Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
371 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2023-27524 |
— | — | 0.9815 | — | KEV | Apache Superset contains an insecure default initialization of a resource vulnerability that allows |
CVE-2024-12987 |
— | — | 0.9816 | — | KEV | DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability du |
CVE-2022-26138 |
— | — | 0.9824 | — | KEV | Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and passwor |
CVE-2026-34197 |
— | — | 0.9826 | 2026-04-07 | KEV | Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. |
CVE-2023-20887 |
— | — | 0.9828 | — | KEV | VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection |
CVE-2023-48788 |
— | — | 0.9845 | — | KEV | Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attac |
CVE-2026-34486 |
— | — | 0.9850 | 2026-04-09 | KEV | Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass o |
CVE-2024-20767 |
— | — | 0.9851 | — | KEV | Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to a |
CVE-2024-50603 |
— | — | 0.9852 | — | KEV | Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticat |
CVE-2024-9463 |
— | — | 0.9855 | — | KEV | Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthen |
CVE-2026-72898 |
— | — | 0.9855 | — | KEV | Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to in |
CVE-2024-8963 |
— | — | 0.9861 | — | KEV | Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a rem |
CVE-2024-50623 |
— | — | 0.9861 | — | KEV | Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestrict |
CVE-2024-29059 |
— | — | 0.9862 | — | KEV | Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef UR |
CVE-2026-1340 |
— | — | 0.9864 | — | KEV | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attac |
CVE-2022-27925 |
— | — | 0.9868 | — | KEV | Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an |
CVE-2026-1281 |
— | — | 0.9869 | — | KEV | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attac |
CVE-2023-47246 |
— | — | 0.9885 | — | KEV | SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execu |
CVE-2022-3236 |
— | — | 0.9890 | — | KEV | A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote |
CVE-2025-32433 |
— | — | 0.9892 | — | KEV | Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. |
CVE-2026-24061 |
— | — | 0.9898 | — | KEV | GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote au |
CVE-2025-68613 |
— | — | 0.9899 | — | KEV | n8n contains an improper control of dynamically managed code resources vulnerability in its workflow |
CVE-2025-49706 |
— | — | 0.9906 | — | KEV | Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized att |
CVE-2022-36804 |
— | — | 0.9908 | — | KEV | Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vul |
CVE-2022-30190 |
— | — | 0.9916 | — | KEV | A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calli |
CVE-2024-27348 |
— | — | 0.9921 | — | KEV | Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote |
CVE-2023-22515 |
— | — | 0.9922 | — | KEV | Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allo |
CVE-2022-30333 |
— | — | 0.9923 | — | KEV | RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to |
CVE-2023-34048 |
— | — | 0.9923 | — | KEV | VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCE |
CVE-2023-28771 |
— | — | 0.9928 | — | KEV | Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which c |
CVE-2024-4885 |
— | — | 0.9929 | — | KEV | Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacke |
CVE-2024-21412 |
— | — | 0.9941 | — | KEV | Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a se |
CVE-2024-38856 |
— | — | 0.9943 | — | KEV | Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code executio |
CVE-2023-36884 |
— | — | 0.9944 | — | KEV | Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade |
CVE-2022-42475 |
— | — | 0.9947 | — | KEV | Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability whi |
CVE-2024-23692 |
— | — | 0.9949 | — | KEV | Rejetto HTTP File Server contains an improper neutralization of special elements used in a template |
CVE-2025-31324 |
— | — | 0.9949 | — | KEV | SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability t |
CVE-2025-49113 |
— | — | 0.9949 | — | KEV | RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code |
CVE-2024-4040 |
— | — | 0.9954 | — | KEV | CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escap |
CVE-2026-39987 |
— | — | 0.9956 | — | KEV | Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticate |
CVE-2023-20198 |
— | — | 0.9961 | — | KEV | Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that cou |
CVE-2024-28995 |
— | — | 0.9961 | — | KEV | SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sen |
CVE-2024-9465 |
— | — | 0.9963 | — | KEV | Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated |
CVE-2024-5217 |
— | — | 0.9963 | — | KEV | ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of |
CVE-2025-48703 |
— | — | 0.9966 | — | KEV | CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability tha |
CVE-2025-61882 |
— | — | 0.9973 | — | KEV | Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration compon |
CVE-2023-3519 |
— | — | 0.9975 | — | KEV | Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for u |
CVE-2022-47966 |
— | — | 0.9975 | — | KEV | Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability d |
CVE-2023-38205 |
— | — | 0.9976 | — | KEV | Adobe ColdFusion contains an improper access control vulnerability that allows for a security featur |
CVE-2024-0012 |
— | — | 0.9979 | — | KEV | Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based managemen |