Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2024-20439 | not reported | — | Listed | Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an aff... | — |
| CVE-2025-24813 | not reported | — | Listed | Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malic... | — |
| CVE-2025-22457 | not reported | — | Listed | Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthentic... | — |
| CVE-2025-31161 | not reported | — | Listed | CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to a... | — |
| CVE-2025-30406 | not reported | — | Listed | Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys u... | — |
| CVE-2025-29824 | not reported | — | Listed | Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate... | — |
| CVE-2024-53197 | not reported | — | Listed | Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the syst... | — |
| CVE-2024-53150 | not reported | — | Listed | Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potenti... | — |
| CVE-2021-20035 | not reported | — | Listed | SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated att... | — |
| CVE-2025-31200 | not reported | — | Listed | Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing... | — |
| CVE-2025-31201 | not reported | — | Listed | Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Point... | — |
| CVE-2025-24054 | not reported | — | Listed | Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoof... | — |
| CVE-2025-1976 | not reported | — | Listed | Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitr... | — |
| CVE-2025-31324 | not reported | — | Listed | SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to u... | — |
| CVE-2023-44221 | not reported | — | Listed | SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenti... | — |
| CVE-2024-38475 | not reported | — | Listed | Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem lo... | — |
| CVE-2024-58136 | not reported | — | Listed | Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. Th... | — |
| CVE-2025-34028 | not reported | — | Listed | Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code. | — |
| CVE-2025-27363 | not reported | — | Listed | FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable... | — |
| CVE-2024-6047 | not reported | — | Listed | Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execut... | — |