CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
JetBrains TeamCity Unauthenticated Remote Code Execution Vulnerability via Agent Polling Protocol (CVE-2026-63077)
[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7
[Impact] Unauthenticated remote attackers can execute arbitrary code on the server via the agent polling protocol, leading to full system compromise
[Mitigation] Immediately upgrade TeamCity server to version 2026.1.3, 2025.11.7, or later
Joomla JCE Editor Extension Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-48907)
[Affected Scope] Vulnerable versions of the JCE (Joomla Content Editor) extension for Joomla CMS
[Impact] Unauthenticated remote attackers can create unauthorized editor profiles, bypass file upload restrictions, and upload malicious PHP scripts to achieve full Remote Code Execution (RCE)
[Mitigation] Immediately upgrade JCE to the latest patched version and deploy Web Application Firewall (WAF) rules to block unauthorized profile modification requests
Oracle Identity Manager REST WebServices Authentication Bypass and System Takeover Vulnerability (CVE-2025-61757) Urgent Security Advisory
[Affected Scope] Oracle Fusion Middleware Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 (REST WebServices component)
[Impact] Unauthenticated remote attackers can bypass authentication via HTTP network access to achieve complete takeover of the Identity Manager system
[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external access to REST API endpoints
Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability (CVE-2025-54236) Security Advisory
[Affected Scope] Adobe Commerce and Magento Open Source versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier
[Impact] Unauthenticated remote attackers can exploit this vulnerability to achieve session takeover and potential remote code execution (RCE) without user interaction
[Mitigation] Immediately apply the official Adobe security patches (APSB25-88) and restrict access to session management endpoints
Critical OS Command Injection Vulnerability in End-of-Life (EOL) GeoVision Devices (CVE-2024-11120) Active Exploitation Alert
[Affected Scope] Certain End-of-Life (EOL) GeoVision IP cameras, video servers, and LPR systems
[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges, leading to complete device takeover and botnet recruitment
[Mitigation] Since these devices are EOL and no patches will be released, immediately isolate the affected devices from the internet or replace them with supported models
D-Link DIR-859 Router hedwig.cgi Path Traversal and Remote Code Execution Vulnerability (CVE-2024-0769)
[Affected Scope] D-Link DIR-859 router firmware version 1.06B01 and prior.
[Impact] Unauthenticated remote attackers can exploit this vulnerability to read sensitive system configuration files and potentially gain full administrative control over the device.
[Mitigation] This product is End-of-Life (EOL) and will not receive official security patches; immediate retirement and replacement of the device is strongly recommended.
Citrix ShareFile Storage Zones Controller Authentication Bypass and Remote Code Execution (RCE) Vulnerability (CVE-2023-24489) Security Advisory
[Affected Scope] Citrix ShareFile Storage Zones Controller versions prior to 5.11.24
[Impact] Unauthenticated remote attackers can exploit a padding oracle vulnerability to bypass authentication, upload arbitrary files, and execute remote code with SYSTEM privileges
[Mitigation] Immediately upgrade customer-managed Storage Zones Controllers to version 5.11.24 or later, and restrict external access
Oracle E-Business Suite Web Applications Desktop Integrator Remote Code Execution Vulnerability (CVE-2022-21587) Analysis and Mitigation Guide
[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.11, specifically the Upload component of Web Applications Desktop Integrator.
[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to upload arbitrary files and achieve full system takeover (RCE).
[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) patches and restrict external access to vulnerable endpoints.
Oracle Access Manager (OpenSSO Agent) Remote Code Execution and System Takeover Vulnerability (CVE-2021-35587) Security Advisory
[Affected Scope] Oracle Access Manager within Oracle Fusion Middleware, versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0
[Impact] Unauthenticated remote attackers can gain full control of the Oracle Access Manager system and execute arbitrary code via HTTP network access
[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external access to OpenSSO Agent endpoints
Apache Airflow Experimental API Authentication Bypass and Remote Code Execution (RCE) Vulnerability (CVE-2020-13927)
[Affected Scope] Apache Airflow versions prior to 1.10.11, and existing installations retaining default configurations
[Impact] Unauthenticated attackers can access the Experimental API to trigger arbitrary DAGs, leading to full remote code execution (RCE) and server compromise
[Mitigation] Upgrade Apache Airflow to version 1.10.11 or higher, or explicitly configure the API authentication backend to 'deny_all' in airflow.cfg