CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
[Impact] Unauthenticated attackers can execute arbitrary code with server privileges, leading to full system compromise and sensitive data theft.
[Mitigation] Immediately apply Adobe security patches (APSB26-146) and implement WAF rules to block malicious template patterns.
CrushFTP Server-Side Template Injection (SSTI) and Remote Code Execution Vulnerability (CVE-2024-4040) Security Advisory
[Affected Scope] All versions of CrushFTP prior to 10.7.1 and 11.1.0 across all operating system platforms
[Impact] Unauthenticated remote attackers can bypass the VFS Sandbox, read arbitrary files from the filesystem, bypass authentication to gain administrative access, and execute arbitrary code on the server.
[Mitigation] Immediately upgrade CrushFTP to the patched versions (10.7.1 or 11.1.0 or higher) and apply WAF rules to block template injection payloads.
Atlassian Confluence Server and Data Center OGNL Template Injection Remote Code Execution (RCE) Vulnerability (CVE-2023-22527) Security Advisory
[Affected Scope] Older versions of Atlassian Confluence Data Center and Server (8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3)
[Impact] Unauthenticated remote attackers can execute arbitrary system commands (RCE) on the affected instance by sending specially crafted HTTP requests.
[Mitigation] Immediately upgrade to the latest patched versions (8.5.4+ or newer LTS releases) provided by Atlassian.
Hitachi Vantara Pentaho Business Analytics Server Non-Canonical URL Path Authorization Bypass and RCE (CVE-2022-43939)
[Affected Scope] Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x
[Impact] Unauthenticated attackers can bypass security restrictions to gain administrative access and chain it with Server-Side Template Injection (SSTI) to execute arbitrary code
[Mitigation] Immediately upgrade to patched versions (9.4.0.1, 9.3.0.2 or later) and restrict external access to the Pentaho management interface
Hitachi Vantara Pentaho Business Analytics Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2022-43769)
[Affected Scope] Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x
[Impact] Remote attackers can inject malicious Spring templates via specific web services, leading to Server-Side Template Injection (SSTI) and arbitrary code execution.
[Mitigation] Immediately upgrade affected Pentaho instances to patched versions (9.4.0.1, 9.3.0.2 or higher) and restrict external access.