Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1731 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-102490 3 Docker, Linux, Zammad 3 Docker, Linux Kernel, Zammad 2026-10-07 9.8 Critical
All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
CVE-2026-102489 3 Docker, Linux, Zammad 3 Docker, Linux Kernel, Zammad 2026-10-07 9.8 Critical
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
CVE-2026-88779 2 Citrix, Netscaler 4 Netscaler Application Delivery Controller, Netscaler Gateway, Adc and 1 more 2026-10-05 7.5 High
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
CVE-2026-104286 1 Fortinet 1 Fortimail 2026-10-02 9.8 Critical
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
CVE-2021-27065 1 Microsoft 1 Exchange Server 2026-10-01 7.8 High
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26858 1 Microsoft 1 Exchange Server 2026-10-01 7.8 High
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26411 1 Microsoft 17 Edge, Internet Explorer, Windows 10 1507 and 14 more 2026-10-01 8.8 High
Internet Explorer Memory Corruption Vulnerability
CVE-2021-20023 2 Microsoft, Sonicwall 20 Windows, Email Security, Email Security Appliance 3300 and 17 more 2026-10-01 4.9 Medium
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
CVE-2021-20022 2 Microsoft, Sonicwall 20 Windows, Email Security, Email Security Appliance 3300 and 17 more 2026-10-01 7.2 High
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
CVE-2020-12812 1 Fortinet 1 Fortios 2026-10-01 7.5 High
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
CVE-2019-2725 1 Oracle 8 Agile Product Lifecycle Management, Communications Converged Application Server, Peoplesoft Enterprise Peopletools and 5 more 2026-10-01 9.8 Critical
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2018-19323 1 Gigabyte 4 Aorus Graphics Engine, Gigabyte App Center, Oc Guru Ii and 1 more 2026-10-01 9.8 Critical
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
CVE-2022-27924 1 Synacor 1 Zimbra Collaboration Suite 2026-10-01 9.8 Critical
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.
CVE-2022-30333 4 Debian, Linux, Opengroup and 1 more 4 Debian Linux, Linux Kernel, Unix and 1 more 2026-10-01 9.8 Critical
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
CVE-2020-0796 1 Microsoft 4 Windows 10 1903, Windows 10 1909, Windows Server 1903 and 1 more 2026-10-01 10 Critical
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
CVE-2010-2861 1 Adobe 1 Coldfusion 2026-10-01 7.5 High
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
CVE-2010-0738 1 Redhat 1 Jboss Enterprise Application Platform 2026-10-01 3.7 Low
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CVE-2021-21975 1 Vmware 3 Cloud Foundation, Vrealize Operations Manager, Vrealize Suite Lifecycle Manager 2026-10-01 9.8 Critical
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
CVE-2025-0282 1 Ivanti 3 Connect Secure, Neurons For Zero-trust Access, Policy Secure 2026-10-01 9 Critical
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2024-9379 1 Ivanti 1 Endpoint Manager Cloud Services Appliance 2026-10-01 6.5 Medium
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.