Skip to main content

CVE mentions, exploit signals, and PoC evidence in one fast public view.

Explore Sources Research Browse

Production

Loading current evidence

Loading the latest cvebuzz view.

© 2026 cvebuzz. CVE data courtesy of the National Vulnerability Database.

Subscribe via Atom About Browse CVEs Research Contact Privacy Policy Terms of Service

Search the full CVE archive | cvebuzz

Trending
Browse CVEs

Historical archive search

Search the full CVE archive

Search decades of CVEs by regex, severity, date, CWE, vendor/product tags, KEV, PoC, and other evidence.

Years with data: 28
Top vendors indexed: 100

FiltersRefine the archive+

Search by CVE ID or description (supports basic regex, e.g. log4j|struts)

Quick date range

Last 7 days Last 30 days Last 90 days

Severity (select multiple)

Critical (44,647)High (129,550)Medium (164,428)Low (18,314)Unrated (1,828)

Attack vector (select multiple)

Results

CVE results

474 results · Sorted by Highest Buzz score first

CVE-2023-35359

Published Aug 8, 2023

Windows Kernel Elevation of Privilege Vulnerability

CVSS 7.8 · High

evidence mentions: 2
Buzz score: 21.0

Vendor/product tagsBeta · best-effort

Network

Adjacent network

Local

Physical

CVSS minCVSS max

Year

CWEEnter a numeric ID such as 79 or the prefixed form CWE-79.

VendorBetaChoose an indexed vendor suggestion or enter another vendor.ProductBeta

Only show CVEs with KEV evidence

Only show CVEs with public PoC evidence

Only show CVEs with mention evidence

Only show CVEs with AlienVault OTX activity

Sort

microsoft / windows_10_1507

microsoft / windows_10_1607

microsoft / windows_10_1809

microsoft / windows_10_21h2

microsoft / windows_10_22h2

microsoft / windows_11_21h2

microsoft / windows_11_22h2

microsoft / windows_server_2008

microsoft / windows_server_2012

microsoft / windows_server_2016

microsoft / windows_server_2019

microsoft / windows_server_2022

CVE-2025-10249

Published Oct 9, 2025

The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions in all versions up…

CVSS 6.5 · Medium

evidence mentions: 2
Buzz score: 21.0

CVE-2025-26645

Published Mar 11, 2025

Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVSS 8.8 · High

evidence mentions: 2
Buzz score: 21.0

Vendor/product tagsBeta · best-effort

microsoft / remote_desktop_clientmicrosoft / windows_10_1507microsoft / windows_10_1607microsoft / windows_10_1809microsoft / windows_10_21h2microsoft / windows_10_22h2microsoft / windows_11_22h2microsoft / windows_11_23h2microsoft / windows_11_24h2microsoft / windows_appmicrosoft / windows_server_2008microsoft / windows_server_2016microsoft / windows_server_2019microsoft / windows_server_2022microsoft / windows_server_2022_23h2microsoft / windows_server_2025

CVE-2025-40605

Published Nov 20, 2025

A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequ…

CVSS 5.3 · Medium

evidence mentions: 2
Buzz score: 21.0

Vendor/product tagsBeta · best-effort

sonicwall / email_security_appliance_5000sonicwall / email_security_appliance_5000_firmwaresonicwall / email_security_appliance_5050sonicwall / email_security_appliance_5050_firmwaresonicwall / email_security_appliance_7000sonicwall / email_security_appliance_7000_firmwaresonicwall / email_security_appliance_7050sonicwall / email_security_appliance_7050_firmwaresonicwall / email_security_appliance_9000sonicwall / email_security_appliance_9000_firmware

CVE-2025-52207

Published Jun 27, 2025

PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.

CVSS 9.9 · Critical

evidence mentions: 2
Buzz score: 21.0

CVE-2026-20078

Published Apr 15, 2026

Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnera…

CVSS 6.5 · Medium

evidence mentions: 2
Buzz score: 21.0

Vendor/product tagsBeta · best-effort

cisco / unity_connection

CVE-2026-20081

Published Apr 15, 2026

Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnera…

CVSS 6.5 · Medium

evidence mentions: 2
Buzz score: 21.0

Vendor/product tagsBeta · best-effort

cisco / unity_connection

CVE-2026-21659

Published Feb 27, 2026

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthentic…

CVSS 8.7 · High

evidence mentions: 2
Buzz score: 21.0

Vendor/product tagsBeta · best-effort

johnsoncontrols / frick_controls_quantum_hdjohnsoncontrols / frick_controls_quantum_hd_firmware

CVE-2026-29098

Published Mar 19, 2026

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `action_exportCustom` function in…

CVSS 4.9 · Medium

evidence mentions: 2
Buzz score: 21.0

Vendor/product tagsBeta · best-effort

suitecrm / suitecrm

CVE-2026-29101

Published Mar 19, 2026

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a Denial-of-Service (DoS) vulnerabili…

CVSS 4.9 · Medium

evidence mentions: 2
Buzz score: 21.0

Vendor/product tagsBeta · best-effort

suitecrm / suitecrm

CVE-2026-29201

Published May 8, 2026

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

CVSS 8.6 · High

evidence mentions: 2
Buzz score: 21.0

CVE-2026-34026

Published Jun 15, 2026

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservice/openselfservicedo…

CVSS 7.1 · High

evidence mentions: 2
Buzz score: 21.0

CVE-2026-57871

Published Jul 7, 2026

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: thr…

CVSS 7.1 · High

evidence mentions: 2
Buzz score: 21.0

CVE-2026-63303

Published Jul 28, 2026

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolv…

CVSS 5.1 · Medium

evidence mentions: 2
Buzz score: 21.0

CVE-2026-50181

Published Jul 10, 2026

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and `WriteFileTool` appear to treat `curr_dir` a…

CVSS 7.1 · High

evidence mentions: 2
Buzz score: 20.6

Public PoC observedCWE-22CWE-23

CVE-2025-0390

Published Jan 11, 2025

A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of the file /wmOmNoticeHC…

CVSS 6.9 · Medium

evidence mentions: 3
Buzz score: 20.4

Vendor/product tagsBeta · best-effort

huayi-tec / jeewms

CVE-2025-23011

Published Jan 23, 2025

Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will ext…

CVSS 8.7 · High

evidence mentions: 3
Buzz score: 20.4

Vendor/product tagsBeta · best-effort

fedorarepository / fcrepo

CVE-2025-55747

Published Sep 3, 2025

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are acce…

CVSS 9.3 · Critical

evidence mentions: 3
Buzz score: 20.4

Vendor/product tagsBeta · best-effort

CVE-2026-43533

Published May 5, 2026

OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the intended media storage…

CVSS 8.9 · High

evidence mentions: 3
Buzz score: 20.4

Vendor/product tagsBeta · best-effort

openclaw / openclaw

CVE-2026-48681

Published Jun 4, 2026

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

CVSS 5.9 · Medium

evidence mentions: 3
Buzz score: 20.4

Vendor/product tagsBeta · best-effort

openstack / ironic

CVE-2026-49290

Published Jun 19, 2026

Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Prior to 0.2.9-alpha.5, a path-traversal vulnerability in Slo…

CVSS 7.6 · High

evidence mentions: 3
Buzz score: 20.4

CWE-22CWE-23CWE-36

CVE-2026-8073

Published May 19, 2026

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing…

CVSS 7.5 · High

evidence mentions: 3
Buzz score: 20.4

CVE-2025-1086

Published Feb 7, 2025

A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical. This vulnerability affects unknown code of the file /static/. The manipula…

CVSS 6.9 · Medium

evidence mentions: 3
Buzz score: 18.9

CVE-2025-32017

Published Apr 8, 2025

Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traver…

CVSS 8.8 · High

evidence mentions: 3
Buzz score: 18.9

Vendor/product tagsBeta · best-effort

umbraco / umbraco_cms

CVE-2025-55202

Published Aug 29, 2025

Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path t…

CVSS 2.7 · Low

evidence mentions: 3
Buzz score: 18.9

Vendor/product tagsBeta · best-effort

apereo / opencast

Showing 76-100 of 474 CVEsPage 4 of 19

Previous 1 3 4 5 19 Next

About these shareable results+

Every filter state lives in the URL so you can bookmark, share, and crawl exact historical slices instead of a client-only search session.

Buzz order uses the latest all-time evidence snapshot, refreshed every two hours. Evidence-bearing CVEs rank first; records without a snapshot continue newest-first.