Loading vulnerability catalog
Threat intelligence
Public CVEs with current exploit evidence, risk signals and related defensive or research tooling.
Exploits RSS| CVE and title | Evidence / dates | CVSS | EPSS | KEV | Vendor / product | Exploits | Updated |
|---|---|---|---|---|---|---|---|
| CVE-2026-80343Runnable proof-of-concept for CVE-2026-80343, a camel-netty-http security-constraint case-sensitivity bypass, with Spring Boot and Quarkus reproducers and... | Evidence Oct 18, 2026Published — | —Not availableNot available | —Not available | — | —— | 1 |
| Oct 18, 2026 |
| CVE-2026-80312Runnable proof-of-concept for CVE-2026-80312, a fail-open OAuth guard in Apache Camel camel-oauth, with affected and fixed Spring Boot and Quarkus reproducers. | Evidence Oct 18, 2026Published — | —Not availableNot available | —Not available | — | —— | 1 | Oct 18, 2026 |
|---|
| CVE-2026-85714Stirling-PDF: Remote Code Execution via H2 | Evidence Oct 18, 2026Published Oct 14, 2026 | 9.1HighCritical | 0.6%Low | — | Stirling-ToolsStirling-PDF | 1 | Oct 18, 2026 |
|---|
| CVE-2020-11800Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. | Evidence Aug 28, 2026Published Oct 7, 2020 | 9.8HighCritical | 9.2%Low | — | n/an/a | 21 Repository evidenceEvidence observed: Oct 18, 2026 | Aug 28, 2026 |
|---|
| CVE-2017-2824An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause... | Evidence Aug 8, 2026Published May 24, 2017 | 8.1HighHigh | 25.9%Moderate | — | ZabbixZabbix Server | 31 Repository evidenceEvidence observed: Oct 18, 2026 | Aug 8, 2026 |
|---|
| CVE-2016-10134SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array... | Evidence Aug 6, 2026Published Feb 16, 2017 | 9.8HighCritical | 83.4%High | — | n/an/a | 43 Repository evidenceEvidence observed: Sep 25, 2026 | Aug 6, 2026 |
|---|
| CVE-2021-29505XStream is vulnerable to a Remote Command Execution attack | Evidence Aug 8, 2026Published May 28, 2021 | 8.8HighHigh | 77.2%High | — | x-streamxstream | 42 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2021-21351XStream is vulnerable to an Arbitrary Code Execution attack | Evidence —Published Mar 22, 2021 | 9.1HighCritical | 82.1%High | — | x-streamxstream | 22 Repository evidenceEvidence observed: Sep 26, 2026 | Oct 7, 2026 |
|---|
| CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query | Evidence Jul 21, 2026Published Jul 17, 2026 | 5.9ModerateMedium | 5.3%Low | KEV | WordPressWordPress | 583 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | Evidence Jul 21, 2026Published Jul 17, 2026 | 9.8HighCritical | 10.6%Moderate | KEV | WordPressWordPress | 754 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2019-15107Webmin Command Injection Vulnerability | Evidence Aug 12, 2019Published Aug 16, 2019 | 9.8HighCritical | 99.7%High | KEV | n/an/a | 453 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2023-21839Oracle WebLogic Server Unspecified Vulnerability | Evidence May 1, 2023Published Jan 17, 2023 | 7.5HighHigh | 99.9%High | KEV | Oracle CorporationWebLogic Server | 113 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2020-14882Oracle WebLogic Server Remote Code Execution Vulnerability | Evidence Jan 26, 2021Published Oct 21, 2020 | 9.8HighCritical | 100.0%High | KEV | Oracle CorporationWebLogic Server | 423 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2018-2894Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected... | Evidence Aug 7, 2026Published Jul 18, 2018 | 9.8HighCritical | 50.2%High | — | Oracle CorporationWebLogic Server | 82 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 7, 2026 |
|---|
| CVE-2018-2628Oracle WebLogic Server Unspecified Vulnerability | Evidence Apr 22, 2018Published Apr 19, 2018 | 9.8HighCritical | 100.0%High | KEV | Oracle CorporationWebLogic Server | 293 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2017-10271Oracle Corporation WebLogic Server Remote Code Execution Vulnerability | Evidence Dec 26, 2017Published Oct 19, 2017 | 7.5HighHigh | 100.0%High | KEV | Oracle CorporationWebLogic Server | 373 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2026-39363Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket | Evidence Aug 24, 2026Published Apr 7, 2026 | 8.2HighHigh | 2.6%Low | — | vitejsvite, vite-plus | 62 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 24, 2026 |
|---|
| CVE-2025-32395Vite has an server.fs.deny bypass with an invalid request-target | Evidence Aug 8, 2026Published Apr 10, 2025 | 6.0ModerateMedium | 1.8%Low | — | vitejsvite | 42 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2025-30208Vite bypasses server.fs.deny when using ?raw?? | Evidence Apr 3, 2025Published Mar 24, 2025 | 7.5HighHigh | 74.8%High | — | vitejsvite | 252 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2018-7490uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal. | Evidence Mar 2, 2018Published Feb 26, 2018 | 7.5HighHigh | 69.4%High | — | n/an/a | 42 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2020-13942Remote Code Execution in Apache Unomi | Evidence Aug 8, 2026Published Nov 24, 2020 | 9.8HighCritical | 68.3%High | — | Apache Software FoundationApache Unomi | 112 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor | Evidence Aug 4, 2026Published Apr 9, 2026 | 7.5HighHigh | 6.6%Low | KEV | Apache Software FoundationApache Tomcat | 82 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2025-24813Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT | Evidence Apr 1, 2025Published Mar 10, 2025 | 10.0HighCritical | 99.9%High | KEV | Apache Software FoundationApache Tomcat | 573 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2020-1938Apache Tomcat Improper Privilege Management Vulnerability | Evidence Feb 20, 2020Published Feb 24, 2020 | 9.8HighCritical | 99.3%High | KEV | ApacheApache Tomcat | 423 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2017-12615Apache Tomcat on Windows Remote Code Execution Vulnerability | Evidence Sep 20, 2017Published Sep 19, 2017 | 8.1HighHigh | 99.6%High | KEV | Apache Software FoundationApache Tomcat | 202 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2020-15906tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts. | Evidence Aug 8, 2026Published Oct 22, 2020 | 9.8HighCritical | 27.2%Moderate | — | n/an/a | 32 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2024-27198JetBrains TeamCity Authentication Bypass Vulnerability | Evidence Mar 7, 2024Published Mar 4, 2024 | 9.8HighCritical | 99.9%High | KEV | JetBrainsTeamCity | 223 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2023-42793JetBrains TeamCity Authentication Bypass Vulnerability | Evidence Oct 4, 2023Published Sep 19, 2023 | 9.8HighCritical | 100.0%High | KEV | JetBrainsTeamCity | 213 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2017-11610The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute... | Evidence Sep 25, 2017Published Aug 23, 2017 | 9.0HighHigh | 87.4%High | — | n/an/a | 73 Repository evidenceEvidence observed: Sep 25, 2026 | Aug 8, 2026 |
|---|
| CVE-2023-37941Apache Superset: Metadata db write access can lead to remote code execution | Evidence Aug 8, 2026Published Sep 6, 2023 | 6.6ModerateMedium | 35.5%Moderate | — | Apache Software FoundationApache Superset | 32 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2023-27524Apache Superset: Session validation vulnerability when using provided default SECRET_KEY | Evidence May 23, 2023Published Apr 24, 2023 | 9.8HighCritical | 97.4%High | KEV | Apache Software FoundationApache Superset | 184 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2024-53677Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks | Evidence Aug 8, 2026Published Dec 11, 2024 | 9.5HighCritical | 70.1%High | — | Apache Software FoundationApache Struts | 181 Repository evidenceEvidence observed: Oct 18, 2026 | Aug 8, 2026 |
|---|
| CVE-2023-50164Apache Struts: File upload component had a directory traversal vulnerability | Evidence Aug 8, 2026Published Dec 7, 2023 | 9.8HighCritical | 80.8%High | — | Apache Software FoundationApache Struts | 151 Repository evidenceEvidence observed: Oct 18, 2026 | Aug 8, 2026 |
|---|
| CVE-2020-17530Apache Struts Remote Code Execution Vulnerability | Evidence Nov 3, 2021Published Dec 11, 2020 | 9.8HighCritical | 95.9%High | KEV | Apache Software FoundationApache Struts | 153 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2019-0230Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. | Evidence Nov 17, 2020Published Sep 14, 2020 | 9.8HighCritical | 96.9%High | — | n/aApache Struts | 93 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2018-11776Apache Struts Remote Code Execution Vulnerability | Evidence Aug 25, 2018Published Aug 22, 2018 | 8.1HighHigh | 100.0%High | KEV | Apache Software FoundationApache Struts | 263 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2017-12611In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to... | Evidence Sep 8, 2017Published Sep 20, 2017 | 9.8HighCritical | 87.1%High | — | Apache Software FoundationApache Struts | 72 Repository evidenceEvidence observed: Sep 25, 2026 | Aug 24, 2026 |
|---|
| CVE-2017-9805Apache Struts Deserialization of Untrusted Data Vulnerability | Evidence Sep 6, 2017Published Sep 15, 2017 | 8.1HighHigh | 99.4%High | KEV | Apache Software FoundationApache Struts | 263 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2017-9791Apache Struts 1 Improper Input Validation Vulnerability | Evidence Jul 7, 2017Published Jul 10, 2017 | 9.8HighCritical | 98.9%High | KEV | Apache Software FoundationApache Struts | 93 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2017-5638Apache Struts Remote Code Execution Vulnerability | Evidence Mar 7, 2017Published Mar 11, 2017 | 9.8HighCritical | 100.0%High | KEV | Apache Software FoundationApache Struts | 834 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2016-3081Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute... | Evidence May 2, 2016Published Apr 26, 2016 | 8.1HighHigh | 96.1%High | KEV | n/an/a | 53 Repository evidenceEvidence observed: Sep 25, 2026 | Oct 8, 2026 |
|---|
| CVE-2013-2251Apache Struts Improper Input Validation Vulnerability | Evidence Jul 27, 2013Published Jul 18, 2013 | 9.8HighCritical | 100.0%High | KEV | n/an/a | 73 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2013-2134Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled... | Evidence Jun 5, 2013Published Jul 16, 2013 | 9.3HighHigh | 70.2%High | — | n/an/a | 21 Repository evidenceEvidence observed: Oct 18, 2026 | Aug 8, 2026 |
|---|
| CVE-2013-2135Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}"... | Evidence —Published Jul 16, 2013 | 9.3HighHigh | 13.8%Moderate | — | n/an/a | 11 Repository evidenceEvidence observed: Oct 18, 2026 | Aug 6, 2024 |
|---|
| CVE-2013-1966Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the... | Evidence Jun 5, 2013Published Jul 10, 2013 | 9.3HighHigh | 73.7%High | — | n/an/a | 32 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2013-1965Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted... | Evidence Aug 8, 2026Published Jul 10, 2013 | 9.3HighHigh | 93.5%High | — | n/an/a | 32 Repository evidenceEvidence observed: Sep 25, 2026 | Aug 8, 2026 |
|---|
| CVE-2011-3923Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. | Evidence Mar 22, 2013Published Nov 1, 2019 | 9.8HighCritical | 89.5%High | — | ApacheStruts | 32 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2012-0391Apache Struts 2 Improper Input Validation Vulnerability | Evidence Jan 6, 2012Published Jan 8, 2012 | 9.8HighCritical | 75.6%High | KEV | n/an/a | 42 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2010-1870The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other... | Evidence Jul 14, 2010Published Aug 17, 2010 | 5.0ModerateMedium | 92.0%High | — | n/an/a | 53 Repository evidenceEvidence observed: Sep 25, 2026 | Aug 8, 2026 |
|---|
| CVE-2022-22978In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed... | Evidence Aug 8, 2026Published May 19, 2022 | 9.8HighCritical | 12.4%Moderate | — | n/aSpring Security | 81 Repository evidenceEvidence observed: Oct 18, 2026 | Aug 8, 2026 |
|---|