CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
PaperCut MF/NG Web Management Interface Improper Access Control Vulnerability (CVE-2026-81578) Advisory
[Affected Scope] Web management interface of PaperCut MF and PaperCut NG.
[Impact] Unauthenticated remote attackers can trigger backend actions and modify system configurations before access validation checks complete, potentially leading to Remote Code Execution (RCE).
[Mitigation] Apply the official vendor security patches immediately and restrict external access to the web management ports (default 9191, 9192).
CrushFTP Authentication Bypass and Admin Account Takeover Vulnerability (CVE-2025-31161) Urgent Security Advisory
[Affected Scope] CrushFTP 10 before 10.8.4 and CrushFTP 11 before 11.3.1
[Impact] Unauthenticated attackers can bypass authentication via HTTP(S) ports to take over the 'crushadmin' account and fully compromise the system
[Mitigation] Immediately upgrade CrushFTP to version 10.8.4 / 11.3.1 or later, and enforce DMZ proxy configurations
VMware ESXi Authentication Bypass and Privilege Escalation via Active Directory Integration (CVE-2024-37085)
[Affected Scope] VMware ESXi hosts configured to use Active Directory (AD) for user management.
[Impact] A malicious actor with group creation permissions in AD can gain full administrative access to the ESXi host by re-creating the deleted 'ESXi Admins' group.
[Mitigation] Apply the official security patches from Broadcom or change the default ESXi Admins group setting to an unprivileged/non-existent group name.