Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2021-27104 | not reported | — | Listed | Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints. | — |
| CVE-2021-42292 | not reported | — | Listed | A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution. | — |
| CVE-2021-42321 | not reported | — | Listed | An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution... | — |
| CVE-2021-40449 | not reported | — | Listed | Unspecified vulnerability allows for an authenticated user to escalate privileges. | — |
| CVE-2021-22204 | not reported | — | Listed | Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing t... | — |
| CVE-2021-44077 | not reported | — | Listed | Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to un... | — |
| CVE-2021-40438 | not reported | — | Listed | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apa... | — |
| CVE-2021-37415 | not reported | — | Listed | Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authenticatio... | — |
| CVE-2018-14847 | not reported | — | Listed | MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write a... | — |
| CVE-2020-11261 | not reported | — | Listed | Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto,... | — |
| CVE-2021-44228 | not reported | — | Listed | Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for r... | — |
| CVE-2019-10758 | not reported | — | Listed | mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. | — |
| CVE-2020-8816 | not reported | — | Listed | Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. | — |
| CVE-2020-17463 | not reported | — | Listed | FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. | — |
| CVE-2010-1871 | not reported | — | Listed | JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote cod... | — |
| CVE-2017-17562 | not reported | — | Listed | Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. | — |
| CVE-2021-44168 | not reported | — | Listed | Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files. | — |
| CVE-2019-0193 | not reported | — | Listed | The optional Apache Solr module DataImportHandler contains a code injection vulnerability. | — |
| CVE-2019-7238 | not reported | — | Listed | Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution... | — |
| CVE-2021-35394 | not reported | — | Listed | RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution. | — |