Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (186 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-22024 1 Ivanti 3 Connect Secure, Policy Secure, Zero Trust Access Gateway 2025-10-31 8.3 High
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
CVE-2021-22893 1 Ivanti 1 Connect Secure 2025-10-30 10 Critical
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
CVE-2024-21893 1 Ivanti 3 Connect Secure, Neurons For Zero-trust Access, Policy Secure 2025-10-30 8.2 High
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVE-2024-29824 1 Ivanti 1 Endpoint Manager 2025-10-30 8.8 High
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
CVE-2024-13159 1 Ivanti 1 Endpoint Manager 2025-10-24 9.8 Critical
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVE-2024-13160 1 Ivanti 1 Endpoint Manager 2025-10-24 9.8 Critical
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVE-2024-13161 1 Ivanti 1 Endpoint Manager 2025-10-24 9.8 Critical
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVE-2024-8963 1 Ivanti 1 Endpoint Manager Cloud Services Appliance 2025-10-24 9.4 Critical
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
CVE-2024-37404 1 Ivanti 2 Connect Secure, Policy Secure 2025-09-23 8.8 High
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.
CVE-2024-8540 1 Ivanti 2 Sentry, Standalone Sentry 2025-07-30 8.8 High
Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application components.
CVE-2025-22462 1 Ivanti 1 Neurons For Itsm 2025-07-16 9.8 Critical
An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system.
CVE-2025-6995 1 Ivanti 1 Endpoint Manager 2025-07-13 8.4 High
Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
CVE-2025-6996 1 Ivanti 1 Endpoint Manager 2025-07-13 8.4 High
Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
CVE-2024-37397 1 Ivanti 1 Endpoint Manager 2025-07-10 8.2 High
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.
CVE-2024-37381 1 Ivanti 1 Endpoint Manager 2025-07-10 8.0 High
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code.
CVE-2024-38656 1 Ivanti 3 Automation, Connect Secure, Policy Secure 2025-06-27 9.1 Critical
Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2024-44107 1 Ivanti 1 Workspace Control 2025-06-12 8.8 High
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges and achieve arbitrary code execution.
CVE-2024-44106 1 Ivanti 2 Automation, Workspace Control 2025-06-12 8.8 High
Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
CVE-2024-44105 1 Ivanti 2 Automation, Workspace Control 2025-06-12 8.2 High
Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to obtain OS credentials.
CVE-2024-44104 1 Ivanti 2 Automation, Workspace Control 2025-06-12 8.8 High
An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.