Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
915 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2023-22515 |
— | — | 0.9922 | — | KEV | Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allo |
CVE-2017-0144 |
— | — | 0.9923 | — | KEV | The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary |
CVE-2022-30333 |
— | — | 0.9923 | — | KEV | RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to |
CVE-2023-34048 |
— | — | 0.9923 | — | KEV | VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCE |
CVE-2020-14750 |
— | — | 0.9925 | — | KEV | Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to |
CVE-2020-1938 |
— | — | 0.9927 | — | KEV | Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for exampl |
CVE-2023-28771 |
— | — | 0.9928 | — | KEV | Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which c |
CVE-2024-4885 |
— | — | 0.9929 | — | KEV | Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacke |
CVE-2014-6287 |
— | — | 0.9932 | — | KEV | The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) al |
CVE-2022-0543 |
— | — | 0.9935 | — | KEV | Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code executio |
CVE-2017-0148 |
— | — | 0.9936 | — | KEV | The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets. |
CVE-2020-1472 |
— | — | 0.9939 | — | KEV | Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an |
CVE-2021-32030 |
— | — | 0.9939 | — | KEV | ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allo |
CVE-2017-9805 |
— | — | 0.9940 | — | KEV | Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization wit |
CVE-2024-21412 |
— | — | 0.9941 | — | KEV | Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a se |
CVE-2011-0611 |
— | — | 0.9941 | — | KEV | Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code o |
CVE-2024-38856 |
— | — | 0.9943 | — | KEV | Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code executio |
CVE-2023-36884 |
— | — | 0.9944 | — | KEV | Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade |
CVE-2017-7494 |
— | — | 0.9945 | — | KEV | Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared |
CVE-2022-42475 |
— | — | 0.9947 | — | KEV | Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability whi |
CVE-2018-0171 |
— | — | 0.9948 | — | KEV | Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote |
CVE-2024-23692 |
— | — | 0.9949 | — | KEV | Rejetto HTTP File Server contains an improper neutralization of special elements used in a template |
CVE-2025-31324 |
— | — | 0.9949 | — | KEV | SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability t |
CVE-2025-49113 |
— | — | 0.9949 | — | KEV | RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code |
CVE-2017-0199 |
— | — | 0.9950 | — | KEV | Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications pa |
CVE-2015-3306 |
— | — | 0.9950 | — | KEV | ProFTPD contains an improper access control vulnerability that could allow remote attackers to read |
CVE-2018-20062 |
— | — | 0.9953 | — | KEV | ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution throu |
CVE-2024-4040 |
— | — | 0.9954 | — | KEV | CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escap |
CVE-2026-39987 |
— | — | 0.9956 | — | KEV | Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticate |
CVE-2015-5477 |
— | — | 0.9958 | — | KEV | ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause |
CVE-2020-16846 |
— | — | 0.9959 | — | KEV | SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injec |
CVE-2021-33045 |
— | — | 0.9959 | — | KEV | Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopba |
CVE-2023-20198 |
— | — | 0.9961 | — | KEV | Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that cou |
CVE-2024-28995 |
— | — | 0.9961 | — | KEV | SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sen |
CVE-2024-9465 |
— | — | 0.9963 | — | KEV | Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated |
CVE-2024-5217 |
— | — | 0.9963 | — | KEV | ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of |
CVE-2022-22965 |
— | — | 0.9964 | — | KEV | Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code executio |
CVE-2025-48703 |
— | — | 0.9966 | — | KEV | CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability tha |
CVE-2014-6278 |
— | — | 0.9967 | — | KEV | GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arb |
CVE-2021-22054 |
— | — | 0.9968 | — | KEV | Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request |
CVE-2017-1000353 |
— | — | 0.9968 | — | KEV | Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attack |
CVE-2017-0147 |
— | — | 0.9969 | — | KEV | The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from p |
CVE-2017-12615 |
— | — | 0.9971 | — | KEV | When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to |
CVE-2019-15107 |
— | — | 0.9971 | — | KEV | An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injec |
CVE-2016-10033 |
— | — | 0.9971 | — | KEV | PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied inpu |
CVE-2025-61882 |
— | — | 0.9973 | — | KEV | Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration compon |
CVE-2019-16759 |
— | — | 0.9973 | — | KEV | The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code ex |
CVE-2021-22205 |
— | — | 0.9973 | — | KEV | GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Wo |
CVE-2020-15505 |
— | — | 0.9974 | — | KEV | Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products cont |
CVE-2019-18935 |
— | — | 0.9974 | — | KEV | Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability thro |