CVE-2021-26412 — Microsoft Exchange_server: Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability CVSSv3.1 9.1 (CRITICAL) · EPSS 98th percentile
9.1
CVSS v3.1
100
Edit Score
Latest intel// live feed
25 results//sorted by published//last sync 2026-10-28 00:45Z
CVE-2021-25329 — Apache Tomcat: to 7.0.107 with a configuration edge case that was highly unlikely to be used
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue. CVSSv3.1 7.0 (HIGH) · EPSS 95th percentile
7.0
CVSS v3.1
88
Edit Score
CVE-2021-25122 — Apache Tomcat: When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request. CVSSv3.1 7.5 (HIGH) · EPSS 97th percentile
7.5
CVSS v3.1
93
Edit Score
CVE-2021-27132 — Sercomm Agcombo_vd625_firmware: AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header. CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2021-24112 — Microsoft .net: Core Remote Code Execution Vulnerability
.NET Core Remote Code Execution Vulnerability CVSSv3.1 8.1 (HIGH) · EPSS 88th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2021-1732 — Microsoft Windows_10_1803: Windows Win32k Elevation of Privilege Vulnerability
Windows Win32k Elevation of Privilege Vulnerability CVSSv3.1 7.8 (HIGH) · EPSS 100th percentile
7.8
CVSS v3.1
100
Edit Score
CVE-2020-11987 — Apache Batik: 1.13 is vulnerable to server-side request forgery, caused by improper input validation
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. CVSSv3.1 8.2 (HIGH) · EPSS 96th percentile
8.2
CVSS v3.1
95
Edit Score
CVE-2021-21974 — Vmware Cloud_foundation: A malicious actor residing within the same network segment as ESXi who has access
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution. CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile
8.8
CVSS v3.1
100
Edit Score
CVE-2021-21972 — Vmware Cloud_foundation: The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2). CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2020-24841 — Sdg Pnpscada: 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp.
PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. CVSSv3.1 9.8 (CRITICAL) · EPSS 75th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2021-25299 — Nagios Nagios_xi: XI version xi-5.7.5 is affected by cross-site scripting (XSS).
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server. CVSSv3.1 6.1 (MEDIUM) · EPSS 100th percentile
6.1
CVSS v3.1
100
Edit Score
CVE-2021-25298 — Nagios Nagios_xi: XI version xi-5.7.5 is affected by OS command injection.
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile
8.8
CVSS v3.1
100
Edit Score
CVE-2021-25297 — Nagios Nagios_xi: XI version xi-5.7.5 is affected by OS command injection.
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile
8.8
CVSS v3.1
100
Edit Score
CVE-2021-25296 — Nagios Nagios_xi: XI version xi-5.7.5 is affected by OS command injection.
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile
8.8
CVSS v3.1
100
Edit Score
CVE-2021-23337 — Lodash Lodash: versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. CVSSv3.1 7.2 (HIGH) · EPSS 98th percentile
7.2
CVSS v3.1
92
Edit Score
CVE-2021-23336 — Python Python: The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the serve CVSSv3.1 5.9 (MEDIUM) · EPSS 99th percentile
5.9
CVSS v3.1
92
Edit Score
CVE-2021-27212 — Openldap Openldap: In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can
In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime. CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile
7.5
CVSS v3.1
100
Edit Score
CVE-2020-15798 — Siemens Simatic_hmi_comfort_panels_firmware: This could allow a remote attacker to gain full access to the device.
A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 3a), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). Affected de CVSSv3.1 9.8 (CRITICAL) · EPSS 82th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2021-20016 — Sonicwall Sma_100_firmware: A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x. CVSSv3.1 9.8 (CRITICAL) · EPSS 98th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2021-3331 — Winscp Winscp: before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler
WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.) CVSSv3.1 9.8 (CRITICAL) · EPSS 94th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2021-3199 — Onlyoffice Document_server: Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter. CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2020-36230 — Openldap Openldap: A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in
A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service. CVSSv3.1 7.5 (HIGH) · EPSS 96th percentile
7.5
CVSS v3.1
91
Edit Score
CVE-2020-36228 — Openldap Openldap: An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service. CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile
7.5
CVSS v3.1
100
Edit Score
CVE-2020-36227 — Openldap Openldap: A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in
A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service. CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile
7.5
CVSS v3.1
100
Edit Score
CVE-2020-36222 — Openldap Openldap: A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in
A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service. CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile
7.5
CVSS v3.1
100
Edit Score