CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Critical Authentication Bypass in Vvveb CMS Password Reset (CVE-2026-110799)
[Affected Scope] All websites and e-commerce stores running Vvveb CMS versions prior to 1.0.8.7
[Impact] Remote attackers can bypass authentication to reset any user's password, leading to full account takeover including administrative privileges.
[Mitigation] Immediately upgrade Vvveb CMS to version 1.0.8.7 or later.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
[Impact] Remote, unauthenticated attackers can inject arbitrary SQL queries, manipulate the database, and gain full administrator access to the Metabase instance
[Mitigation] Apply the official vendor security patches immediately, or restrict access to the vulnerable endpoint using a WAF or reverse proxy
Oracle E-Business Suite Payments File Transmission Authentication Bypass and Remote Code Execution (CVE-2026-46817)
[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component
[Impact] Unauthenticated remote attackers can bypass authentication via HTTP, leading to complete takeover of the Oracle Payments module
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, and restrict external HTTP access to the Payments module until patched
Sangfor Operation and Maintenance Security Management System Weak Password Recovery Vulnerability (CVE-2026-1325) Security Advisory
[Affected Scope] Sangfor Operation and Maintenance Security Management System up to version 3.0.12
[Impact] Unauthenticated remote attackers can bypass password reset logic, compromise administrative accounts, and gain full control over the bastion host
[Mitigation] Restrict external access to the system and block the vulnerable endpoint using web application firewalls or reverse proxy rules
Fortinet FortiManager Unauthenticated Remote Code Execution Vulnerability (CVE-2024-47575) Security Advisory
[Affected Scope] Multiple versions of FortiManager and FortiManager Cloud (7.6.0, 7.4.0-7.4.4, 7.2.0-7.2.7, 7.0.0-7.0.12, 6.4.0-6.4.14, 6.2.0-6.2.12, etc.)
[Impact] An unauthenticated remote attacker can execute arbitrary code or system commands via specially crafted requests, potentially leading to full system compromise
[Mitigation] Immediately upgrade to the official patched versions or apply workarounds to restrict unauthorized FGFM connections
Array Networks AG and vxAG SSL VPN Gateway Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2023-28461) Analysis and Mitigation Guide
[Affected Scope] Array Networks Array AG Series and vxAG virtual appliances running version 9.4.0.481 and earlier
[Impact] Unauthenticated remote attackers can browse the filesystem of the SSL VPN gateway by manipulating the 'flags' attribute in HTTP headers, leading to full Remote Code Execution (RCE)
[Mitigation] Immediately upgrade to the patched firmware version released by the vendor, and restrict access to the management interface and VPN ports from untrusted networks
Atlassian Questions for Confluence Hardcoded Credentials Vulnerability (CVE-2022-26138) Security Advisory
[Affected Scope] Confluence Server and Data Center environments with Questions for Confluence app versions 2.7.34, 2.7.35, and 3.0.2 installed
[Impact] A remote, unauthenticated attacker can exploit the hardcoded 'disabledsystemuser' account to log into Confluence and access all sensitive content
[Mitigation] Immediately upgrade the Questions for Confluence app to a non-vulnerable version or disable/delete the 'disabledsystemuser' account