CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
[Impact] Unauthenticated attackers can execute arbitrary code with server privileges, leading to full system compromise and sensitive data theft.
[Mitigation] Immediately apply Adobe security patches (APSB26-146) and implement WAF rules to block malicious template patterns.
Rejetto HTTP File Server (HFS) 2.3m Remote Code Execution (RCE) Vulnerability (CVE-2024-23692) Analysis and Mitigation Guide
[Affected Scope] Rejetto HTTP File Server (HFS) up to and including version 2.3m
[Impact] Unauthenticated remote attackers can execute arbitrary commands on the host system by sending a specially crafted HTTP request
[Mitigation] Immediately discontinue the use of HFS 2.x, migrate to the completely redesigned HFS 3, or restrict network access
CrushFTP Server-Side Template Injection (SSTI) and Remote Code Execution Vulnerability (CVE-2024-4040) Security Advisory
[Affected Scope] All versions of CrushFTP prior to 10.7.1 and 11.1.0 across all operating system platforms
[Impact] Unauthenticated remote attackers can bypass the VFS Sandbox, read arbitrary files from the filesystem, bypass authentication to gain administrative access, and execute arbitrary code on the server.
[Mitigation] Immediately upgrade CrushFTP to the patched versions (10.7.1 or 11.1.0 or higher) and apply WAF rules to block template injection payloads.