CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Tomcat Default Servlet Path Equivalence Vulnerability Leading to Remote Code Execution and Information Disclosure (CVE-2025-24813)
[Affected Scope] Apache Tomcat versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, 9.0.0.M1 through 9.0.98, and EOL 8.5.0 through 8.5.100.
[Impact] Attackers can bypass path validation via internal dot path equivalence, allowing them to inject malicious content into sensitive files or trigger remote code execution (RCE) via session deserialization.
[Mitigation] Immediately upgrade to patched versions (11.0.3, 10.1.35, or 9.0.99) and ensure the Default Servlet's 'readonly' parameter is set to 'true'.
Zoho ManageEngine ADSelfService Plus REST API Authentication Bypass and Remote Code Execution (RCE) Vulnerability (CVE-2021-40539) Security Advisory
[Affected Scope] Zoho ManageEngine ADSelfService Plus version 6113 and prior
[Impact] Unauthenticated remote attackers can bypass REST API authentication and execute arbitrary code with SYSTEM privileges
[Mitigation] Immediately upgrade to build 6114 or later and inspect systems for Indicators of Compromise (IoCs)
MobileIron Core, Connector, and Sentry Remote Code Execution (RCE) Vulnerability (CVE-2020-15505) Security Advisory
[Affected Scope] MobileIron Core & Connector versions 10.6.0.0 and earlier, Sentry versions 9.8.0 and earlier, Monitor & RDB versions 2.0.0.1 and earlier
[Impact] Unauthenticated remote attackers can execute arbitrary code with system administrator privileges by sending specially crafted Hessian serialized data
[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external access to sensitive service endpoints