Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
916 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2022-27593 |
— | — | 0.8791 | — | KEV | Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled refer |
CVE-2025-29635 |
— | — | 0.8794 | — | KEV | D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to exe |
CVE-2025-4428 |
— | — | 0.8800 | — | KEV | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component t |
CVE-2021-21973 |
— | — | 0.8801 | — | KEV | VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper valid |
CVE-2023-36025 |
— | — | 0.8809 | — | KEV | Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an a |
CVE-2019-7192 |
— | — | 0.8810 | — | KEV | QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing rem |
CVE-2026-24423 |
— | — | 0.8818 | — | KEV | SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in th |
CVE-2023-41265 |
— | — | 0.8821 | — | KEV | Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges a |
CVE-2018-8174 |
— | — | 0.8824 | — | KEV | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in |
CVE-2010-0188 |
— | — | 0.8825 | — | KEV | Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service |
CVE-2020-8193 |
— | — | 0.8827 | — | KEV | Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorizati |
CVE-2026-34908 |
— | — | 0.8829 | — | KEV | Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious ac |
CVE-2026-1603 |
— | — | 0.8833 | — | KEV | Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel v |
CVE-2021-43798 |
— | — | 0.8850 | — | KEV | Grafana contains a path traversal vulnerability that could allow access to local files. |
CVE-2026-20230 |
— | — | 0.8853 | — | KEV | Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session M |
CVE-2024-8190 |
— | — | 0.8853 | — | KEV | Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administ |
CVE-2014-3120 |
— | — | 0.8856 | — | KEV | Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL exp |
CVE-2011-2462 |
— | — | 0.8858 | — | KEV | The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerabil |
CVE-2025-61757 |
— | — | 0.8865 | — | KEV | Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allo |
CVE-2026-20079 |
— | — | 0.8866 | — | KEV | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewa |
CVE-2017-8759 |
— | — | 0.8870 | — | KEV | Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted in |
CVE-2025-54253 |
— | — | 0.8877 | — | KEV | Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrar |
CVE-2021-20021 |
— | — | 0.8878 | — | KEV | SonicWall Email Security contains an improper privilege management vulnerability that allows an atta |
CVE-2020-0601 |
— | — | 0.8908 | — | KEV | Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates |
CVE-2018-14839 |
— | — | 0.8925 | — | KEV | LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability. |
CVE-2026-20127 |
— | — | 0.8929 | — | KEV | Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerl |
CVE-2019-7195 |
— | — | 0.8932 | — | KEV | QNAP devices running Photo Station contain an external control of file name or path vulnerability al |
CVE-2017-5521 |
— | — | 0.8935 | — | KEV | Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the w |
CVE-2026-9082 |
— | — | 0.8938 | — | KEV | Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and rem |
CVE-2010-3333 |
— | — | 0.8939 | — | KEV | A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office an |
CVE-2018-15982 |
— | — | 0.8958 | — | KEV | Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability |
CVE-2010-2568 |
— | — | 0.8962 | — | KEV | Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed whe |
CVE-2021-20123 |
— | — | 0.8965 | — | KEV | Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An |
CVE-2020-17463 |
— | — | 0.8969 | — | KEV | FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /n |
CVE-2017-0146 |
— | — | 0.8975 | — | KEV | The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution. |
CVE-2024-13161 |
— | — | 0.8981 | — | KEV | Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote |
CVE-2017-0145 |
— | — | 0.8985 | — | KEV | The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary |
CVE-2017-8570 |
— | — | 0.8989 | — | KEV | A remote code execution vulnerability exists in Microsoft Office software when it fails to properly |
CVE-2023-36844 |
— | — | 0.8996 | — | KEV | Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allow |
CVE-2017-8464 |
— | — | 0.9003 | — | KEV | Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to ex |
CVE-2026-34910 |
— | — | 0.9003 | — | KEV | Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious |
CVE-2009-3960 |
— | — | 0.9012 | — | KEV | Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows f |
CVE-2025-26399 |
— | — | 0.9012 | — | KEV | SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that |
CVE-2013-0431 |
— | — | 0.9015 | — | KEV | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote at |
CVE-2020-29583 |
— | — | 0.9015 | — | KEV | Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded |
CVE-2025-37164 |
— | — | 0.9019 | — | KEV | Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remot |
CVE-2018-4878 |
— | — | 0.9028 | — | KEV | Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution. |
CVE-2016-8735 |
— | — | 0.9034 | — | KEV | Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemo |
CVE-2023-40044 |
— | — | 0.9035 | — | KEV | Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Tran |
CVE-2024-40711 |
— | — | 0.9037 | — | KEV | Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated us |