CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Appsmith Unauthenticated Edit-Mode Action Execution and Data Exposure Vulnerability (CVE-2026-24042)
[Affected Scope] Appsmith versions 1.94 and below with publicly accessible applications
[Impact] Unauthenticated attackers can execute unpublished (edit-mode) actions, leading to sensitive data exposure, unauthorized database queries, and side-effect behaviors
[Mitigation] Restrict public access to applications and implement request filtering on reverse proxies or WAFs to block unauthorized edit-mode execution requests
Triofox Improper Access Control Bypass Vulnerability (CVE-2025-12480) Security Advisory
[Affected Scope] Triofox versions prior to 16.7.10368.56560
[Impact] Unauthenticated remote attackers can access initial setup pages even after installation is complete, potentially leading to full administrative takeover.
[Mitigation] Immediately upgrade Triofox to version 16.7.10368.56560 or later.
Microsoft Partner Portal (Partner.Microsoft.com) Privilege Escalation Vulnerability (CVE-2024-49035) Security Advisory
[Affected Scope] Microsoft Partner Center Portal (Partner.Microsoft.com) services and associated API endpoints
[Impact] An unauthenticated remote attacker can elevate privileges over the network, potentially gaining administrative control over partner accounts and sensitive tenant data
[Mitigation] As this is a cloud-hosted service, Microsoft has applied server-side mitigations; however, organizations must immediately audit Partner Center API integrations, permissions, and admin logs
Atlassian Confluence Data Center and Server Privilege Escalation and RCE Vulnerability (CVE-2023-22515) Security Advisory
[Affected Scope] On-premise deployments of Atlassian Confluence Data Center and Confluence Server (Atlassian Cloud instances are not affected)
[Impact] Unauthenticated remote attackers can bypass access controls to access setup endpoints, create unauthorized administrator accounts, and achieve full system compromise
[Mitigation] Immediately upgrade to the patched official versions, or restrict external access to the vulnerable /setup/* endpoints if patching cannot be applied immediately
Veeam Backup & Replication Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2022-26501)
[Affected Scope] Veeam Backup & Replication versions 10.x and 11.x
[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges, leading to backup data theft and infrastructure compromise
[Mitigation] Immediately apply the official vendor patch (KB4288) or restrict access to vulnerable ports and services
Sangoma FreePBX Remote Administrator Authentication Bypass Vulnerability (CVE-2019-19006) Security Advisory
[Affected Scope] Sangoma FreePBX versions 15.0.16.26 and below, 14.0.13.11 and below, and 13.0.197.13 and below
[Impact] Remote attackers can bypass authentication entirely to gain full administrative access, leading to complete system compromise and unauthorized call routing
[Mitigation] Immediately upgrade the FreePBX framework module to the patched version using the fwconsole utility
Hikvision IP Cameras and PTZ Cameras Improper Authentication Vulnerability (CVE-2017-7921) Technical Advisory
[Affected Scope] Hikvision DS-2CD2xx2F-I, DS-2CD2xx0F-I, DS-2CD2xx2FWD, DS-2CD4x2xFWD, DS-2CD4xx5, DS-2DFx, and DS-2CD63xx series IP camera devices
[Impact] Unauthenticated remote attackers can bypass authentication mechanisms via crafted HTTP requests to escalate privileges and gain unauthorized access to sensitive system configuration and credentials
[Mitigation] Immediately upgrade device firmware to the latest patched version and restrict access to the camera management interface from the public internet