주요 제품 취약점 (538건)
Windows
infra
293건
KEV 293 · 최근 2026-10-13
Cisco IOS
infra
44건
KEV 44 · 최근 2026-07-13
Ivanti
infra
36건
KEV 36 · 최근 2026-10-13
Linux 커널
infra
30건
KEV 30 · 최근 2026-09-18
Fortinet
infra
21건
KEV 22 · 최근 2026-10-16
Microsoft Exchange
infra
20건
KEV 20 · 최근 2026-05-15
Citrix NetScaler
infra
16건
KEV 16 · 최근 2026-10-04
Palo Alto PAN-OS
infra
14건
KEV 14 · 최근 2026-10-14
VMware vCenter
infra
12건
KEV 12 · 최근 2026-08-18
Apache HTTP
infra
11건
KEV 11 · 최근 2026-08-24
Atlassian Confluence
infra
10건
KEV 10 · 최근 2026-10-15
Apache Tomcat
infra
8건
KEV 8 · 최근 2026-08-04
VMware ESXi
infra
7건
KEV 7 · 최근 2025-03-04
OpenSSH
infra
3건
KEV 3 · 최근 2025-10-02
Redis
infra
3건
KEV 3 · 최근 2026-05-26
MySQL/MariaDB
finance
2건
KEV 2 · 최근 2024-11-07
Node.js
infra
2건
KEV 2 · 최근 2025-01-14
PostgreSQL
finance
2건
KEV 2 · 최근 2026-09-02
Apache Spark
finance
1건
KEV 1 · 최근 2023-03-07
curl
infra
1건
KEV 1 · 최근 2023-05-12
OpenSSL
infra
1건
KEV 1 · 최근 2022-05-04
Spring Framework
finance
1건
KEV 1 · 최근 2022-04-04
| 기술 | CVE | 심각도 | 유형 | KEV | 등재일 |
|---|---|---|---|---|---|
|
Apache HTTP
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy P…
|
CVE-2026-21962 | 10.0 | CWE-284 | KEV | 2026-08-24 |
|
Ivanti
Ivanti Sentry
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achie…
|
CVE-2026-10520 | 10.0 | CWE-78 | KEV | 2026-06-11 |
|
MySQL/MariaDB
CyberPersons CyberPanel
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute …
|
CVE-2024-51567 | 10.0 | CWE-306 | KEV | 2024-11-07 |
|
Palo Alto PAN-OS
Palo Alto Networks PAN-OS
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for speci…
|
CVE-2024-3400 | 10.0 | CWE-20 | KEV | 2024-04-12 |
|
Cisco IOS
Cisco IOS XE Web UI
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating…
|
CVE-2023-20198 | 10.0 | CWE-420 | KEV | 2023-10-16 |
|
Redis
Redis Debian-specific Redis Servers
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which c…
|
CVE-2022-0543 | 10.0 | CWE-862 | KEV | 2022-03-28 |
|
Palo Alto PAN-OS
Palo Alto Networks PAN-OS
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (uncheck…
|
CVE-2020-2021 | 10.0 | CWE-347 | KEV | 2022-03-25 |
|
Windows
Microsoft SMBv3
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka …
|
CVE-2020-0796 | 10.0 | CWE-119 | KEV | 2022-02-10 |
|
Windows
Kaseya Virtual System/Server Administrator (VSA)
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page …
|
CVE-2021-30116 | 10.0 | CWE-522 | KEV | 2021-11-03 |
|
Ivanti
Ivanti Pulse Connect Secure
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pul…
|
CVE-2021-22893 | 10.0 | CWE-287 | KEV | 2021-11-03 |
|
Windows
Ivanti Pulse Connect Secure
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pul…
|
CVE-2021-22893 | 10.0 | CWE-287 | KEV | 2021-11-03 |
|
Windows
Microsoft Windows
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Serve…
|
CVE-2020-1350 | 10.0 | CWE-20 | KEV | 2021-11-03 |
|
Ivanti
Ivanti Pulse Connect Secure
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can se…
|
CVE-2019-11510 | 10.0 | CWE-22 | KEV | 2021-11-03 |
|
Linux 커널
Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
tls: fix handling of zero-length records on the rx_list
Each recvmsg() call mus…
|
CVE-2025-39682 | 9.8 | CWE-754 | KEV | 2026-09-18 |
|
Citrix NetScaler
Citrix NetScaler ADC and NetScaler Gateway
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the applian…
|
CVE-2026-8452 | 9.8 | CWE-119 | KEV | 2026-08-26 |
|
VMware vCenter
Broadcom VMware vCenter
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this i…
|
CVE-2026-59310 | 9.8 | CWE-22 | KEV | 2026-08-18 |
|
Windows
Microsoft Internet Key Exchange (IKE) Service Extensions
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
|
CVE-2026-33824 | 9.8 | CWE-415 | KEV | 2026-08-18 |
|
PostgreSQL
Splunk Enterprise
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files throug…
|
CVE-2026-20253 | 9.8 | CWE-306 | KEV | 2026-06-18 |
|
Windows
Daemon Daemon Tools Lite
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distrib…
|
CVE-2026-8398 | 9.8 | CWE-506 | KEV | 2026-05-27 |
|
Redis
LiteSpeed cPanel Plugin
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best…
|
CVE-2026-48172 | 9.8 | CWE-266 | KEV | 2026-05-26 |
|
Windows
Microsoft Windows
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows rem…
|
CVE-2008-4250 | 9.8 | CWE-94 | KEV | 2026-05-20 |
|
Palo Alto PAN-OS
Palo Alto Networks PAN-OS
A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an un…
|
CVE-2026-0300 | 9.8 | CWE-787 | KEV | 2026-05-06 |
|
Ivanti
Ivanti Endpoint Manager Mobile (EPMM)
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
|
CVE-2026-1340 | 9.8 | CWE-94 | KEV | 2026-04-08 |
|
Citrix NetScaler
Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
|
CVE-2026-3055 | 9.8 | CWE-125 | KEV | 2026-03-30 |
|
Windows
React Native Community CLI
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpo…
|
CVE-2025-11953 | 9.8 | CWE-78 | KEV | 2026-02-05 |
|
Ivanti
Ivanti Endpoint Manager Mobile (EPMM)
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
|
CVE-2026-1281 | 9.8 | CWE-94 | KEV | 2026-01-29 |
|
Fortinet
Fortinet Multiple Products
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, Fort…
|
CVE-2026-24858 | 9.8 | CWE-288 | KEV | 2026-01-27 |
|
VMware vCenter
Broadcom VMware vCenter Server
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter …
|
CVE-2024-37079 | 9.8 | CWE-787 | KEV | 2026-01-23 |
|
Fortinet
Fortinet Multiple Products
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 …
|
CVE-2025-59718 | 9.8 | CWE-347 | KEV | 2025-12-16 |
|
Windows
Microsoft Windows
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
|
CVE-2025-59287 | 9.8 | CWE-502 | KEV | 2025-10-24 |
|
Citrix NetScaler
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is conf…
|
CVE-2025-7775 | 9.8 | CWE-119 | KEV | 2025-08-26 |
|
Citrix NetScaler
Citrix NetScaler ADC and Gateway
Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gate…
|
CVE-2025-6543 | 9.8 | CWE-119 | KEV | 2025-06-30 |
|
Apache Tomcat
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploade…
|
CVE-2025-24813 | 9.8 | CWE-44 | KEV | 2025-04-01 |
|
Ivanti
Ivanti Endpoint Manager (EPM)
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthen…
|
CVE-2024-13161 | 9.8 | CWE-36 | KEV | 2025-03-10 |
|
Ivanti
Ivanti Endpoint Manager (EPM)
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthen…
|
CVE-2024-13160 | 9.8 | CWE-36 | KEV | 2025-03-10 |
|
Ivanti
Ivanti Endpoint Manager (EPM)
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthen…
|
CVE-2024-13159 | 9.8 | CWE-36 | KEV | 2025-03-10 |
|
Node.js
Fortinet FortiOS and FortiProxy
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy ver…
|
CVE-2024-55591 | 9.8 | CWE-288 | KEV | 2025-01-14 |
|
Fortinet
Fortinet FortiOS and FortiProxy
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy ver…
|
CVE-2024-55591 | 9.8 | CWE-288 | KEV | 2025-01-14 |
|
VMware vCenter
VMware vCenter Server
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCen…
|
CVE-2024-38812 | 9.8 | CWE-122 | KEV | 2024-11-20 |
|
Palo Alto PAN-OS
Palo Alto Networks PAN-OS
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interfac…
|
CVE-2024-0012 | 9.8 | CWE-306 | KEV | 2024-11-18 |
|
Fortinet
Fortinet Multiple Products
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy …
|
CVE-2024-23113 | 9.8 | CWE-134 | KEV | 2024-10-09 |
|
Ivanti
Ivanti Virtual Traffic Manager
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker t…
|
CVE-2024-7593 | 9.8 | CWE-287 | KEV | 2024-09-24 |
|
Windows
Adobe Flash Player
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.3…
|
CVE-2014-0497 | 9.8 | CWE-191 | KEV | 2024-09-17 |
|
Windows
PHP Group PHP
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to us…
|
CVE-2024-4577 | 9.8 | CWE-78 | KEV | 2024-06-12 |
|
Ivanti
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA)
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited…
|
CVE-2021-44529 | 9.8 | CWE-94 | KEV | 2024-03-25 |
|
Microsoft Exchange
Microsoft Exchange Server
Microsoft Exchange Server Elevation of Privilege Vulnerability
|
CVE-2024-21410 | 9.8 | CWE-287 | KEV | 2024-02-15 |
|
Fortinet
Fortinet FortiOS
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 throug…
|
CVE-2024-21762 | 9.8 | CWE-787 | KEV | 2024-02-09 |
|
Atlassian Confluence
Atlassian Confluence Data Center and Server
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an aff…
|
CVE-2023-22527 | 9.8 | CWE-74 | KEV | 2024-01-24 |
|
VMware vCenter
VMware vCenter Server
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to v…
|
CVE-2023-34048 | 9.8 | CWE-787 | KEV | 2024-01-22 |
|
Ivanti
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of t…
|
CVE-2023-35082 | 9.8 | CWE-287 | KEV | 2024-01-18 |
|
Apache Tomcat
SysAid SysAid Server
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as…
|
CVE-2023-47246 | 9.8 | CWE-22 | KEV | 2023-11-13 |
|
Atlassian Confluence
Atlassian Confluence Data Center and Server
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an…
|
CVE-2023-22518 | 9.8 | CWE-863 | KEV | 2023-11-07 |
|
Atlassian Confluence
Atlassian Confluence Data Center and Server
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnera…
|
CVE-2023-22515 | 9.8 | CWE-20 | KEV | 2023-10-05 |
|
Apache HTTP
Ivanti Sentry
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentica…
|
CVE-2023-38035 | 9.8 | CWE-863 | KEV | 2023-08-22 |
|
Ivanti
Ivanti Sentry
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentica…
|
CVE-2023-38035 | 9.8 | CWE-863 | KEV | 2023-08-22 |
|
Ivanti
Ivanti Endpoint Manager Mobile (EPMM)
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application wi…
|
CVE-2023-35078 | 9.8 | CWE-287 | KEV | 2023-07-25 |
|
Citrix NetScaler
Citrix NetScaler ADC and NetScaler Gateway
Unauthenticated remote code execution
|
CVE-2023-3519 | 9.8 | CWE-94 | KEV | 2023-07-19 |
|
Fortinet
Fortinet FortiOS and FortiProxy SSL-VPN
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version …
|
CVE-2023-27997 | 9.8 | CWE-122 | KEV | 2023-06-13 |
|
MySQL/MariaDB
Progress MOVEit Transfer
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection…
|
CVE-2023-34362 | 9.8 | CWE-89 | KEV | 2023-06-02 |
|
curl
Ruckus Wireless Multiple Products
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_us…
|
CVE-2023-25717 | 9.8 | CWE-94 | KEV | 2023-05-12 |