Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
916 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2024-1708 |
— | — | 0.9544 | — | KEV | ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to e |
CVE-2022-41352 |
— | — | 0.9548 | — | KEV | Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio pac |
CVE-2016-0752 |
— | — | 0.9554 | — | KEV | Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read ar |
CVE-2020-5410 |
— | — | 0.9559 | — | KEV | Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applicatio |
CVE-2022-23131 |
— | — | 0.9568 | — | KEV | Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Fro |
CVE-2025-12480 |
— | — | 0.9575 | — | KEV | Gladinet Triofox contains an improper access control vulnerability that allows access to initial set |
CVE-2021-26857 |
— | — | 0.9576 | — | KEV | Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code executio |
CVE-2026-87902 |
— | — | 0.9577 | — | KEV | WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated a |
CVE-2020-1147 |
— | — | 0.9580 | — | KEV | Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vu |
CVE-2020-5847 |
— | — | 0.9584 | — | KEV | Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abus |
CVE-2025-61884 |
— | — | 0.9589 | — | KEV | Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime c |
CVE-2021-20124 |
— | — | 0.9592 | — | KEV | Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of t |
CVE-2019-1652 |
— | — | 0.9592 | — | KEV | A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual G |
CVE-2018-14847 |
— | — | 0.9598 | — | KEV | MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and r |
CVE-2017-3506 |
— | — | 0.9599 | — | KEV | Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injecti |
CVE-2018-20250 |
— | — | 0.9600 | — | KEV | WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution |
CVE-2022-24112 |
— | — | 0.9607 | — | KEV | Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution. |
CVE-2019-20085 |
— | — | 0.9607 | — | KEV | TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. req |
CVE-2026-33017 |
— | — | 0.9618 | — | KEV | Langflow contains a code injection vulnerability that could allow building public flows without requ |
CVE-2020-17530 |
— | — | 0.9625 | — | KEV | Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw us |
CVE-2025-54068 |
— | — | 0.9628 | — | KEV | Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers t |
CVE-2021-35587 |
— | — | 0.9628 | — | KEV | Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via H |
CVE-2010-0840 |
— | — | 0.9632 | — | KEV | Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote a |
CVE-2026-23760 |
— | — | 0.9643 | — | KEV | SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulner |
CVE-2020-8260 |
— | — | 0.9648 | — | KEV | Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to |
CVE-2016-3081 |
— | — | 0.9653 | — | KEV | Apache Struts contains a command injection vulnerability that could allow remote attackers to execut |
CVE-2009-1151 |
— | — | 0.9657 | — | KEV | Setup script used to generate configuration can be fooled using a crafted POST request to include ar |
CVE-2023-33246 |
— | — | 0.9657 | — | KEV | Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to |
CVE-2020-11651 |
— | — | 0.9661 | — | KEV | SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs |
CVE-2009-0927 |
— | — | 0.9663 | — | KEV | Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arb |
CVE-2011-3544 |
— | — | 0.9665 | — | KEV | An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java |
CVE-2026-35273 |
— | — | 0.9668 | — | KEV | Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vul |
CVE-2018-6530 |
— | — | 0.9668 | — | KEV | Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS command |
CVE-2019-20500 |
— | — | 0.9671 | — | KEV | D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Sav |
CVE-2023-46747 |
— | — | 0.9671 | — | KEV | F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel |
CVE-2020-1350 |
— | — | 0.9672 | — | KEV | Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remo |
CVE-2021-22502 |
— | — | 0.9674 | — | KEV | Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remo |
CVE-2020-25223 |
— | — | 0.9675 | — | KEV | A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM. |
CVE-2010-3962 |
— | — | 0.9683 | — | KEV | Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could all |
CVE-2024-57727 |
— | — | 0.9683 | — | KEV | SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unaut |
CVE-2023-52163 |
— | — | 0.9692 | — | KEV | Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command in |
CVE-2026-20253 |
— | — | 0.9694 | — | KEV | Splunk Enterprise contains a missing authentication for critical function vulnerability which could |
CVE-2018-1273 |
— | — | 0.9696 | — | KEV | Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform |
CVE-2017-8291 |
— | — | 0.9697 | — | KEV | Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion |
CVE-2013-0422 |
— | — | 0.9702 | — | KEV | A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to |
CVE-2019-3398 |
— | — | 0.9703 | — | KEV | Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadal |
CVE-2025-5086 |
— | — | 0.9704 | — | KEV | Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that coul |
CVE-2019-1003030 |
— | — | 0.9706 | — | KEV | Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, |
CVE-2023-38203 |
— | — | 0.9707 | — | KEV | Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code exe |
CVE-2019-7256 |
— | — | 0.9708 | — | KEV | Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker |