RouterCVE

Search

Published: All 7d 30d 90d 12m
Severity: All Critical High Medium Low

23,172 CVEs

Hide EOL products

CVEs (23,172, showing first 500)

Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.

Showing 351–375 of 23,172 (capped at 500)

CVE ID Severity Patch CVSS ↓ Published Description
CVE-2026-45552 CRITICAL 9.9 2026-06-10 Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.before_request …
CVE-2026-45556 CRITICAL 9.9 2026-06-10 Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf/<service>/<server_ip>/rule/<rule_id>/save ac&hellip;
CVE-2026-45558 CRITICAL 9.9 2026-06-10 Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/&hellip;
CVE-2026-10523 CRITICAL Patched 9.9 2026-06-09 An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitr&hellip;
CVE-2026-44748 CRITICAL 9.9 2026-06-09 SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XM&hellip;
CVE-2026-46442 CRITICAL Patched 9.9 2026-06-08 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authori&hellip;
CVE-2026-45744 CRITICAL Patched 9.9 2026-06-05 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolveP&hellip;
CVE-2026-43986 CRITICAL 9.9 2026-06-04 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public `/image/<hash>` route that resolves attacker-control&hellip;
CVE-2026-41283 CRITICAL 9.9 2026-06-04 OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltrati&hellip;
CVE-2025-14771 CRITICAL 9.9 2026-06-03 Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.
CVE-2026-45372 CRITICAL Patched 9.9 2026-05-29 cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-&hellip;
CVE-2026-47744 CRITICAL Patched 9.9 2026-05-29 Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the &hellip;
CVE-2026-45632 CRITICAL 9.9 2026-05-29 Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authen&hellip;
CVE-2026-45633 CRITICAL 9.9 2026-05-29 Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSo&hellip;
CVE-2026-45661 CRITICAL 9.9 2026-05-29 Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenti&hellip;
CVE-2026-45625 CRITICAL Patched 9.9 2026-05-29 Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints under /api/custom&hellip;
CVE-2026-45629 CRITICAL 9.9 2026-05-29 Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the /listen-deployment WebSocket endpoint allows&hellip;
CVE-2026-45663 CRITICAL 9.9 2026-05-29 Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.1 and earlier, a command injection vulnerability exists in the Docker file upload functionality. When&hellip;
CVE-2026-44962 CRITICAL 9.9 2026-05-29 Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without pr&hellip;
CVE-2026-45312 CRITICAL 9.9 2026-05-29 RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py)&hellip;
CVE-2026-9559 CRITICAL 9.9 2026-05-29 A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic&hellip;
CVE-2026-9558 CRITICAL 9.9 2026-05-29 A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function res&hellip;
CVE-2026-44881 CRITICAL Patched 9.9 2026-05-28 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environme&hellip;
CVE-2026-9645 CRITICAL 9.9 2026-05-28 Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system comp&hellip;
CVE-2026-46839 CRITICAL Patched 9.9 2026-05-28 Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privilege&hellip;