Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2019-10149 | not reported | — | Listed | Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. | — |
| CVE-2018-13383 | not reported | — | Listed | A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users. | — |
| CVE-2018-13382 | not reported | — | Listed | An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to mo... | — |
| CVE-2019-9670 | not reported | — | Listed | Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd compone... | — |
| CVE-2019-1458 | not reported | — | Listed | A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP... | — |
| CVE-2020-6572 | not reported | — | Listed | Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page. | — |
| CVE-2021-36260 | not reported | — | Listed | A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation. | — |
| CVE-2021-22017 | not reported | — | Listed | Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. | — |
| CVE-2020-13927 | not reported | — | Listed | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication. | — |
| CVE-2020-11978 | not reported | — | Listed | A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow. | — |
| CVE-2020-13671 | not reported | — | Listed | Improper sanitization in the extension file names is present in Drupal core. | — |
| CVE-2020-14864 | not reported | — | Listed | Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to a... | — |
| CVE-2021-22991 | not reported | — | Listed | The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access... | — |
| CVE-2021-21315 | not reported | — | Listed | In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attacke... | — |
| CVE-2021-33766 | not reported | — | Listed | Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffi... | — |
| CVE-2021-40870 | not reported | — | Listed | Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via director... | — |
| CVE-2021-25298 | not reported | — | Listed | Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. | — |
| CVE-2021-25297 | not reported | — | Listed | Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. | — |
| CVE-2021-25296 | not reported | — | Listed | Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. | — |
| CVE-2021-32648 | not reported | — | Listed | In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account usi... | — |