Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
915 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-34197 |
— | — | 0.9826 | 2026-04-07 | KEV | Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. |
CVE-2023-20887 |
— | — | 0.9828 | — | KEV | VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection |
CVE-2016-1555 |
— | — | 0.9829 | — | KEV | Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input d |
CVE-2018-1000861 |
— | — | 0.9833 | — | KEV | A code execution vulnerability exists in the Stapler web framework used by Jenkins |
CVE-2017-15944 |
— | — | 0.9834 | — | KEV | Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote |
CVE-2022-21587 |
— | — | 0.9834 | — | KEV | Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacke |
CVE-2023-48788 |
— | — | 0.9845 | — | KEV | Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attac |
CVE-2021-21311 |
— | — | 0.9846 | — | KEV | Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote a |
CVE-2026-34486 |
— | — | 0.9850 | 2026-04-09 | KEV | Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass o |
CVE-2019-5418 |
— | — | 0.9851 | — | KEV | Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept |
CVE-2024-20767 |
— | — | 0.9851 | — | KEV | Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to a |
CVE-2024-50603 |
— | — | 0.9852 | — | KEV | Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticat |
CVE-2016-3088 |
— | — | 0.9852 | — | KEV | The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbi |
CVE-2012-4681 |
— | — | 0.9854 | — | KEV | The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution. |
CVE-2019-11539 |
— | — | 0.9854 | — | KEV | Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web in |
CVE-2024-9463 |
— | — | 0.9855 | — | KEV | Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthen |
CVE-2026-72898 |
— | — | 0.9855 | — | KEV | Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to in |
CVE-2019-17558 |
— | — | 0.9857 | — | KEV | The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow |
CVE-2024-8963 |
— | — | 0.9861 | — | KEV | Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a rem |
CVE-2024-50623 |
— | — | 0.9861 | — | KEV | Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestrict |
CVE-2015-5119 |
— | — | 0.9862 | — | KEV | A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Playe |
CVE-2024-29059 |
— | — | 0.9862 | — | KEV | Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef UR |
CVE-2026-1340 |
— | — | 0.9864 | — | KEV | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attac |
CVE-2022-27925 |
— | — | 0.9868 | — | KEV | Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an |
CVE-2026-1281 |
— | — | 0.9869 | — | KEV | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attac |
CVE-2008-4250 |
— | — | 0.9875 | — | KEV | Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows |
CVE-2013-2465 |
— | — | 0.9877 | — | KEV | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows r |
CVE-2012-3152 |
— | — | 0.9879 | — | KEV | Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote |
CVE-2023-47246 |
— | — | 0.9885 | — | KEV | SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execu |
CVE-2022-3236 |
— | — | 0.9890 | — | KEV | A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote |
CVE-2017-9791 |
— | — | 0.9891 | — | KEV | The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value p |
CVE-2025-32433 |
— | — | 0.9892 | — | KEV | Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. |
CVE-2017-3881 |
— | — | 0.9895 | — | KEV | A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisc |
CVE-2019-3929 |
— | — | 0.9895 | — | KEV | Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoi |
CVE-2021-40539 |
— | — | 0.9896 | — | KEV | Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the R |
CVE-2020-7247 |
— | — | 0.9897 | — | KEV | smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote a |
CVE-2026-24061 |
— | — | 0.9898 | — | KEV | GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote au |
CVE-2025-68613 |
— | — | 0.9899 | — | KEV | n8n contains an improper control of dynamically managed code resources vulnerability in its workflow |
CVE-2019-16278 |
— | — | 0.9903 | — | KEV | Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non- |
CVE-2020-0618 |
— | — | 0.9905 | — | KEV | Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page |
CVE-2025-49706 |
— | — | 0.9906 | — | KEV | Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized att |
CVE-2020-10199 |
— | — | 0.9906 | — | KEV | Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code executio |
CVE-2022-36804 |
— | — | 0.9908 | — | KEV | Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vul |
CVE-2021-44529 |
— | — | 0.9910 | — | KEV | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability th |
CVE-2022-30190 |
— | — | 0.9916 | — | KEV | A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calli |
CVE-2018-7602 |
— | — | 0.9917 | — | KEV | A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow att |
CVE-2020-11978 |
— | — | 0.9919 | — | KEV | A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with |
CVE-2022-24086 |
— | — | 0.9920 | — | KEV | Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can |
CVE-2024-27348 |
— | — | 0.9921 | — | KEV | Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote |
CVE-2020-0646 |
— | — | 0.9922 | — | KEV | Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote |