9038 | — | KEV | VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Servi |
CVE-2021-32648 |
— | — | 0.9042 | — | KEV | In affected versions of the october/system package an attacker can request an account password reset |
CVE-2025-6218 |
— | — | 0.9048 | — | KEV | RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the co |
CVE-2023-41763 |
— | — | 0.9055 | — | KEV | Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalat |
CVE-2017-3066 |
— | — | 0.9060 | — | KEV | Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows |
CVE-2019-17621 |
— | — | 0.9062 | — | KEV | D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi |
CVE-2021-21315 |
— | — | 0.9067 | — | KEV | In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter |
CVE-2017-12149 |
— | — | 0.9071 | — | KEV | The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an at |
CVE-2020-8243 |
— | — | 0.9076 | — | KEV | Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that co |
CVE-2024-13160 |
— | — | 0.9099 | — | KEV | Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote |
CVE-2025-64446 |
— | — | 0.9108 | — | KEV | Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated |
CVE-2012-0754 |
— | — | 0.9109 | — | KEV | Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execut |
CVE-2021-35211 |
— | — | 0.9116 | — | KEV | SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote cod |
CVE-2022-26352 |
— | — | 0.9125 | — | KEV | dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerabili |
CVE-2012-5076 |
— | — | 0.9125 | — | KEV | The default Java security properties configuration did not restrict access to the com.sun.org.glassf |
CVE-2026-3055 |
— | — | 0.9149 | — | KEV | Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScale |
CVE-2026-93616 |
— | — | 0.9161 | — | KEV | Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-D |
CVE-2022-26258 |
— | — | 0.9163 | — | KEV | D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which all |
CVE-2024-5910 |
— | — | 0.9168 | — | KEV | Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacke |
CVE-2018-11138 |
— | — | 0.9172 | — | KEV | The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is a |
CVE-2021-42321 |
— | — | 0.9174 | — | KEV | An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Ex |
CVE-2024-11680 |
— | — | 0.9185 | — | KEV | ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated |
CVE-2020-8657 |
— | — | 0.9187 | — | KEV | EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by |
CVE-2010-0249 |
— | — | 0.9194 | — | KEV | Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attacke |
CVE-2024-7399 |
— | — | 0.9194 | — | KEV | Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to w |
CVE-2020-10148 |
— | — | 0.9198 | — | KEV | SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attac |
CVE-2019-6340 |
— | — | 0.9202 | — | KEV | In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead |
CVE-2022-37042 |
— | — | 0.9207 | — | KEV | Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxI |
CVE-2025-11371 |
— | — | 0.9214 | — | KEV | Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vuln |
CVE-2019-2616 |
— | — | 0.9218 | — | KEV | Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for v |
CVE-2017-5689 |
— | — | 0.9219 | — | KEV | Intel products contain a vulnerability which can allow attackers to perform privilege escalation. |
CVE-2025-9242 |
— | — | 0.9222 | — | KEV | WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may all |
CVE-2022-43939 |
— | — | 0.9227 | — | KEV | Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisi |
CVE-2016-3427 |
— | — | 0.9233 | — | KEV | Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to aff |
CVE-2023-38950 |
— | — | 0.9247 | — | KEV | ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthentica |
CVE-2022-24706 |
— | — | 0.9251 | — | KEV | Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow |
CVE-2022-0847 |
— | — | 0.9280 | — | KEV | Linux kernel contains an improper initialization vulnerability where an unprivileged local user coul |
CVE-2025-34291 |
— | — | 0.9281 | — | KEV | Langflow contains an origin validation error vulnerability in which an overly permissive CORS config |
CVE-2020-2551 |
— | — | 0.9282 | — | KEV | Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allow |
CVE-2018-10561 |
— | — | 0.9282 | — | KEV | Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562 |
CVE-2024-6670 |
— | — | 0.9291 | — | KEV | Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker |
CVE-2023-20273 |
— | — | 0.9294 | — | KEV | Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with |
CVE-2021-40870 |
— | — | 0.9302 | — | KEV | Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated use |
CVE-2016-4437 |
— | — | 0.9304 | — | KEV | Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass int |
CVE-2013-0632 |
— | — | 0.9308 | — | KEV | An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthori |
CVE-2026-1731 |
— | — | 0.9310 | — | KEV | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vu |
CVE-2020-5849 |
— | — | 0.9324 | — | KEV | Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the a |
CVE-2022-33891 |
— | — | 0.9324 | — | KEV | Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Co |
CVE-2018-0802 |
— | — | 0.9329 | — | KEV | Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in me |
CVE-2021-44077 |
— | — | 0.9330 | — | KEV | Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCente |