Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2020-28949 | not reported | — | Listed | PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Appli... | — |
| CVE-2020-36193 | not reported | — | Listed | PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP... | — |
| CVE-2021-31010 | not reported | — | Listed | In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions. | — |
| CVE-2021-38406 | not reported | — | Listed | Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) re... | — |
| CVE-2021-39226 | not reported | — | Listed | Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot... | — |
| CVE-2022-2294 | not reported | — | Listed | WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allow... | — |
| CVE-2022-22963 | not reported | — | Listed | When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a... | — |
| CVE-2022-24112 | not reported | — | Listed | Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution. | — |
| CVE-2022-24706 | not reported | — | Listed | Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrati... | — |
| CVE-2022-26352 | not reported | — | Listed | dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal,... | — |
| CVE-2011-1823 | not reported | — | Listed | The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain... | — |
| CVE-2011-4723 | not reported | — | Listed | The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information. | — |
| CVE-2017-5521 | not reported | — | Listed | Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server. | — |
| CVE-2018-2628 | not reported | — | Listed | Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromis... | — |
| CVE-2018-6530 | not reported | — | Listed | Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands. | — |
| CVE-2018-7445 | not reported | — | Listed | In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to... | — |
| CVE-2020-9934 | not reported | — | Listed | Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensit... | — |
| CVE-2022-26258 | not reported | — | Listed | D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution. | — |
| CVE-2022-27593 | not reported | — | Listed | Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which c... | — |
| CVE-2022-3075 | not reported | — | Listed | Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer... | — |