Analytical use of cookies
CVE-2024-27199CVSS 7.3CISA KEVKnown Exploited
CVE-2024-27199: JetBrains TeamCity Relative Path Traversal Vulnerability
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
Security feed
Recent CVE advisories selected for server infrastructure
The feed is built from NVD, CISA KEV and EPSS signals, then translated and cached for DataHouse users.
CategorySwitch between product-focused CVE watchlists.
Showknown exploited vulnerabilities from CISA KEV
CVE-2026-10520CVSS 10.0CISA KEVVPN
CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
CVE-2008-4250CVSS 9.8CISA KEVWindows
CVE-2008-4250: Microsoft Windows Buffer Overflow Vulnerability
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path can...
CVE-2026-33017CVSS 9.3CISA KEVRuntime
CVE-2026-33017: Langflow Code Injection Vulnerability
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parame...
CVE-2026-41940CVSS 9.3CISA KEVCMS
CVE-2026-41940: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CVE-2023-48788CVSS 9.8CISA KEVFirewall
CVE-2023-48788: Fortinet FortiClient EMS SQL Injection Vulnerability
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted...
CVE-2025-25257CVSS 9.8CISA KEVFirewall
CVE-2025-25257: Fortinet FortiWeb SQL Injection Vulnerability
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10...
CVE-2026-34197CVSS 8.8CISA KEVWeb
CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolo...
CVE-2026-31431CVSS 7.8CISA KEVLinux
CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in ...
CVE-2026-39987CVSS 9.3CISA KEVRuntime
CVE-2026-39987: Marimo Remote Code Execution Vulnerability
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitra...
CVE-2024-47575CVSS 9.8CISA KEVFirewall
CVE-2024-47575: Fortinet FortiManager Missing Authentication Vulnerability
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet Forti...
CVE-2026-21643CVSS 9.8CISA KEVFirewall
CVE-2026-21643: Fortinet FortiClient EMS SQL Injection Vulnerability
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
CVE-2026-35273CVSS 9.8CISA KEVKnown Exploited
CVE-2026-35273: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with ne...
CVE-2024-7399CVSS 8.8CISA KEVKnown Exploited
CVE-2024-7399: Samsung MagicINFO 9 Server Path Traversal Vulnerability
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
CVE-2010-0249CVSS 8.8CISA KEVWindows
CVE-2010-0249: Microsoft Internet Explorer Use-After-Free Vulnerability
Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attacke...
CVE-2025-64446CVSS 9.8CISA KEVFirewall
CVE-2025-64446: Fortinet FortiWeb Path Traversal Vulnerability
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative comman...
CVE-2026-35616CVSS 9.8CISA KEVFirewall
CVE-2026-35616: Fortinet FortiClient EMS Improper Access Control Vulnerability
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
CVE-2026-20182CVSS 10.0CISA KEVNetwork
CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The s...
CVE-2026-20253CVSS 9.8CISA KEVDatabase
CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function Vulnerability
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service end...
CVE-2024-1708CVSS 8.4CISA KEVWindows
CVE-2024-1708: ConnectWise ScreenConnect Path Traversal Vulnerability
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
CVE-2025-29635CVSS 7.2CISA KEVKnown Exploited
CVE-2025-29635: D-Link DIR-823X Command Injection Vulnerability
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote comma...
CVE-2026-0257CVSS 7.8CISA KEVFirewall
CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted ...
CVE-2026-42208CVSS 9.3CISA KEVKnown Exploited
CVE-2026-42208: BerriAI LiteLLM SQL Injection Vulnerability
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing...
CVE-2009-3459CVSS 8.8CISA KEVMail
CVE-2009-3459: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009....
CVE-2026-24858CVSS 9.8CISA KEVFirewall
CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, Forti...
CVE-2026-9082CVSS 9.8CISA KEVCMS
CVE-2026-9082: Drupal Core SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9,...
CVE-2026-39808CVSS 9.8CISA KEVFirewall
CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
CVE-2026-1340CVSS 9.8CISA KEVVPN
CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVE-2026-3055CVSS 9.3CISA KEVKnown Exploited
CVE-2026-3055: Citrix NetScaler Out-of-Bounds Read Vulnerability
Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
CVE-2024-21762CVSS 9.8CISA KEVFirewall
CVE-2024-21762: Fortinet FortiOS Out-of-Bound Write Vulnerability
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through ...
CVE-2010-0806CVSS 8.8CISA KEVWindows
CVE-2010-0806: Microsoft Internet Explorer Use-After-Free Vulnerability
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object,...
CVE-2026-48907CVSS 10.0CISA KEVWeb
CVE-2026-48907: Widget Factory Joomla Content Editor Improper Access Control Vulnerability
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
CVE-2026-42271CVSS 8.7CISA KEVKnown Exploited
CVE-2026-42271: BerriAI LiteLLM Command Injection Vulnerability
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/l...
CVE-2025-34291CVSS 9.4CISA KEVKnown Exploited
CVE-2025-34291: Langflow Origin Validation Error Vulnerability
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie...
CVE-2026-34910CVSS 10.0CISA KEVKnown Exploited
CVE-2026-34910: Ubiquiti UniFi OS Improper Input Validation Vulnerability
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
CVE-2023-27351CVSS 7.5CISA KEVKnown Exploited
CVE-2023-27351: PaperCut NG/MF Improper Authentication Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class....
CVE-2026-50751CVSS 9.3CISA KEVMail
CVE-2026-50751: Check Point Security Gateway Improper Authentication Vulnerability
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
CVE-2025-59718CVSS 9.8CISA KEVFirewall
CVE-2025-59718: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.1...
CVE-2026-32202CVSS 4.3CISA KEVWindows
CVE-2026-32202: Microsoft Windows Protection Mechanism Failure Vulnerability
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-45498CVSS 4.0CISA KEVWindows
CVE-2026-45498: Microsoft Defender Denial of Service Vulnerability
Microsoft Defender Denial of Service Vulnerability
CVE-2023-21529CVSS 8.8CISA KEVWindows
CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2024-23113CVSS 9.8CISA KEVFirewall
CVE-2024-23113: Fortinet Multiple Products Format String Vulnerability
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 thro...
CVE-2026-33634CVSS 9.4CISA KEVContainers
CVE-2026-33634: Aquasecurity Trivy Embedded Malicious Code Vulnerability
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags ...
CVE-2025-58034CVSS 7.2CISA KEVFirewall
CVE-2025-58034: Fortinet FortiWeb OS Command Injection Vulnerability
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through ...
CVE-2009-1537CVSS 8.8CISA KEVWindows
CVE-2009-1537: Microsoft DirectX NULL Byte Overwrite Vulnerability
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a...
CVE-2024-21182CVSS 7.5CISA KEVKnown Exploited
CVE-2024-21182: Oracle WebLogic Server Unspecified Vulnerability
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via...
CVE-2020-9715CVSS 7.8CISA KEVKnown Exploited
CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability
Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2009-0238CVSS 8.8CISA KEVWindows
CVE-2009-0238: Microsoft Office Remote Code Execution
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attac...
CVE-2026-20230CVSS 8.6CISA KEVNetwork
CVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks t...
CVE-2026-25089CVSS 9.8CISA KEVFirewall
CVE-2026-25089: Fortinet FortiSandbox OS Command Injection Vulnerability
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5,...
CVE-2026-6973CVSS 7.2CISA KEVVPN
CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
CVE-2026-0300CVSS 9.3CISA KEVFirewall
CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewal...
CVE-2025-32756CVSS 9.8CISA KEVFirewall
CVE-2025-32756: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 throug...
CVE-2026-48282CVSS 10.0CISA KEVKnown Exploited
CVE-2026-48282: Adobe ColdFusion Path Traversal Vulnerability
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of t...
CVE-2024-1086CVSS 7.8CISA KEVLinux
CVE-2024-1086: Linux Kernel Use-After-Free Vulnerability
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_...
CVE-2026-45247CVSS 9.3CISA KEVWeb
CVE-2026-45247: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie....
CVE-2026-20245CVSS 7.8CISA KEVNetwork
CVE-2026-20245: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execu...
CVE-2008-4128CVSS 4.3CISA KEVMail
CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /l...
CVE-2026-32201CVSS 6.5CISA KEVWindows
CVE-2026-32201: Microsoft SharePoint Server Improper Input Validation Vulnerability
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2012-1854CVSS 7.8CISA KEVWindows
CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privilege...