Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
371 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2023-29298 |
— | — | 0.9979 | — | KEV | Adobe ColdFusion contains an improper access control vulnerability that allows for a security featur |
CVE-2025-32432 |
— | — | 0.9979 | — | KEV | Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary |
CVE-2025-55182 |
— | — | 0.9980 | — | KEV | Meta React Server Components contains a remote code execution vulnerability that could allow unauthe |
CVE-2023-23752 |
— | — | 0.9981 | — | KEV | Joomla! contains an improper access control vulnerability that allows unauthorized access to webserv |
CVE-2024-36401 |
— | — | 0.9981 | — | KEV | OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated |
CVE-2023-38831 |
— | — | 0.9981 | — | KEV | RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a u |
CVE-2025-10035 |
— | — | 0.9982 | — | KEV | Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor wit |
CVE-2022-46169 |
— | — | 0.9983 | — | KEV | Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code |
CVE-2026-8037 |
— | — | 0.9984 | — | KEV | Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attac |
CVE-2022-35914 |
— | — | 0.9985 | — | KEV | Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed. |
CVE-2022-35405 |
— | — | 0.9987 | — | KEV | Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulne |
CVE-2023-21839 |
— | — | 0.9990 | — | KEV | Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker |
CVE-2024-45519 |
— | — | 0.9991 | — | KEV | Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal se |
CVE-2026-10520 |
— | — | 0.9991 | — | KEV | Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability w |
CVE-2024-32113 |
— | — | 0.9992 | — | KEV | Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. |
CVE-2025-25257 |
— | — | 0.9992 | — | KEV | Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker |
CVE-2025-4427 |
— | — | 0.9993 | — | KEV | Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API com |
CVE-2023-34362 |
— | — | 0.9993 | — | KEV | Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated |
CVE-2024-29824 |
— | — | 0.9994 | — | KEV | Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an u |
CVE-2024-27198 |
— | — | 0.9994 | — | KEV | JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perfor |
CVE-2025-24813 |
— | — | 0.9994 | — | KEV | Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute cod |
CVE-2022-30525 |
— | — | 0.9994 | — | KEV | A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an |
CVE-2023-38035 |
— | — | 0.9995 | — | KEV | Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability |
CVE-2022-41040 |
— | — | 0.9996 | — | KEV | Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulne |
CVE-2024-38475 |
— | — | 0.9996 | — | KEV | Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows |
CVE-2022-47986 |
— | — | 0.9997 | — | KEV | IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML dese |
CVE-2025-31161 |
— | — | 0.9997 | — | KEV | CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allow |
CVE-2022-41082 |
— | — | 0.9997 | — | KEV | Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote |
CVE-2025-5777 |
— | — | 0.9997 | — | KEV | Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient inp |
CVE-2025-24893 |
— | — | 0.9997 | — | KEV | XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitr |
CVE-2024-4879 |
— | — | 0.9998 | — | KEV | ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injecti |
CVE-2024-24919 |
— | — | 0.9998 | — | KEV | Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. T |
CVE-2023-4863 |
— | — | 0.9998 | — | KEV | Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attack |
CVE-2025-59287 |
— | — | 0.9998 | — | KEV | Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerab |
CVE-2024-1709 |
— | — | 0.9998 | — | KEV | ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker wi |
CVE-2025-22457 |
— | — | 0.9998 | — | KEV | Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulner |
CVE-2025-0282 |
— | — | 0.9998 | — | KEV | Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which c |
CVE-2024-45195 |
— | — | 0.9998 | — | KEV | Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauth |
CVE-2023-46805 |
— | — | 0.9998 | — | KEV | Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateway |
CVE-2023-29357 |
— | — | 0.9998 | — | KEV | Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated att |
CVE-2023-22527 |
— | — | 0.9998 | — | KEV | Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulne |
CVE-2022-40684 |
— | — | 0.9998 | — | KEV | Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability |
CVE-2024-4577 |
— | — | 0.9999 | — | KEV | PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability |
CVE-2023-42793 |
— | — | 0.9999 | — | KEV | JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execu |
CVE-2024-27199 |
— | — | 0.9999 | — | KEV | JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin a |
CVE-2023-29300 |
— | — | 0.9999 | — | KEV | Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code exe |
CVE-2023-46604 |
— | — | 0.9999 | — | KEV | Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote a |
CVE-2025-3248 |
— | — | 0.9999 | — | KEV | Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that |
CVE-2024-13159 |
— | — | 0.9999 | — | KEV | Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote |
CVE-2024-34102 |
— | — | 0.9999 | — | KEV | Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity refere |