{ "query": { "kev": "1", "page": "59" }, "count": 20, "total": 1734, "page": 59, "limit": 20, "updated": { "cves": "2026-10-08T12:49:09.674Z", "kev": "2026-10-08T12:50:09.232Z", "epss": "2026-10-08T13:01:09.708Z", "breaches": "2026-10-08T12:49:09.286Z", "posts": "2026-10-08T12:49:09.674Z" }, "links": { "web": "https://spydr.io/threats?kev=1&page=59", "next": "https://spydr.io/threats.json?kev=1&page=60" }, "coverage": { "cves_published_since": "2026-06-10", "days": 120, "also": "every CVE in CISA KEV" }, "unscored_hidden": 0, "warnings": [], "results": [ { "id": "CVE-2012-5076", "url": "https://spydr.io/cve/CVE-2012-5076", "published": "2012-10-16T21:55:02.073Z", "modified": "2026-06-16T23:46:10.790Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "CISA ADP", "epss": 0.9125, "epss_percentile": 0.99809, "exploited": true, "kev": { "added": "2022-03-28", "due": "2022-04-18", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "oracle", "suse" ], "products": [ "oracle jre", "suse linux enterprise desktop" ], "cwes": [ "CWE-284" ], "description": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS." }, { "id": "CVE-2012-2034", "url": "https://spydr.io/cve/CVE-2012-2034", "published": "2012-06-09T00:55:00.987Z", "modified": "2026-06-16T23:40:50.083Z", "score": 7.5, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.078, "epss_percentile": 0.94516, "exploited": true, "kev": { "added": "2022-03-28", "due": "2022-04-18", "action": "The impacted product is end-of-life and should be disconnected if still in use.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "adobe", "opensuse", "suse", "redhat" ], "products": [ "adobe flash player", "adobe air", "opensuse", "suse linux enterprise desktop", "redhat enterprise linux desktop", "redhat enterprise linux eus", "redhat enterprise linux server", "redhat enterprise linux server aus", "redhat enterprise linux workstation" ], "cwes": [ "CWE-119" ], "description": "Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037." }, { "id": "CVE-2011-2005", "url": "https://spydr.io/cve/CVE-2011-2005", "published": "2011-10-12T02:52:43.910Z", "modified": "2026-06-16T23:30:35.373Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.31761, "epss_percentile": 0.98259, "exploited": true, "kev": { "added": "2022-03-28", "due": "2022-04-18", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "microsoft" ], "products": [ "microsoft windows server 2003", "microsoft windows xp" ], "cwes": [], "description": "afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka \"Ancillary Function Driver Elevation of Privilege Vulnerability.\"" }, { "id": "CVE-2010-4398", "url": "https://spydr.io/cve/CVE-2010-4398", "published": "2010-12-06T13:44:54.863Z", "modified": "2026-06-16T23:24:42.707Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.08661, "epss_percentile": 0.94994, "exploited": true, "kev": { "added": "2022-03-28", "due": "2022-04-21", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "microsoft" ], "products": [ "microsoft windows 7", "microsoft windows server 2003", "microsoft windows server 2008", "microsoft windows vista", "microsoft windows xp" ], "cwes": [ "CWE-787" ], "description": "Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka \"Driver Improper Interaction with Windows Kernel Vulnerability.\"" }, { "id": "CVE-2022-26143", "url": "https://spydr.io/cve/CVE-2022-26143", "published": "2022-03-10T17:47:32.813Z", "modified": "2026-06-17T04:34:46.337Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.87325, "epss_percentile": 0.99752, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "mitel" ], "products": [ "mitel micollab", "mitel mivoice business express" ], "cwes": [ "CWE-306" ], "description": "The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack." }, { "id": "CVE-2022-26318", "url": "https://spydr.io/cve/CVE-2022-26318", "published": "2022-03-04T18:15:08.367Z", "modified": "2026-06-17T04:34:58.110Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.78157, "epss_percentile": 0.99569, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "watchguard" ], "products": [ "watchguard fireware" ], "cwes": [], "description": "On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2." }, { "id": "CVE-2022-21999", "url": "https://spydr.io/cve/CVE-2022-21999", "published": "2022-02-09T17:15:09.563Z", "modified": "2026-06-17T04:27:26.760Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.41007, "epss_percentile": 0.98628, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1809", "Microsoft Windows Server 2019", "Microsoft Windows Server 2019 (Server Core installation)", "Microsoft Windows 10 Version 1909", "Microsoft Windows 10 Version 21H1", "Microsoft Windows Server 2022", "Microsoft Windows 10 Version 20H2", "Microsoft Windows Server version 20H2", "Microsoft Windows 11 version 21H2", "Microsoft Windows 10 Version 21H2", "Microsoft Windows 10 Version 1507", "Microsoft Windows 10 Version 1607", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)", "Microsoft Windows 7", "Microsoft Windows 7 Service Pack 1", "Microsoft Windows 8.1", "Microsoft Windows Server 2008 Service Pack 2", "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)", "Microsoft Windows Server 2008 R2 Service Pack 1" ], "cwes": [ "CWE-22", "CWE-59" ], "description": "Windows Print Spooler Elevation of Privilege Vulnerability" }, { "id": "CVE-2021-42237", "url": "https://spydr.io/cve/CVE-2021-42237", "published": "2021-11-05T10:15:08.240Z", "modified": "2026-07-09T13:57:14.483Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.97566, "epss_percentile": 0.99902, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "sitecore" ], "products": [ "sitecore experience platform" ], "cwes": [ "CWE-502" ], "description": "Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability." }, { "id": "CVE-2021-22941", "url": "https://spydr.io/cve/CVE-2021-22941", "published": "2021-09-23T13:15:08.620Z", "modified": "2026-06-17T03:38:04.350Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.53585, "epss_percentile": 0.98969, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "citrix" ], "products": [ "Citrix ShareFile storage zones controller" ], "cwes": [ "CWE-284" ], "description": "Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller." }, { "id": "CVE-2020-2506", "url": "https://spydr.io/cve/CVE-2020-2506", "published": "2021-02-03T16:15:13.807Z", "modified": "2026-06-17T03:12:15.060Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.01982, "epss_percentile": 0.79915, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "QNAP Systems Inc." ], "products": [ "QNAP Systems Inc. Helpdesk" ], "cwes": [ "CWE-284" ], "description": "The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3." }, { "id": "CVE-2020-25223", "url": "https://spydr.io/cve/CVE-2020-25223", "published": "2020-09-25T04:23:04.857Z", "modified": "2026-06-17T03:06:37.003Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.96753, "epss_percentile": 0.99887, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "sophos" ], "products": [ "sophos unified threat management" ], "cwes": [ "CWE-78" ], "description": "A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11" }, { "id": "CVE-2020-9377", "url": "https://spydr.io/cve/CVE-2020-9377", "published": "2020-07-09T13:15:10.653Z", "modified": "2026-06-17T03:27:50.537Z", "score": 8.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.21338, "epss_percentile": 0.97548, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "The impacted product is end-of-life and should be disconnected if still in use.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "dlink" ], "products": [ "dlink dir-610 firmware" ], "cwes": [ "CWE-78" ], "description": "D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer" }, { "id": "CVE-2020-2021", "url": "https://spydr.io/cve/CVE-2020-2021", "published": "2020-06-29T15:15:12.733Z", "modified": "2026-06-17T03:11:38.983Z", "score": 10, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.04362, "epss_percentile": 0.90988, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "Palo Alto Networks" ], "products": [ "Palo Alto Networks PAN-OS" ], "cwes": [ "CWE-347" ], "description": "When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability." }, { "id": "CVE-2020-5410", "url": "https://spydr.io/cve/CVE-2020-5410", "published": "2020-06-02T17:15:11.690Z", "modified": "2026-06-17T03:21:26.550Z", "score": 7.5, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score_source": "NVD", "epss": 0.95586, "epss_percentile": 0.99871, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Spring by VMware" ], "products": [ "Spring by VMware Spring Cloud Config" ], "cwes": [ "CWE-23", "CWE-22" ], "description": "Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack." }, { "id": "CVE-2020-1956", "url": "https://spydr.io/cve/CVE-2020-1956", "published": "2020-05-22T14:15:11.840Z", "modified": "2026-06-17T03:02:43.010Z", "score": 8.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.97337, "epss_percentile": 0.99897, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Apache" ], "products": [ "Apache Kylin" ], "cwes": [ "CWE-78" ], "description": "Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation." }, { "id": "CVE-2020-1631", "url": "https://spydr.io/cve/CVE-2020-1631", "published": "2020-05-04T10:15:10.890Z", "modified": "2026-06-17T03:02:02.143Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.04843, "epss_percentile": 0.91775, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Juniper Networks" ], "products": [ "Juniper Networks Junos OS" ], "cwes": [ "CWE-22", "CWE-73" ], "description": "A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with 'world' readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user 'nobody', the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with 'world' readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to read the configuration file. (CVSS score 5.9, vector CVSS:3.1/ AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web. (CVSS score 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled. Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device> show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf To summarize: If HTTP/HTTPS services are disabled, there is no impact from this vulnerability. If HTTP/HTTPS services are enabled and J-Web is not in use, this vulnerability has a CVSS score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). If J-Web is enabled, this vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Juniper SIRT has received a single report of this vulnerability being exploited in the wild. Out of an abundance of caution, we are notifying customers so they can take appropriate actions. Indicators of Compromise: The /var/log/httpd.log may have indicators that commands have injected or files being accessed. The device administrator can look for these indicators by searching for the string patterns \"=*;*&\" or \"*%3b*&\" in /var/log/httpd.log, using the following command: user@device> show log httpd.log | match \"=*;*&|=*%3b*&\" If this command returns any output, it might be an indication of malicious attempts or simply scanning activities. Rotated logs should also be reviewed, using the following command: user@device> show log httpd.log.0.gz | match \"=*;*&|=*%3b*&\" user@device> show log httpd.log.1.gz | match \"=*;*&|=*%3b*&\" Note that a skilled attacker would likely remove these entries from the local log file, thus effectively eliminating any reliable signature that the device had been attacked. This issue affects Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S16; 12.3X48 versions prior to 12.3X48-D101, 12.3X48-D105; 14.1X53 versions prior to 14.1X53-D54; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D211, 15.1X49-D220; 16.1 versions prior to 16.1R7-S8; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S4; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S7, 18.4R3-S2 ; 18.4 version 18.4R2 and later versions; 19.1 versions prior to 19.1R1-S5, 19.1R3-S1; 19.1 version 19.1R2 and later versions; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R2-S3, 19.3R3; 19.4 versions prior to 19.4R1-S2, 19.4R2; 20.1 versions prior to 20.1R1-S1, 20.1R2." }, { "id": "CVE-2016-11021", "url": "https://spydr.io/cve/CVE-2016-11021", "published": "2020-03-09T01:15:10.780Z", "modified": "2026-06-17T00:40:49.490Z", "score": 7.2, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.6887, "epss_percentile": 0.99333, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "The impacted product is end-of-life and should be disconnected if still in use.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "dlink" ], "products": [ "dlink dcs-930l firmware" ], "cwes": [ "CWE-78" ], "description": "setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter." }, { "id": "CVE-2020-9054", "url": "https://spydr.io/cve/CVE-2020-9054", "published": "2020-03-04T20:15:10.750Z", "modified": "2026-10-07T18:17:09.643Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.99988, "epss_percentile": 0.99984, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "ZyXEL" ], "products": [ "ZyXEL NAS326", "ZyXEL NAS520", "ZyXEL NAS540", "ZyXEL NAS542", "ZyXEL NSA210", "ZyXEL NSA220", "ZyXEL NSA221", "ZyXEL NSA310", "ZyXEL NSA320", "ZyXEL NSA320S", "ZyXEL NSA325", "ZyXEL NSA325v2" ], "cwes": [ "CWE-78" ], "description": "Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2" }, { "id": "CVE-2020-7247", "url": "https://spydr.io/cve/CVE-2020-7247", "published": "2020-01-29T16:15:12.897Z", "modified": "2026-06-17T03:24:35.133Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.98972, "epss_percentile": 0.99929, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "openbsd", "debian", "fedoraproject", "canonical" ], "products": [ "openbsd opensmtpd", "debian linux", "fedoraproject fedora", "canonical ubuntu linux" ], "cwes": [ "CWE-78", "CWE-755" ], "description": "smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation." }, { "id": "CVE-2019-11043", "url": "https://spydr.io/cve/CVE-2019-11043", "published": "2019-10-28T15:15:13.863Z", "modified": "2026-06-17T02:12:11.767Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.9978, "epss_percentile": 0.99955, "exploited": true, "kev": { "added": "2022-03-25", "due": "2022-04-15", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "PHP" ], "products": [ "PHP" ], "cwes": [ "CWE-120", "CWE-787" ], "description": "In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution." } ], "attribution": [ { "source": "NVD", "url": "https://nvd.nist.gov", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "notice": "Known exploited vulnerabilities from the CISA KEV catalog." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss", "notice": "Exploit prediction scores from FIRST EPSS." } ] }