Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
371 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2023-36025 |
— | — | 0.8809 | — | KEV | Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an a |
CVE-2026-24423 |
— | — | 0.8818 | — | KEV | SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in th |
CVE-2026-20230 |
— | — | 0.8820 | — | KEV | Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session M |
CVE-2023-41265 |
— | — | 0.8821 | — | KEV | Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges a |
CVE-2026-34908 |
— | — | 0.8829 | — | KEV | Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious ac |
CVE-2026-1603 |
— | — | 0.8833 | — | KEV | Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel v |
CVE-2026-20079 |
— | — | 0.8847 | — | KEV | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewa |
CVE-2024-8190 |
— | — | 0.8853 | — | KEV | Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administ |
CVE-2025-61757 |
— | — | 0.8865 | — | KEV | Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allo |
CVE-2025-54253 |
— | — | 0.8877 | — | KEV | Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrar |
CVE-2026-20127 |
— | — | 0.8929 | — | KEV | Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerl |
CVE-2026-9082 |
— | — | 0.8938 | — | KEV | Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and rem |
CVE-2024-13161 |
— | — | 0.8981 | — | KEV | Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote |
CVE-2023-36844 |
— | — | 0.8996 | — | KEV | Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allow |
CVE-2026-34910 |
— | — | 0.9003 | — | KEV | Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious |
CVE-2025-26399 |
— | — | 0.9012 | — | KEV | SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that |
CVE-2025-37164 |
— | — | 0.9019 | — | KEV | Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remot |
CVE-2023-40044 |
— | — | 0.9035 | — | KEV | Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Tran |
CVE-2024-40711 |
— | — | 0.9037 | — | KEV | Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated us |
CVE-2025-6218 |
— | — | 0.9048 | — | KEV | RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the co |
CVE-2023-41763 |
— | — | 0.9055 | — | KEV | Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalat |
CVE-2024-13160 |
— | — | 0.9099 | — | KEV | Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote |
CVE-2025-64446 |
— | — | 0.9108 | — | KEV | Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated |
CVE-2022-26352 |
— | — | 0.9125 | — | KEV | dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerabili |
CVE-2026-3055 |
— | — | 0.9149 | — | KEV | Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScale |
CVE-2026-93616 |
— | — | 0.9161 | — | KEV | Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-D |
CVE-2022-26258 |
— | — | 0.9163 | — | KEV | D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which all |
CVE-2024-5910 |
— | — | 0.9168 | — | KEV | Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacke |
CVE-2024-11680 |
— | — | 0.9185 | — | KEV | ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated |
CVE-2024-7399 |
— | — | 0.9194 | — | KEV | Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to w |
CVE-2022-37042 |
— | — | 0.9207 | — | KEV | Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxI |
CVE-2025-11371 |
— | — | 0.9214 | — | KEV | Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vuln |
CVE-2025-9242 |
— | — | 0.9222 | — | KEV | WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may all |
CVE-2022-43939 |
— | — | 0.9227 | — | KEV | Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisi |
CVE-2023-38950 |
— | — | 0.9247 | — | KEV | ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthentica |
CVE-2025-34291 |
— | — | 0.9281 | — | KEV | Langflow contains an origin validation error vulnerability in which an overly permissive CORS config |
CVE-2024-6670 |
— | — | 0.9291 | — | KEV | Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker |
CVE-2023-20273 |
— | — | 0.9294 | — | KEV | Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with |
CVE-2026-1731 |
— | — | 0.9310 | — | KEV | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vu |
CVE-2022-33891 |
— | — | 0.9324 | — | KEV | Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Co |
CVE-2024-28987 |
— | — | 0.9330 | — | KEV | SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, un |
CVE-2025-4008 |
— | — | 0.9332 | — | KEV | Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthent |
CVE-2025-54309 |
— | — | 0.9347 | — | KEV | CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not |
CVE-2023-36846 |
— | — | 0.9347 | — | KEV | Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability |
CVE-2024-9474 |
— | — | 0.9375 | — | KEV | Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege e |
CVE-2025-24016 |
— | — | 0.9384 | — | KEV | Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code executi |
CVE-2025-47812 |
— | — | 0.9388 | — | KEV | Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that |
CVE-2022-27924 |
— | — | 0.9391 | — | KEV | Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targe |
CVE-2024-55956 |
— | — | 0.9397 | — | KEV | Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestrict |
CVE-2025-11953 |
— | — | 0.9398 | — | KEV | React Native Community CLI contains an OS command injection vulnerability which could allow unauthen |