CVE Tracker
Track known exploited vulnerabilities, CISA KEV alerts, and linked threat intelligence.
2,235
Total CVEs
1,590
CISA KEV
41
Known Exploits
8.8
Avg CVSS Score
Showing 20 of 1,590 CVEs · CISA KEV
LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability.
Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.
Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.
D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.
Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software.
Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.
VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution.
smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.
Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.
Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer.
Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.
Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands
Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution.