CVE-2013-0629 | HIGH | 7.5 | 0.65902 | 78.07 | Yes | No | 2022-03-07 | 2022-03-07 | cisa.gov, euvd | Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories. |
CVE-2023-29552 | HIGH | 7.5 | 0.65873 | 78.06 | Yes | No | 2023-11-08 | 2023-11-08 | cisa.gov, euvd | The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to…The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor. |
CVE-2013-0631 | HIGH | 7.5 | 0.65867 | 78.05 | Yes | No | 2022-03-07 | 2022-03-07 | cisa.gov, euvd | Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server. |
CVE-2023-6549 | HIGH | 8.2 | 0.57633 | 77.97 | Yes | No | 2024-01-17 | 2024-01-17 | cisa.gov, euvd | Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a …Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. |
CVE-2023-49897 | HIGH | 8.8 | 0.50729 | 77.96 | Yes | No | 2023-12-21 | 2023-12-21 | cisa.gov, euvd | FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network. |
CVE-2019-3568 | CRITICAL | 9.8 | 0.39166 | 77.91 | Yes | No | 2022-04-19 | 2022-04-19 | cisa.gov, euvd | A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a …A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. |
CVE-2016-11021 | HIGH | 7.2 | 0.6887 | 77.9 | Yes | No | 2022-03-25 | 2022-03-25 | cisa.gov, euvd | setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command. |
CVE-2023-41763 | MEDIUM | 5.3 | 0.90353 | 77.82 | Yes | No | 2023-10-10 | 2023-10-10 | cisa.gov, euvd | Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation. |
CVE-2023-21608 | HIGH | 7.8 | 0.61475 | 77.72 | Yes | No | 2023-10-10 | 2023-10-10 | cisa.gov, euvd | Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user. |
CVE-2013-0431 | MEDIUM | 5.3 | 0.89987 | 77.7 | Yes | No | 2022-05-25 | 2022-05-25 | cisa.gov, euvd | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sand…Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox. |
CVE-2021-3493 | HIGH | 8.8 | 0.49166 | 77.41 | Yes | Yes | 2022-10-20 | 2022-10-20 | cisa.gov, euvd, packetstorm | The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, …The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation. |
CVE-2019-13720 | HIGH | 8.8 | 0.4914 | 77.4 | Yes | No | 2022-05-23 | 2022-05-23 | cisa.gov, euvd | Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a cr…Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2023-5217 | HIGH | 8.8 | 0.49013 | 77.35 | Yes | No | 2023-10-02 | 2023-10-02 | cisa.gov, euvd | Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit he…Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome. |
CVE-2020-8655 | HIGH | 7.8 | 0.60075 | 77.23 | Yes | No | 2021-11-03 | 2021-11-03 | cisa.gov, euvd | EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scrip…EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7. |
CVE-2021-38163 | CRITICAL | 9.9 | 0.36018 | 77.21 | Yes | No | 2022-06-09 | 2022-06-09 | cisa.gov, euvd | SAP NetWeaver contains a vulnerability that allows unrestricted file upload.SAP NetWeaver contains a vulnerability that allows unrestricted file upload. |
CVE-2020-16009 | HIGH | 8.8 | 0.48574 | 77.2 | Yes | No | 2021-11-03 | 2021-11-03 | cisa.gov, euvd | Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a…Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. |
CVE-2019-8394 | HIGH | 7.5 | 0.63336 | 77.17 | Yes | No | 2021-11-03 | 2021-11-03 | cisa.gov, euvd | Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page custo…Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization. |
CVE-2017-11774 | HIGH | 7.8 | 0.59893 | 77.16 | Yes | No | 2021-11-03 | 2021-11-03 | cisa.gov, euvd | Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitat…Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands. |
CVE-2006-2492 | HIGH | 8.8 | 0.48387 | 77.14 | Yes | No | 2022-06-08 | 2022-06-08 | cisa.gov, euvd | Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code. |
CVE-2024-21338 | HIGH | 7.8 | 0.5981 | 77.13 | Yes | No | 2024-02-13 | 2026-07-31 | cisa.gov, euvd, nvd | Windows Kernel Elevation of Privilege VulnerabilityWindows Kernel Elevation of Privilege Vulnerability |
CVE-2021-20016 | CRITICAL | 9.8 | 0.36952 | 77.13 | Yes | No | 2021-11-03 | 2021-11-03 | cisa.gov, euvd | SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated a…SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker. |
CVE-2022-28810 | MEDIUM | 6.8 | 0.70966 | 77.04 | Yes | No | 2023-03-07 | 2023-03-07 | cisa.gov, euvd | Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password cha…Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset. |
CVE-2016-1646 | HIGH | 8.8 | 0.4811 | 77.04 | Yes | No | 2022-06-08 | 2022-06-08 | cisa.gov, euvd | Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibl…Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. |
CVE-2019-19006 | CRITICAL | 9.8 | 0.36615 | 77.02 | Yes | No | 2026-02-03 | 2026-02-03 | cisa.gov, euvd | Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authenticati…Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin. |
CVE-2020-13965 | MEDIUM | 6.3 | 0.76596 | 77.01 | Yes | No | 2024-06-26 | 2024-06-26 | cisa.gov, euvd | Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML a…Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment. |
CVE-2021-21973 | MEDIUM | 5.3 | 0.88012 | 77.0 | Yes | No | 2022-03-07 | 2022-03-07 | cisa.gov, euvd | VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin…VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure. |
CVE-2025-2775 | CRITICAL | 9.3 | 0.42244 | 76.99 | Yes | No | 2025-07-22 | 2025-07-22 | cisa.gov, euvd | SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allo…SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives. |
CVE-2024-30088 | HIGH | 7.0 | 0.68202 | 76.87 | Yes | No | 2024-06-11 | 2026-08-04 | cisa.gov, euvd, nvd | Windows Kernel Elevation of Privilege VulnerabilityWindows Kernel Elevation of Privilege Vulnerability |
CVE-2010-1428 | HIGH | 7.5 | 0.62308 | 76.81 | Yes | No | 2022-05-25 | 2022-05-25 | cisa.gov, euvd | Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this blo…Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information. |
CVE-2022-31199 | CRITICAL | 9.8 | 0.36009 | 76.8 | Yes | No | 2023-07-11 | 2023-07-11 | cisa.gov, euvd | Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthen…Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling. |
CVE-2014-4123 | HIGH | 8.8 | 0.47259 | 76.74 | Yes | No | 2022-05-25 | 2022-05-25 | cisa.gov, euvd | Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site. |
CVE-2009-0557 | HIGH | 7.8 | 0.58551 | 76.69 | Yes | No | 2022-06-08 | 2022-06-08 | cisa.gov, euvd | Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file wi…Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object. |
CVE-2016-7262 | HIGH | 7.8 | 0.58204 | 76.57 | Yes | No | 2022-03-03 | 2022-03-03 | cisa.gov, euvd | A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vu…A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands. |
CVE-2025-0411 | HIGH | 7.0 | 0.67071 | 76.47 | Yes | No | 2025-02-06 | 2025-02-06 | cisa.gov, euvd | 7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to e…7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user. |
CVE-2016-7193 | HIGH | 7.8 | 0.57705 | 76.4 | Yes | No | 2022-03-03 | 2022-03-03 | cisa.gov, euvd | Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution.Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution. |
CVE-2017-0101 | HIGH | 7.8 | 0.57482 | 76.32 | Yes | No | 2022-03-15 | 2022-03-15 | cisa.gov, euvd | A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory. |
CVE-2010-5330 | CRITICAL | 9.8 | 0.34641 | 76.32 | Yes | No | 2022-04-15 | 2022-04-15 | cisa.gov, euvd | Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi. |
CVE-2026-60137 | MEDIUM | 5.9 | 0.79029 | 76.26 | Yes | Yes | 2026-07-17 | 2026-07-29 | cisa.gov, euvd, github, nvd, packetstorm | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query…WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter. |
CVE-2023-35081 | HIGH | 7.2 | 0.63577 | 76.05 | Yes | No | 2023-07-31 | 2023-07-31 | cisa.gov, euvd | Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicio…Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable). |
CVE-2024-29988 | HIGH | 8.8 | 0.45151 | 76.0 | Yes | No | 2024-04-30 | 2024-04-30 | cisa.gov, euvd | Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) f…Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file. |
CVE-2024-57968 | CRITICAL | 9.9 | 0.32514 | 75.98 | Yes | No | 2025-03-10 | 2025-03-10 | cisa.gov, euvd | Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unint…Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx. |
CVE-2023-5631 | MEDIUM | 6.1 | 0.75873 | 75.96 | Yes | No | 2023-10-26 | 2023-10-26 | cisa.gov, euvd | Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript c…Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code. |
CVE-2015-2425 | HIGH | 8.8 | 0.44851 | 75.9 | Yes | No | 2022-05-25 | 2022-05-25 | cisa.gov, euvd | Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-servi…Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). |
CVE-2020-2509 | CRITICAL | 9.8 | 0.33381 | 75.88 | Yes | No | 2022-04-11 | 2022-04-11 | cisa.gov, euvd | QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution. |
CVE-2015-1701 | HIGH | 7.8 | 0.562 | 75.87 | Yes | No | 2022-03-03 | 2022-03-03 | cisa.gov, euvd | An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute…An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges. |
CVE-2015-2419 | HIGH | 8.8 | 0.44688 | 75.84 | Yes | No | 2022-03-28 | 2022-03-28 | cisa.gov, euvd | JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a…JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. |
CVE-2023-36847 | MEDIUM | 5.3 | 0.84573 | 75.8 | Yes | No | 2023-11-13 | 2023-11-13 | cisa.gov, euvd | Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-…Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. |
CVE-2024-9380 | HIGH | 7.2 | 0.62785 | 75.77 | Yes | No | 2024-10-09 | 2024-10-09 | cisa.gov, euvd | Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authen…Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS. |
CVE-2021-33742 | HIGH | 7.5 | 0.59139 | 75.7 | Yes | No | 2021-11-03 | 2021-11-03 | cisa.gov, euvd | Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution. |
CVE-2019-17026 | HIGH | 8.8 | 0.43677 | 75.49 | Yes | No | 2021-11-03 | 2021-11-03 | cisa.gov, euvd | Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when…Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements. |