CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Palo Alto Networks PAN-OS User-ID Authentication Portal Buffer Overflow RCE Vulnerability (CVE-2026-0300)
[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.
[Impact] An unauthenticated remote attacker can execute arbitrary code with root privileges on the firewall by sending specially crafted packets.
[Mitigation] Apply the latest security patches immediately, and restrict access to the User-ID™ Authentication Portal to trusted internal IP addresses only.
Zyxel Firewall Directory Traversal Vulnerability (CVE-2024-11667) Technical Analysis and Mitigation Guide
[Affected Scope] Zyxel ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN series running firmware versions V5.00 through V5.38
[Impact] Unauthenticated remote attackers can download or upload arbitrary files via crafted URLs, potentially leading to full system compromise and remote code execution
[Mitigation] Immediately upgrade to firmware version V5.39 or later, and restrict external access to the web management interface
Juniper Networks Junos OS J-Web External Variable Modification Vulnerability (CVE-2023-36845) Remote Code Execution Analysis and Mitigation Guide
[Affected Scope] Juniper Networks Junos OS on EX Series switches and SRX Series firewalls with the J-Web interface enabled
[Impact] An unauthenticated, network-based attacker can modify the PHP execution environment (PHPRC) via crafted HTTP requests, leading to arbitrary code execution and full device compromise
[Mitigation] Immediately upgrade Junos OS to the patched versions, or disable the J-Web interface and restrict access to trusted IP addresses as a temporary workaround
Sophos Firewall User Portal and Webadmin Remote Code Execution (RCE) Vulnerability Advisory (CVE-2022-3236)
[Affected Scope] Sophos Firewall version v19.0 MR1 and older affecting User Portal and Webadmin interfaces
[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the firewall device by sending specially crafted HTTP requests
[Mitigation] Immediately upgrade to the latest firmware version (v19.0 MR2 or later) and disable WAN access to Webadmin and User Portal
Sophos XG Firewall User Portal Buffer Overflow Vulnerability (CVE-2020-15069) Technical Advisory
[Affected Scope] Sophos XG Firewall v17.0, v17.1, and v17.5 (v17.5 MR12 and prior) with Clientless VPN Access feature enabled
[Impact] Unauthenticated remote attackers can execute arbitrary code (RCE) or cause a Denial of Service (DoS) on the firewall via specially crafted HTTP/S requests
[Mitigation] Apply official hotfix HF062020.1, upgrade to the latest firmware, and restrict WAN access to the User Portal and SSL VPN ports