Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2020-29574 | not reported | — | Listed | CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL st... | — |
| CVE-2020-15069 | not reported | — | Listed | Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature. | — |
| CVE-2025-0994 | not reported | — | Listed | Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack... | — |
| CVE-2025-21418 | not reported | — | Listed | Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escala... | — |
| CVE-2024-40890 | not reported | — | Listed | Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenti... | — |
| CVE-2024-40891 | not reported | — | Listed | Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an... | — |
| CVE-2024-41710 | not reported | — | Listed | Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability... | — |
| CVE-2025-24200 | not reported | — | Listed | Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a l... | — |
| CVE-2024-57727 | not reported | — | Listed | SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download... | — |
| CVE-2024-53704 | not reported | — | Listed | SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to... | — |
| CVE-2025-23209 | not reported | — | Listed | Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code... | — |
| CVE-2025-0111 | not reported | — | Listed | Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated... | — |
| CVE-2025-24989 | not reported | — | Listed | Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a ne... | — |
| CVE-2017-3066 | not reported | — | Listed | Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution. | — |
| CVE-2024-20953 | not reported | — | Listed | Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network... | — |
| CVE-2024-49035 | not reported | — | Listed | Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges. | — |
| CVE-2023-34192 | not reported | — | Listed | Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to... | — |
| CVE-2023-20118 | not reported | — | Listed | Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful... | — |
| CVE-2022-43939 | not reported | — | Listed | Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attack... | — |
| CVE-2022-43769 | not reported | — | Listed | Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into... | — |