Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-39932 | critical | 9.1 | No | OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php... | 2026-09-01 |
| CVE-2026-5480 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descri... | 2026-09-01 |
| CVE-2024-6840 | medium | 6.6 | No | An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an... | 2026-06-17 |
| CVE-2024-45770 | medium | 4.4 | No | A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP syst... | 2026-06-17 |
| CVE-2024-45769 | medium | 5.5 | No | A vulnerability was found in Performance Co-Pilot (PCP). This flaw allows an attacker to send specially crafted data to the system, which co... | 2026-06-17 |
| CVE-2020-29583 | not reported | — | Listed | Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocume... | — |
| CVE-2019-8394 | not reported | — | Listed | Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page custo... | — |
| CVE-2020-10189 | not reported | — | Listed | Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution. | — |
| CVE-2021-40539 | not reported | — | Listed | Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code... | — |
| CVE-2021-27561 | not reported | — | Listed | Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution. | — |
| CVE-2019-9978 | not reported | — | Listed | WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerabilit... | — |
| CVE-2020-11738 | not reported | — | Listed | WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that al... | — |
| CVE-2020-25213 | not reported | — | Listed | WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and uploa... | — |
| CVE-2020-4006 | not reported | — | Listed | VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. A... | — |
| CVE-2021-21985 | not reported | — | Listed | VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by defau... | — |
| CVE-2021-21972 | not reported | — | Listed | VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with... | — |
| CVE-2020-3952 | not reported | — | Listed | VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Co... | — |
| CVE-2021-22005 | not reported | — | Listed | VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to ex... | — |
| CVE-2020-3950 | not reported | — | Listed | VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of... | — |
| CVE-2020-3992 | not reported | — | Listed | VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 4... | — |