Recently added to KEV

Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with…

Ivanti · Connect Secure · published 3 Nov 2026

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root,…

Ivanti · Connect Secure · published 15 Oct 2026

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software · published 28 Oct 2026

Integer Overflow or Wraparound in GitLab

GitLab · GitLab · published 13 Oct 2026

ESX insufficient logging vulnerability

VMware · Cloud Foundation · published 30 Jul 2026

net: skbuff: preserve shared-frag marker during coalescing

Linux · Linux · published 23 May 2026

Out-of-Bounds Write in Google Brotli Decoder

Google · Brotli · published 22 Oct 2026

Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

Adobe · Adobe Commerce · published 14 Jul 2026

RCE via stale global state

PHP Group · PHP · published 21 Oct 2026

RCE via OOM corruption

PHP Group · PHP · published 21 Oct 2026

Security Advisory 0199

Arista Networks · VeloCloud Orchestrator · published 22 Oct 2026

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September…

Collabora · Collabora Online - Built-in CODE Server · published 14 Oct 2026

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an…

Siemens · Siemens Software Center · published 15 Oct 2026

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM…

EG Secure Solutions Inc. · SiteGuard Server Edition for Apache httpd · published 14 Oct 2026

Plex Media Server arbitrary file write

Plex · Media Server · published 23 Sept 2026

Plex Media Server arbitrary-host SSRF

Plex · Media Server · published 23 Sept 2026

Plex Media Server URL injection

Plex · Media Server · published 23 Sept 2026

Plex Media Server SSRF

Plex · Media Server · published 23 Sept 2026

Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

BeyondTrust · Remote Support · published 15 Oct 2026

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0…

Fortinet · FortiOS · published 14 Apr 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.…

Atlassian · Bamboo Data Center · published 5 Oct 2026

PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

Palo Alto Networks · Cloud NGFW · published 14 Oct 2026

Cisco Secure Email Gateway Arbitrary File Write Vulnerability

Cisco · Cisco Secure Email · published 14 Oct 2026

Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

Ahsay · AhsayCBS · published 4 Oct 2026

Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

Ahsay · AhsayCBS · published 4 Oct 2026

Windows Shell Security Feature Bypass Vulnerability

Microsoft · Microsoft Edge (Chromium-based) · published 13 Oct 2026

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…

Ivanti · Connect Secure · published 13 Oct 2026

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can…

Product not named · published 19 Apr 2023

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an…

Product not named · published 22 Jan 2021

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute…

Product not named · published 26 Apr 2016

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon…

Product not named · published 29 Jul 2015

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Product not named · published 18 May 2015

Memory overflow vulnerability leading to Denial of Service

NetScaler · ADC · published 4 Oct 2026

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

Zammad GmbH · Zammad · published 30 Sept 2026

Undisclosed RCE in Zammad v6.3 and higher

Zammad GmbH · Zammad · published 30 Sept 2026

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0…

Fortinet · FortiMail · published 1 Oct 2026

Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

Cisco · Cisco Catalyst SD-WAN Manager · published 30 Sept 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1,…

Apple · iOS and iPadOS · published 28 Sept 2026

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

Citrix NetScaler · ADC · published 27 Sept 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

Citrix NetScaler · ADC · published 27 Sept 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…

WordPress · WordPress · published 22 Sept 2026

SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

Mikrotik · RouterOS · published 5 Sept 2026

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft · Microsoft SharePoint Enterprise Server 2016 · published 11 Aug 2026

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe · Adobe Commerce · published 11 Aug 2026

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

WSO2 · WSO2 Universal Gateway · published 6 Aug 2026

BIG-IP APM OAuth vulnerability

F5 · BIG-IP · published 22 Sept 2026

Directory Traversal and File upload allows execution of arbitrary script on the Management Server

checkpoint · Quantum Security Management · published 22 Sept 2026

Security Advisory 0183

Arista Networks · VeloCloud Orchestrator (VCO) On-Prem · published 22 Sept 2026

Improper Certificate Validation in Quantum Security Gateway

checkpoint · Quantum Security Gateway · published 9 Sept 2026

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based,…

Zyxel · GS1900-48HPv2 firmware · published 16 Jun 2026

netfilter: bridge: make ebt_snat ARP rewrite writable

Linux · Linux · published 25 Jun 2026

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

Linux · Linux · published 13 Oct 2025

tls: fix handling of zero-length records on the rx_list

Linux · Linux · published 5 Sept 2025

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build…

Acronis · Acronis Backup plugin for cPanel & WHM · published 17 Sept 2026

Cisco Identity Services Engine Authentication Bypass Vulnerability

Cisco · Cisco Identity Services Engine Software · published 16 Sept 2026

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of…

Google · Android · published 15 Sept 2026

Cisco Secure Email Gateway SQL Injection Vulnerability

Cisco · Cisco Secure Email · published 14 Sept 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

GitLab · GitLab · published 12 Sept 2026

ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions

ConnectWise · ScreenConnect · published 8 Sept 2026

Anonymous user token generation exposure in JFrog Artifactory

jfrog · artifactory · published 12 Aug 2026

Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation

jfrog · artifactory · published 27 Jul 2026

SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

Mikrotik · RouterOS · published 5 Sept 2026

Kernel memory disclosure and denial of service in MikroTik RouterOS btest service

Mikrotik · RouterOS · published 5 Sept 2026

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML…

Google · Chrome · published 9 Sept 2026

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490

NetScaler · ADC · published 19 Aug 2026

Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability

Cisco · Cisco Secure Firewall Management Center (FMC) · published 4 Mar 2026

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0…

Fortinet · FortiSwitchManager · published 13 Jan 2026

Windows Update Stack Elevation of Privilege Vulnerability

Microsoft · Windows 11 version 23H2 · published 8 Sept 2026

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

Microsoft · Windows 10 Version 1607 · published 8 Sept 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

Adobe · Adobe Commerce · published 7 Sept 2026

pre-authentication remote code execution

N-able · N-central · published 6 Sept 2026

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…

Google · Chrome · published 3 Sept 2026

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000…

SonicWall · SMA1000 · published 1 Sept 2026

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote…

SonicWall · SMA1000 · published 1 Sept 2026

Potential authentication bypass leading to administrative access in Artifactory

jfrog · artifactory · published 28 Aug 2026

Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

Sangoma · Switchvox SMB Edition · published 17 Jul 2026

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

BerriAI · litellm · published 8 Jul 2026

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

kestra-io · kestra · published 26 Jun 2026

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Kludex · starlette · published 26 May 2026

PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

PaperCut · PaperCut MF/NG · published 28 Aug 2026

PaperCut MF/NG: Authentication Bypass

PaperCut · PaperCut MF/NG · published 28 Aug 2026

Authenticated users may write data outside the intended Docker cache path

jfrog · artifactory · published 12 Aug 2026

ipv6: account for fraggap on the paged allocation path

Linux · Linux · published 4 Jul 2026

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of…

Product not named · published 21 Nov 2023

Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service

NetScaler · ADC · published 30 Jun 2026

An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel…

kernel · published 25 Mar 2022

Deserialization of Untrusted Data

AjaxPro.2 · published 3 Dec 2021

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server…

Microsoft · Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR) · published 15 Jul 2019

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a…

Product not named · published 7 Dec 2015

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local…

Product not named · published 11 Aug 2015

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Gitea · Gitea · published 26 Aug 2026

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for…

Oracle Corporation · Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in · published 20 Jan 2026

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP…

Zimbra · Collaboration · published 13 Aug 2026

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and…

TrueConf · TrueConf Server · published 19 Aug 2026

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and…

TrueConf · TrueConf Server · published 19 Aug 2026

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

mlflow · mlflow · published 17 Aug 2026

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9,…

Apple · macOS · published 6 Aug 2026

vCenter directory-traversal vulnerability

VMware · Cloud Foundation · published 30 Jul 2026

Microsoft SharePoint Server Security Feature Bypass Vulnerability

Microsoft · Microsoft SharePoint Enterprise Server 2016 · published 14 Jul 2026

Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

Microsoft · Windows 10 Version 1607 · published 14 Apr 2026