Skip to content
Noroxi

NetApp records

2,529 published records for vendor NetApp. 41 of them have been exploited in the wild (listed in CISA KEV) and 53 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
41 · 1.6%
Weaponized
53 · 2.1%
Pre-auth RCE
73
With a fix record
68.6%
Median publish → KEV
738 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 23
  9. 24
  10. 25
  11. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

2,529 records
  • CVE-2021-44228
    100Now

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    apache · log4jDec 10, 2021

  • CVE-2017-5638
    99Now

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mes

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · strutsMar 10, 2017

  • CVE-2021-41773
    99Now

    Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · http serverOct 5, 2021

  • CVE-2023-46604
    99Now

    Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · activemqOct 27, 2023

  • CVE-2021-42013
    99Now

    Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · http serverOct 7, 2021

  • CVE-2025-24813
    99Now

    Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · tomcatMar 10, 2025

  • CVE-2020-1938
    99Now

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · geodeFeb 24, 2020

  • CVE-2016-3427
    97Now

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to aff

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    oracle · jdkApr 21, 2016

  • CVE-2021-40438
    96Now

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.

    CriticalCVSS 9.0KEVWeaponizedEPSS 99%

    resf · rocky linuxSep 16, 2021

  • CVE-2024-38475
    96Now

    Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

    CriticalCVSS 9.1KEVWeaponizedEPSS 99%

    apache · http serverJul 1, 2024

  • CVE-2016-8735
    96Now

    Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before

    CriticalCVSS 9.8KEVWeaponizedEPSS 90%

    apache · tomcatApr 6, 2017

  • CVE-2023-4863
    95Now

    Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bo

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    google · chromeSep 12, 2023

  • CVE-2021-39144
    93Now

    XStream is vulnerable to a Remote Command Execution attack

    HighCVSS 8.5KEVWeaponizedEPSS 98%

    xstream · xstreamAug 23, 2021

  • CVE-2018-11776
    92Now

    Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (ei

    HighCVSS 8.1KEVWeaponizedEPSS 99%

    apache · strutsAug 22, 2018

  • CVE-2017-12617
    92Now

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.

    HighCVSS 8.1KEVWeaponizedEPSS 99%

    apache · tomcatOct 3, 2017

  • CVE-2017-12615
    92Now

    When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.

    HighCVSS 8.1KEVWeaponizedEPSS 99%

    apache · tomcatSep 19, 2017

  • CVE-2017-9805
    92Now

    The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStrea

    HighCVSS 8.1KEVWeaponizedEPSS 99%

    apache · strutsSep 15, 2017

  • CVE-2021-3156
    91Now

    Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root

    HighCVSS 7.8KEVWeaponizedEPSS 99%

    sudo project · sudoJan 26, 2021

  • CVE-2023-44487
    90Now

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmwareOct 10, 2023

  • CVE-2015-5477
    90Now

    named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion fa

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    isc · bindJul 29, 2015

  • CVE-2010-1871
    90Now

    JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for

    HighCVSS 8.8KEVWeaponizedEPSS 83%

    redhat · jboss enterprise application platformAug 5, 2010

  • CVE-2022-0847
    89Now

    A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe

    HighCVSS 7.8KEVWeaponizedEPSS 92%

    linux · linux kernelMar 10, 2022

  • CVE-2024-54085
    88Now

    Redfish Authentication Bypass

    CriticalCVSS 10.0KEVWeaponizedEPSS 60%

    ami · megarac sp-xMar 11, 2025

  • CVE-2020-15999
    87Now

    Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption vi

    CriticalCVSS 9.6KEVWeaponizedEPSS 63%

    google · chromeNov 2, 2020

  • CVE-2021-22555
    85Now

    Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

    HighCVSS 7.8KEVWeaponizedEPSS 78%

    linux · linux kernelJul 7, 2021