CISA KEV Catalog

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file wit

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Den

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (compo

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior t

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a n

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint a

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated atta

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER toke

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privile

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote at

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension B

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Dir

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulti

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vul

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS de

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to a

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or tr

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated us

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software all

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was publish

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were publ

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20