Türkiye-KEV

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclu

• pre-auth RCE
• Deserializasyon

facebook · react3 Ara 2025

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

• pre-auth RCE
• Komut enjeksiyonu

paloaltonetworks · pan-os12 Nis 2024

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software.

• Kimlik doğrulamasız

cisco · ios xe16 Eki 2023

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape

• pre-auth RCE
• Erişim denetimi (IDOR)

redis · redis18 Şub 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

• pre-auth RCE

apache · log4j10 Ara 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9.

• pre-auth RCE

gitlab · gitlab23 Nis 2021

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain reque

• pre-auth RCE
• Bellek hatası

microsoft · windows 10 190312 Mar 2020

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attack

• Kimlik doğrulamasız
• Yol geçişi

ivanti · connect secure8 May 2019

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

• pre-auth RCE

ivanti · endpoint manager mobile29 Oca 2026

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

• pre-auth RCE

ivanti · endpoint manager mobile29 Oca 2026

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

• pre-auth RCE
• Deserializasyon

microsoft · windows server 201214 Eki 2025

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

oracle · concurrent processing5 Eki 2025

Deserialization Vulnerability in GoAnywhere MFT's License Servlet

• pre-auth RCE
• Deserializasyon
• Komut enjeksiyonu

fortra · goanywhere managed file transfer18 Eyl 2025

Microsoft SharePoint Server Remote Code Execution Vulnerability

• pre-auth RCE
• Deserializasyon

microsoft · sharepoint server19 Tem 2025

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

• pre-auth RCE

cisco · identity services engine25 Haz 2025

Missing Authorization check in SAP NetWeaver (Visual Composer development server)

• Kimlik doğrulamasız
• Dosya yükleme

sap · netweaver24 Nis 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA

• pre-auth RCE
• Bellek hatası

ivanti · connect secure3 Nis 2025

Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

• pre-auth RCE
• Komut enjeksiyonu

paloaltonetworks · expedition9 Eki 2024

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.

• pre-auth RCE
• Komut enjeksiyonu

synacor · zimbra collaboration suite2 Eki 2024

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated a

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

ivanti · virtual traffic manager13 Ağu 2024

Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

apache · ofbiz5 Ağu 2024

XXE can expose crypt key and other secrets granting full admin access

• pre-auth RCE
• XXE

adobe · commerce13 Haz 2024

Apache OFBiz: Path traversal leading to RCE

• pre-auth RCE
• Yol geçişi

apache · ofbiz8 May 2024

Apache HugeGraph-Server: Command execution in gremlin

• pre-auth RCE
• Erişim denetimi (IDOR)

apache · hugegraph22 Nis 2024

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.

• Kimlik doğrulamasız
• SQL enjeksiyonu

fortinet · forticlient enterprise management server12 Mar 2024

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE

• pre-auth RCE
• SSTI

atlassian · confluence data center16 Oca 2024

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat we

• Kimlik doğrulamasız
• Yol geçişi

sysaid · sysaid10 Kas 2023

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability.

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

atlassian · confluence data center31 Eki 2023

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

• pre-auth RCE
• Deserializasyon

apache · activemq27 Eki 2023

VMware vCenter Server Out-of-Bounds Write Vulnerability

• pre-auth RCE
• Bellek hatası

vmware · vcenter server25 Eki 2023

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknow

• Kimlik doğrulamasız

atlassian · confluence data center4 Eki 2023

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

• pre-auth RCE
• Kimlik doğrulama atlatma

jetbrains · teamcity19 Eyl 2023

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass a

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• Erişim denetimi (IDOR)

ivanti · mobileiron sentry21 Ağu 2023

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resou

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

ivanti · endpoint manager mobile15 Ağu 2023

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the appli

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

ivanti · endpoint manager mobile25 Tem 2023

Unauthenticated remote code execution

• pre-auth RCE

citrix · netscaler application delivery controller19 Tem 2023

Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

• pre-auth RCE
• Deserializasyon

adobe · coldfusion12 Tem 2023

Microsoft SharePoint Server Elevation of Privilege Vulnerability

• Kimlik doğrulamasız

microsoft · sharepoint server13 Haz 2023

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL

• Kimlik doğrulamasız
• SQL enjeksiyonu

progress · moveit cloud2 Haz 2023

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.

• pre-auth RCE
• Komut enjeksiyonu

zyxel · atp100 firmware24 Nis 2023

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).

• pre-auth RCE
• Kimlik doğrulama atlatma
• Erişim denetimi (IDOR)

papercut · papercut mf20 Nis 2023

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution

• pre-auth RCE
• Komut enjeksiyonu

sophos · web appliance4 Nis 2023

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache San

• pre-auth RCE

zohocorp · manageengine access manager plus18 Oca 2023

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.

• pre-auth RCE

fortinet · fortios2 Oca 2023

Unauthenticated Command Injection

• pre-auth RCE
• Kimlik doğrulama atlatma
• Komut enjeksiyonu

cacti · cacti5 Ara 2022

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

oracle · e-business suite18 Eki 2022

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1

• pre-auth RCE

sophos · firewall23 Eyl 2022

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack

• pre-auth RCE

atlassian · confluence data center3 Haz 2022

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 f

• pre-auth RCE
• Komut enjeksiyonu

zyxel · usg flex 100w firmware12 May 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

f5 · big-ip access policy manager5 May 2022

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.

• pre-auth RCE
• SSTI

vmware · identity manager11 Nis 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

• pre-auth RCE

vmware · spring framework1 Nis 2022

An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

sophos · sfos25 Mar 2022

Adobe Commerce checkout improper input validation leads to remote code execution

• pre-auth RCE

adobe · commerce16 Şub 2022

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in th

• pre-auth RCE
• Kimlik doğrulama atlatma

zohocorp · manageengine desktop central12 Ara 2021

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthentic

• Kimlik doğrulamasız
• Bellek hatası

sonicwall · sma 200 firmware8 Ara 2021

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

• pre-auth RCE
• Yol geçişi

apache · http server7 Eki 2021

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

• pre-auth RCE
• Yol geçişi

apache · http server5 Eki 2021

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service.

• Kimlik doğrulamasız
• Yol geçişi
• Dosya yükleme

vmware · cloud foundation23 Eyl 2021

A command injection vulnerability in the web server of some Hikvision product.

• pre-auth RCE
• Komut enjeksiyonu

hikvision · ds-2cd2026g2-iu\/sl firmware22 Eyl 2021

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

• pre-auth RCE

microsoft · azure automation state configuration15 Eyl 2021

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execu

• pre-auth RCE
• Kimlik doğrulama atlatma

zohocorp · manageengine adselfservice plus7 Eyl 2021

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack

• pre-auth RCE

atlassian · confluence data center30 Ağu 2021

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check pl

• pre-auth RCE
• SSRF

vmware · vcenter server26 May 2021

Cisco HyperFlex HX Command Injection Vulnerabilities

• pre-auth RCE
• Komut enjeksiyonu

cisco · hyperflex hx data platform6 May 2021

Cisco HyperFlex HX Command Injection Vulnerabilities

• pre-auth RCE
• Komut enjeksiyonu

cisco · hyperflex hx data platform6 May 2021

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3

• pre-auth RCE
• SSRF

f5 · big-ip access policy manager31 Mar 2021

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.

• pre-auth RCE
• Yol geçişi

vmware · cloud foundation24 Şub 2021

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of i

• pre-auth RCE

laravel · laravel12 Oca 2021

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security ri

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

apache · airflow10 Kas 2020

An issue was discovered in SaltStack Salt through 3002.

• pre-auth RCE
• Komut enjeksiyonu

saltstack · salt6 Kas 2020

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).

• Kimlik doğrulamasız

oracle · weblogic server21 Eki 2020

A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows

• pre-auth RCE

microsoft · windows server 200814 Tem 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Inte

• pre-auth RCE
• Yol geçişi

f5 · big-ip access policy manager1 Tem 2020

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage

• pre-auth RCE
• Deserializasyon

zohocorp · manageengine desktop central6 Mar 2020

ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi

• pre-auth RCE
• Komut enjeksiyonu

zyxel · nas326 firmware4 Mar 2020

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.

• Kimlik doğrulamasız

apache · geode24 Şub 2020

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code executi

• pre-auth RCE
• Kimlik doğrulama atlatma
• Komut enjeksiyonu

draytek · vigor2960 firmware1 Şub 2020

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary co

• pre-auth RCE
• Komut enjeksiyonu

openbsd · opensmtpd29 Oca 2020

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0.

• Kimlik doğrulamasız
• Yol geçişi

citrix · application delivery controller firmware27 Ara 2019

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function.

• pre-auth RCE
• Deserializasyon

telerik · ui for asp.net ajax11 Ara 2019

Underflow in PHP-FPM can lead to RCE

• pre-auth RCE
• Bellek hatası

php · php28 Eki 2019

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a c

• pre-auth RCE
• Yol geçişi

nazgul · nostromo nhttpd14 Eki 2019

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565.

• pre-auth RCE
• Komut enjeksiyonu

dlink · dir-655 firmware27 Eyl 2019

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring re

• pre-auth RCE

vbulletin · vbulletin24 Eyl 2019

A flaw was found in Exim versions 4.87 to 4.91 (inclusive).

• pre-auth RCE
• Komut enjeksiyonu

exim · exim5 Haz 2019

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4

• Kimlik doğrulamasız
• Yol geçişi

fortinet · fortiproxy4 Haz 2019

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker

• pre-auth RCE
• Bellek hatası

microsoft · windows 716 May 2019

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

• Kimlik doğrulamasız

oracle · agile product lifecycle management26 Nis 2019

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa

• pre-auth RCE

microsoft · sharepoint enterprise server5 Mar 2019

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file uploa

• pre-auth RCE
• Dosya yükleme

adobe · coldfusion25 Eyl 2018

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious cli

• pre-auth RCE

samba · samba30 May 2017

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows S

• pre-auth RCE
• Bellek hatası

microsoft · internet information services26 Mar 2017

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthe

• Kimlik doğrulamasız

cisco · ios17 Mar 2017

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mes

• pre-auth RCE

apache · struts10 Mar 2017

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail c

• pre-auth RCE

phpmailer project · phpmailer30 Ara 2016

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier

• Kimlik doğrulamasız

oracle · jre18 Haz 2013

Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

splunk · splunk10 Haz 2026

A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by us

• Kimlik doğrulamasız

cisco · smart license utility4 Eyl 2024

Registration Authentication Bypass Vulnerability

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

telerik · report server 202429 May 2024