Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2021-36260 | not reported | — | Listed | A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation. | — |
| CVE-2021-22017 | not reported | — | Listed | Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. | — |
| CVE-2020-13927 | not reported | — | Listed | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication. | — |
| CVE-2020-11978 | not reported | — | Listed | A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow. | — |
| CVE-2020-13671 | not reported | — | Listed | Improper sanitization in the extension file names is present in Drupal core. | — |
| CVE-2020-14864 | not reported | — | Listed | Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to a... | — |
| CVE-2021-22991 | not reported | — | Listed | The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access... | — |
| CVE-2021-21315 | not reported | — | Listed | In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attacke... | — |
| CVE-2021-33766 | not reported | — | Listed | Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffi... | — |
| CVE-2021-40870 | not reported | — | Listed | Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via director... | — |
| CVE-2021-25298 | not reported | — | Listed | Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. | — |
| CVE-2021-25297 | not reported | — | Listed | Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. | — |
| CVE-2021-25296 | not reported | — | Listed | Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. | — |
| CVE-2021-32648 | not reported | — | Listed | In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account usi... | — |
| CVE-2021-35247 | not reported | — | Listed | SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send que... | — |
| CVE-2018-8453 | not reported | — | Listed | Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges. | — |
| CVE-2012-0391 | not reported | — | Listed | The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remot... | — |
| CVE-2006-1547 | not reported | — | Listed | ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS). | — |
| CVE-2014-7169 | not reported | — | Listed | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attac... | — |
| CVE-2014-6271 | not reported | — | Listed | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attac... | — |