Export limit exceeded: 11612 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-18265 1 Osnexus 1 Quantastor 2026-08-26 N/A
OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OSNEXUS QuantaStor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of Kapacitor. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-30036.
CVE-2026-10880 1 Osnexus 1 Quantastor 2026-06-04 9.8 Critical
OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly sanitized before being incorporated into a SQL query, allowing an unauthenticated remote attacker to bypass authentication and log in as an administrator without supplying a valid password.
CVE-2021-4406 1 Osnexus 1 Quantastor 2025-01-09 9.1 Critical
An administrator is able to execute commands as root via the alerts management dialog
CVE-2021-42079 1 Osnexus 1 Quantastor 2025-01-09 6.2 Medium
An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests.
CVE-2021-42080 1 Osnexus 1 Quantastor 2025-01-09 7.4 High
An attacker is able to launch a Reflected XSS attack using a crafted URL.
CVE-2021-42082 1 Osnexus 1 Quantastor 2025-01-09 7.8 High
Local users are able to execute scripts under root privileges.
CVE-2021-42081 1 Osnexus 1 Quantastor 2025-01-09 9.1 Critical
An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API.
CVE-2021-42083 3 Linux, Microsoft, Osnexus 3 Linux Kernel, Windows, Quantastor 2024-11-21 8.7 High
An authenticated attacker is able to create alerts that trigger a stored XSS attack.
CVE-2017-9979 1 Osnexus 1 Quantastor 2024-11-21 N/A
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary HTML or JavaScript code as a parameter, aka XSS.
CVE-2017-9978 1 Osnexus 1 Quantastor 2024-11-21 N/A
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response for users that don't exist on the system. An attacker could leverage this information to fine-tune and enumerate valid accounts on the system by searching for common usernames.