Filter public vulnerability entries by severity / channel / vendor / time.
CVE-2026-48907 · 2026-09-02 · pending_review
Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.
CVE-2026-45659 · 2026-09-02 · pending_review
Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.
CVE-2026-34197 · 2026-09-02 · pending_review
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
CVE-2026-32201 · 2026-09-02 · pending_review
Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-20963 · 2026-09-02 · pending_review
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
CVE-2025-68645 · 2026-09-02 · pending_review
Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allow…
CVE-2025-54236 · 2026-09-02 · pending_review
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
CVE-2025-24813 · 2026-09-02 · pending_review
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request.
CVE-2024-4577 · 2026-09-02 · pending_review
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
CVE-2024-45195 · 2026-09-02 · pending_review
Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.
CVE-2024-38475 · 2026-09-02 · pending_review
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/…
CVE-2024-27348 · 2026-09-02 · pending_review
Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.
CVE-2024-23897 · 2026-09-02 · pending_review
Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
CVE-2024-21182 · 2026-09-02 · pending_review
Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can resul…
CVE-2023-7028 · 2026-09-02 · pending_review
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an ac…
CVE-2023-46604 · 2026-09-02 · pending_review
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire pro…
CVE-2023-36845 · 2026-09-02 · pending_review
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafte…
CVE-2023-36844 · 2026-09-02 · pending_review
Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted reques…
CVE-2023-33246 · 2026-09-02 · pending_review
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configurat…
CVE-2023-29357 · 2026-09-02 · pending_review
Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This atta…
CVE-2023-27524 · 2026-09-02 · pending_review
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configu…
CVE-2023-23752 · 2026-09-02 · pending_review
Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.
CVE-2023-22518 · 2026-09-02 · pending_review
Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality si…
CVE-2023-22515 · 2026-09-02 · pending_review
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
CVE-2023-21839 · 2026-09-02 · pending_review
Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.
CVE-2022-33891 · 2026-09-03 · pending_review
Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.
CVE-2022-26138 · 2026-09-03 · pending_review
Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all conten…
CVE-2022-24706 · 2026-09-03 · pending_review
Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.
CVE-2022-24086 · 2026-09-04 · pending_review
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.
CVE-2021-43798 · 2026-09-02 · pending_review
Grafana contains a path traversal vulnerability that could allow access to local files.
CVE-2021-39935 · 2026-09-02 · pending_review
GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.
CVE-2021-39226 · 2026-09-03 · pending_review
Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.
CVE-2021-26086 · 2026-09-02 · pending_review
Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.
CVE-2021-26085 · 2026-09-03 · pending_review
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
CVE-2021-26084 · 2026-09-04 · pending_review
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
CVE-2021-22175 · 2026-09-02 · pending_review
GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.
CVE-2020-5410 · 2026-09-03 · pending_review
Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.
CVE-2020-2883 · 2026-09-02 · pending_review
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.
CVE-2020-17519 · 2026-09-02 · pending_review
Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.
CVE-2020-14883 · 2026-09-04 · pending_review
Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
CVE-2020-13927 · 2026-09-04 · pending_review
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
CVE-2020-13671 · 2026-09-04 · pending_review
Improper sanitization in the extension file names is present in Drupal core.
CVE-2020-11978 · 2026-09-04 · pending_review
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
CVE-2020-11738 · 2026-09-04 · pending_review
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard.…
CVE-2019-1003029 · 2026-09-03 · pending_review
Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.
CVE-2019-0211 · 2026-09-04 · pending_review
Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileg…
CVE-2018-2628 · 2026-09-03 · pending_review
Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.
CVE-2018-15133 · 2026-09-02 · pending_review
Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption ke…
CVE-2018-14667 · 2026-09-02 · pending_review
Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using…
CVE-2018-1000861 · 2026-09-04 · pending_review
A code execution vulnerability exists in the Stapler web framework used by Jenkins