Vulnerabilities
Fixes & KEVSeverity
OctNovDecJanFebMarAprMayJunJulAugSep
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
CyStack continuously tracks the latest global threats and develops solutions that help identify new vulnerabilities across your websites and systems.
Data is updated in the system
Data is updated in the CyStack VulnScan system.Learn more
| Vulnerability | Exploitation status | Fix | Provider | Affected product | Published | Severity |
|---|---|---|---|---|---|---|
CVE-2026-85706Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | Exploitation statusKEV | FixYes | ProviderGitLab | Affected productGitLab | Published09/12/2026 | SeverityCritical |
CVE-2026-87902 | Exploitation statusNot known exploited | FixYes | ProviderWordPress | Affected productWordPress | Published09/22/2026 | SeverityHigh |
CVE-2026-85046 | Exploitation statusKEV | FixYes | ProviderGoogle | Affected productChrome | Published09/03/2026 | SeverityHigh |
CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints | Exploitation statusKEV | FixYes | ProviderApache Software Foundation | Affected productApache Log4j2 | Published12/10/2021 | SeverityCritical |
CVE-2026-94127BIG-IP APM OAuth vulnerability | Exploitation statusKEV | FixYes | ProviderF5 | Affected productBIG-IP | Published09/22/2026 | SeverityCritical |
CVE-2026-88771A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands | Exploitation statusPublic exploit | FixYes | ProviderCitrix NetScaler | Affected productADC | Published09/27/2026 | SeverityCritical |
CVE-2026-41940WebPros cPanel and WHM Authentication Bypass via Login Flow | Exploitation statusKEV | FixYes | ProviderWebpros | Affected productcPanel | Published04/29/2026 | SeverityCritical |
CVE-2026-76460Cisco Identity Services Engine Authentication Bypass Vulnerability | Exploitation statusNot confirmed | FixNot confirmed | ProviderCisco | Affected productCisco Identity Services Engine Software | Published09/16/2026 | SeverityCritical |
CVE-2026-76461Cisco Secure Email Gateway SQL Injection Vulnerability | Exploitation statusKEV | FixNot confirmed | ProviderCisco | Affected productCisco Secure Email | Published09/14/2026 | SeverityCritical |
CVE-2026-82329Potential authentication bypass leading to administrative access in Artifactory | Exploitation statusKEV | FixYes | Providerjfrog | Affected productartifactory | Published08/28/2026 | SeverityCritical |
CVE-2026-75650Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Exploitation statusKEV | FixYes | ProviderAdobe | Affected productAdobe Commerce | Published09/07/2026 | SeverityCritical |
CVE-2026-20079Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability | Exploitation statusKEV | FixNot confirmed | ProviderCisco | Affected productCisco Secure Firewall Management Center (FMC) | Published03/04/2026 | SeverityCritical |
CVE-2026-86218Pre-authentication remote code execution in N-able N-central | Exploitation statusKEV | FixYes | ProviderN-able | Affected productN-central | Published09/06/2026 | SeverityCritical |
CVE-2026-43499rtmutex: Use waiter::task instead of current in remove_waiter() | Exploitation statusPublic exploit | FixYes | ProviderLinux | Affected productLinux | Published05/21/2026 | SeverityHigh |
CVE-2026-85102Improper Certificate Validation in Quantum Security Gateway | Exploitation statusKEV | FixNot confirmed | Providercheckpoint | Affected productQuantum Security Gateway | Published09/09/2026 | SeverityCritical |
CVE-2026-81578PaperCut MF/NG: Authentication Bypass | Exploitation statusKEV | FixYes | ProviderPaperCut | Affected productPaperCut MF/NG | Published08/28/2026 | SeverityHigh |
CVE-2026-83548 | Exploitation statusKEV | FixNot confirmed | ProviderSonicWall | Affected productSMA1000 | Published09/01/2026 | SeverityCritical |
CVE-2025-55182 | Exploitation statusKEV | FixYes | ProviderMeta | Affected productreact-server-dom-parcel | Published12/03/2025 | SeverityCritical |
CVE-2026-85880Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Exploitation statusKEV | FixYes | ProviderMicrosoft | Affected productWindows 10 Version 1607 | Published09/08/2026 | SeverityHigh |
CVE-2026-88772Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | Exploitation statusKEV | FixYes | ProviderCitrix NetScaler | Affected productADC | Published09/27/2026 | SeverityCritical |
CVE-2026-82078PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector | Exploitation statusKEV | FixYes | ProviderPaperCut | Affected productPaperCut MF/NG | Published08/28/2026 | SeverityCritical |
CVE-2026-19490NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 | Exploitation statusKEV | FixYes | ProviderNetScaler | Affected productADC | Published08/19/2026 | SeverityCritical |
CVE-2026-93616Directory Traversal and File upload allows execution of arbitrary script on the Management Server | Exploitation statusKEV | FixNot confirmed | Providercheckpoint | Affected productQuantum Security Management | Published09/22/2026 | SeverityCritical |
CVE-2026-3055Insufficient input validation leading to memory overread | Exploitation statusKEV | FixYes | ProviderNetScaler | Affected productADC | Published03/23/2026 | SeverityCritical |
CVE-2026-87491 | Exploitation statusKEV | FixYes | ProviderGoogle | Affected productChrome | Published09/09/2026 | SeverityHigh |
CVE-2026-58704 | Exploitation statusNot known exploited | FixNot confirmed | ProviderGoogle | Affected productAndroid | Published09/15/2026 | SeverityHigh |
CVE-2026-65660Microsoft SharePoint Server Remote Code Execution Vulnerability | Exploitation statusPublic exploit | FixYes | ProviderMicrosoft | Affected productMicrosoft SharePoint Enterprise Server 2016 | Published08/11/2026 | SeverityHigh |
CVE-2026-86060SSH session privilege manipulation via a crafted username in Mikrotik RouterOS | Exploitation statusKEV | FixYes | ProviderMikroTik | Affected productRouterOS | Published09/05/2026 | SeverityCritical |
CVE-2026-83549 | Exploitation statusKEV | FixNot confirmed | ProviderSonicWall | Affected productSMA1000 | Published09/01/2026 | SeverityHigh |
CVE-2022-26134 | Exploitation statusKEV | FixYes | ProviderAtlassian | Affected productConfluence Data Center | Published06/03/2022 | SeverityCritical |
CVE-2026-9586Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB | Exploitation statusKEV | FixYes | ProviderSangoma | Affected productSwitchvox SMB Edition | Published07/17/2026 | SeverityCritical |
CVE-2021-40444Microsoft MSHTML Remote Code Execution Vulnerability | Exploitation statusKEV | FixYes | ProviderMicrosoft | Affected productWindows 10 Version 1507 | Published09/15/2021 | SeverityHigh |
CVE-2026-67276SSH user impersonation possible in Mikrotik RouterOS | Exploitation statusPublic exploit | FixYes | ProviderMikroTik | Affected productRouterOS | Published09/05/2026 | SeverityCritical |
CVE-2025-29927Authorization Bypass in Next.js Middleware | Exploitation statusNot known exploited | FixYes | Providervercel | Affected productnext.js | Published03/21/2025 | SeverityCritical |
CVE-2026-35273 | Exploitation statusKEV | FixNot confirmed | ProviderOracle Corporation | Affected productPeopleSoft Enterprise PeopleTools | Published06/11/2026 | SeverityCritical |
CVE-2024-23897 | Exploitation statusKEV | FixNot confirmed | ProviderJenkins Project | Affected productJenkins | Published01/24/2024 | SeverityCritical |
CVE-2026-40639 | Exploitation statusNot known exploited | FixYes | ProviderDell | Affected productDell Edge Gateway 3000 | Published06/09/2026 | SeverityMedium |
CVE-2015-2051 | Exploitation statusKEV | FixNot confirmed | Providerdlink | Affected productdir-645_firmware | Published02/23/2015 | SeverityHigh |
CVE-2026-48842 | Exploitation statusNot known exploited | FixYes | ProviderRoundcube | Affected productWebmail | Published05/25/2026 | SeverityHigh |
CVE-2026-28576SQL Injection in Android Contacts Provider Can Expose the Contacts Database | Exploitation statusNot known exploited | FixNot confirmed | ProviderAndroid | Affected productAndroid | Published06/17/2026 | SeverityCritical |
CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability | Exploitation statusKEV | FixYes | ProviderMicrosoft | Affected productMicrosoft Exchange Server 2013 Cumulative Update 21 | Published03/02/2021 | SeverityCritical |
CVE-2026-85103Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding | Exploitation statusNot known exploited | FixNot confirmed | Providercheckpoint | Affected productQuantum Security Gateway | Published09/09/2026 | SeverityCritical |
CVE-2026-0768Langflow code Code Injection Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | ProviderLangflow | Affected productLangflow | Published01/23/2026 | SeverityCritical |
CVE-2026-81963Local privilege escalation through link following in Microsoft Windows Update Stack | Exploitation statusKEV | FixYes | ProviderMicrosoft | Affected productWindows 11 Version 23H2 | Published09/08/2026 | SeverityHigh |
CVE-2024-12847NETGEAR DGN setup.cgi OS Command Injection | Exploitation statusPublic exploit | FixYes | ProviderNETGEAR | Affected productDGN1000 | Published01/10/2025 | SeverityCritical |
CVE-2018-7600 | Exploitation statusKEV | FixYes | ProviderDrupal | Affected productDrupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 | Published03/29/2018 | SeverityCritical |
CVE-2026-2652Authentication Bypass in mlflow/mlflow | Exploitation statusPublic exploit | FixYes | ProviderMLflow | Affected productmlflow/mlflow | Published05/15/2026 | SeverityHigh |
CVE-2021-34527Windows Print Spooler Remote Code Execution Vulnerability | Exploitation statusKEV | FixYes | ProviderMicrosoft | Affected productWindows 10 Version 1507 | Published07/02/2021 | SeverityHigh |
CVE-2026-31431crypto: algif_aead - Revert to operating out-of-place | Exploitation statusKEV | FixYes | ProviderLinux | Affected productLinux | Published04/22/2026 | SeverityHigh |
CVE-2021-41773Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 | Exploitation statusKEV | FixYes | ProviderApache Software Foundation | Affected productApache HTTP Server | Published10/05/2021 | SeverityHigh |
CVE-2026-62911Microsoft Exchange Server Elevation of Privilege Vulnerability | Exploitation statusPublic exploit | FixYes | ProviderMicrosoft | Affected productMicrosoft Exchange Server 2016 Cumulative Update 23 | Published08/11/2026 | SeverityHigh |
CVE-2023-20198 | Exploitation statusKEV | FixNot confirmed | ProviderCisco | Affected productCisco IOS XE Software | Published10/16/2023 | SeverityCritical |
CVE-2026-93952Security Advisory 0183 | Exploitation statusKEV | FixYes | ProviderArista Networks | Affected productVeloCloud Orchestrator (VCO) On-Prem | Published09/22/2026 | SeverityCritical |
CVE-2026-5430Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover | Exploitation statusKEV | FixYes | ProviderWSO2 | Affected productWSO2 API Control Plane | Published08/06/2026 | SeverityCritical |
CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | Exploitation statusKEV | FixYes | ProviderWordPress | Affected productWordPress | Published07/17/2026 | SeverityCritical |
CVE-2026-2699EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC) | Exploitation statusPublic exploit | FixYes | ProviderProgress | Affected productShareFile Storage Zones Controller | Published04/02/2026 | SeverityCritical |
CVE-2026-51990 | Exploitation statusNot known exploited | FixYes | ProviderNot confirmed | Affected productNot confirmed | Published09/16/2026 | SeverityCritical |
CVE-2025-25249 | Exploitation statusKEV | FixYes | ProviderFortinet | Affected productFortiOS | Published01/13/2026 | SeverityHigh |
CVE-2026-72898Metabase SQL injection via password reset endpoint | Exploitation statusKEV | FixYes | Providermetabase | Affected productMetabase | Published08/10/2026 | SeverityCritical |
CVE-2021-42013Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) | Exploitation statusKEV | FixNot confirmed | ProviderApache Software Foundation | Affected productApache HTTP Server | Published10/07/2021 | SeverityCritical |
CVE-2026-44756Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing | Exploitation statusNot known exploited | FixNot confirmed | ProviderSAP_SE | Affected productSAP Extended Passport (EPP) Processing | Published09/08/2026 | SeverityCritical |
CVE-2025-5777NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread | Exploitation statusKEV | FixYes | ProviderNetScaler | Affected productADC | Published06/17/2025 | SeverityCritical |
CVE-2026-7273 | Exploitation statusKEV | FixNot confirmed | Providerzyxel | Affected productGS1900-10HP firmware | Published06/16/2026 | SeverityHigh |
CVE-2021-1675Windows Print Spooler Remote Code Execution Vulnerability | Exploitation statusKEV | FixYes | ProviderMicrosoft | Affected productWindows 10 Version 1507 | Published06/08/2021 | SeverityHigh |
CVE-2025-34036Shenzhen TVT CCTV-DVR Command Injection | Exploitation statusPublic exploit | FixNot confirmed | ProviderShenzhen TVT | Affected productCCTV-DVR | Published06/24/2025 | SeverityCritical |
CVE-2018-10562 | Exploitation statusKEV | FixNot confirmed | Providerdasannetworks | Affected productgpon_router_firmware | Published05/04/2018 | SeverityCritical |
CVE-2021-26084 | Exploitation statusKEV | FixYes | ProviderAtlassian | Affected productConfluence Data Center | Published08/30/2021 | SeverityCritical |
CVE-2026-67279SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS | Exploitation statusKEV | FixYes | ProviderMikroTik | Affected productRouterOS | Published09/05/2026 | SeverityMedium |
CVE-2026-63077 | Exploitation statusKEV | FixYes | ProviderJetBrains | Affected productTeamCity | Published07/27/2026 | SeverityCritical |
CVE-2026-84869ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | Exploitation statusKEV | FixYes | ProviderConnectWise | Affected productScreenConnect | Published09/08/2026 | SeverityCritical |
CVE-2026-32475Unauthenticated arbitrary file upload leading to remote code execution in Elementor's Elementor Pro plugin | Exploitation statusNot known exploited | FixYes | ProviderElementor | Affected productElementor Pro | Published08/19/2026 | SeverityCritical |
CVE-2026-91843Stack overflow in login process to the Security Management and Log Servers | Exploitation statusNot known exploited | FixNot confirmed | Providercheckpoint | Affected productQuantum Security Management | Published09/16/2026 | SeverityCritical |
CVE-2026-53266netfilter: bridge: make ebt_snat ARP rewrite writable | Exploitation statusKEV | FixYes | ProviderLinux | Affected productLinux | Published06/25/2026 | SeverityHigh |
CVE-2025-39964crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg | Exploitation statusKEV | FixYes | ProviderLinux | Affected productLinux | Published10/13/2025 | SeverityHigh |
CVE-2025-3248Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code | Exploitation statusKEV | FixYes | Providerlangflow-ai | Affected productlangflow | Published04/07/2025 | SeverityCritical |
CVE-2023-38646 | Exploitation statusNot confirmed | FixNot confirmed | Providermetabase | Affected productMetabase | Published07/21/2023 | SeverityCritical |
CVE-2019-19781 | Exploitation statusKEV | FixYes | Providercitrix | Affected productapplication_delivery_controller_firmware | Published12/27/2019 | SeverityCritical |
CVE-2024-24919Information disclosure | Exploitation statusKEV | FixYes | Providercheckpoint | Affected productCheck Point Quantum Gateway, Spark Gateway and CloudGuard Network | Published05/28/2024 | SeverityHigh |
CVE-2017-18368 | Exploitation statusKEV | FixNot confirmed | Providerbillion | Affected product5200w-t_firmware | Published05/02/2019 | SeverityCritical |
CVE-2026-20253Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise | Exploitation statusKEV | FixYes | ProviderSplunk | Affected productSplunk Enterprise | Published06/10/2026 | SeverityCritical |
CVE-2021-4034 | Exploitation statusKEV | FixYes | Providerpolkit_project | Affected productpolkit | Published01/28/2022 | SeverityHigh |
CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack | Exploitation statusKEV | FixYes | ProviderApache Software Foundation | Affected productApache Log4j | Published12/14/2021 | SeverityCritical |
CVE-2026-87886 | Exploitation statusNot confirmed | FixYes | ProviderAcronis | Affected productAcronis Backup extension for Plesk | Published09/17/2026 | SeverityHigh |
CVE-2020-5902 | Exploitation statusKEV | FixYes | ProviderF5 | Affected productBIG-IP | Published07/01/2020 | SeverityCritical |
CVE-2026-8037OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF | Exploitation statusKEV | FixYes | ProviderProgress Software | Affected productECS Connections Manager | Published06/04/2026 | SeverityCritical |
CVE-2016-1555 | Exploitation statusKEV | FixYes | ProviderNETGEAR | Affected productwn604_firmware | Published04/21/2017 | SeverityCritical |
CVE-2020-3452Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability | Exploitation statusKEV | FixYes | ProviderCisco | Affected productCisco Adaptive Security Appliance (ASA) Software | Published07/22/2020 | SeverityHigh |
CVE-2026-86296D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | ProviderD-LINK | Affected productDIR-822A | Published09/07/2026 | SeverityCritical |
CVE-2026-60004Gitea diffpatch Git hook installation enables remote code execution | Exploitation statusKEV | FixYes | ProviderGitea | Affected productGitea | Published08/26/2026 | SeverityCritical |
CVE-2017-17215 | Exploitation statusNot confirmed | FixNot confirmed | ProviderHuawei Technologies Co., Ltd. | Affected productHG532 | Published03/20/2018 | SeverityHigh |
CVE-2018-13379 | Exploitation statusKEV | FixYes | ProviderFortinet | Affected productFortinet FortiOS, FortiProxy | Published06/04/2019 | SeverityCritical |
CVE-2025-39682tls: fix handling of zero-length records on the rx_list | Exploitation statusPublic exploit | FixYes | ProviderLinux | Affected productLinux | Published09/05/2025 | SeverityCritical |
CVE-2026-69414Microsoft Defender Elevation of Privilege Vulnerability | Exploitation statusPublic exploit | FixYes | ProviderMicrosoft | Affected productMicrosoft Malware Protection Engine | Published08/14/2026 | SeverityHigh |
CVE-2023-24488Cross site scripting | Exploitation statusNot known exploited | FixYes | Providercitrix | Affected productCitrix ADC and Citrix Gateway | Published07/10/2023 | SeverityMedium |
CVE-2011-3600 | Exploitation statusNot confirmed | FixYes | ProviderOFBiz | Affected productOFBiz | Published11/26/2019 | SeverityHigh |
CVE-2023-42793 | Exploitation statusKEV | FixYes | ProviderJetBrains | Affected productTeamCity | Published09/19/2023 | SeverityCritical |
CVE-2021-27691 | Exploitation statusNot confirmed | FixNot confirmed | Providertendacn | Affected productg0_firmware | Published04/15/2021 | SeverityCritical |
CVE-2023-22527 | Exploitation statusKEV | FixNot confirmed | ProviderAtlassian | Affected productConfluence Data Center | Published01/16/2024 | SeverityCritical |
CVE-2026-67401 | Exploitation statusNot known exploited | FixYes | ProviderWebpros | Affected productcPanel | Published09/09/2026 | SeverityCritical |
CVE-2024-28995SolarWinds Serv-U L Directory Transversal Vulnerability | Exploitation statusKEV | FixYes | ProviderSolarWinds | Affected productSolarWinds Serv-U | Published06/06/2024 | SeverityHigh |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
Review CyStack's security rating and practical recommendations for websites and edge assets.
Explore cybersecurity research from our team of security specialists.
Browse practical cybersecurity knowledge across CyStack's articles and guides.
%20On-Prem.svg){kind=icon}
%20Processing.svg){kind=icon}
%20Software.svg){kind=icon}
