Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2024-9465 | not reported | — | Listed | Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database c... | — |
| CVE-2024-1212 | not reported | — | Listed | Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system... | — |
| CVE-2024-0012 | not reported | — | Listed | Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products,... | — |
| CVE-2024-9474 | not reported | — | Listed | Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based manageme... | — |
| CVE-2024-38812 | not reported | — | Listed | VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability c... | — |
| CVE-2024-38813 | not reported | — | Listed | VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network acce... | — |
| CVE-2024-44308 | not reported | — | Listed | Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lea... | — |
| CVE-2024-44309 | not reported | — | Listed | Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lea... | — |
| CVE-2024-21287 | not reported | — | Listed | Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the... | — |
| CVE-2023-28461 | not reported | — | Listed | Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read loca... | — |
| CVE-2023-45727 | not reported | — | Listed | North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vu... | — |
| CVE-2024-11680 | not reported | — | Listed | ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modifica... | — |
| CVE-2024-11667 | not reported | — | Listed | Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or... | — |
| CVE-2024-51378 | not reported | — | Listed | CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary comm... | — |
| CVE-2024-49138 | not reported | — | Listed | Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to e... | — |
| CVE-2024-20767 | not reported | — | Listed | Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an... | — |
| CVE-2024-35250 | not reported | — | Listed | Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privil... | — |
| CVE-2024-55956 | not reported | — | Listed | Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could... | — |
| CVE-2018-14933 | not reported | — | Listed | NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharact... | — |
| CVE-2022-23227 | not reported | — | Listed | NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR arch... | — |