What Is a CVE? Common Vulnerabilities and Exposures

A remote code execution vulnerability in Apache Log4j2's JNDI message lookup feature. An attacker who can get a single crafted string into anything Log4j2 logs, an HTTP header, a username field, or any other user-controlled input, can force the server to fetch and run attacker-controlled Java code over JNDI. It became one of the most widely and rapidly exploited vulnerabilities in internet history within days of disclosure.

An out-of-bounds read in OpenSSL's TLS and DTLS heartbeat extension. A malformed heartbeat request tricks the server into echoing back up to 64KB of adjacent process memory, which can contain private keys, session tokens, passwords, and other sensitive data, and leaves no trace in server logs.

A flaw in how GNU Bash parses function definitions stored in environment variables. Bash keeps executing shell commands appended after a specially formatted function definition, so an attacker who can set an environment variable, commonly through CGI scripts, DHCP clients, or forced SSH commands, can run arbitrary commands on the system.

A remote code execution vulnerability in Microsoft's SMBv1 server caused by improper handling of specially crafted packets. Originally an NSA exploit tool, it was leaked by the Shadow Brokers in April 2017 and became the propagation mechanism for the WannaCry and NotPetya worms weeks later.

A remote code execution vulnerability in the Jakarta Multipart parser Apache Struts 2 uses for file uploads. A malformed Content-Type header triggers evaluation of an attacker-supplied OGNL expression, letting an unauthenticated attacker run arbitrary commands on the server. Exploitation of this flaw was the initial entry point for the 2017 Equifax breach, which exposed data on roughly 147 million people.

A remote code execution vulnerability in Spring Framework's data binding, exploitable on applications deployed as a WAR to Apache Tomcat and running on JDK 9 or later. A crafted HTTP request walks the class loader through Java's ClassLoader property chain to overwrite server configuration and drop a webshell.

A server-side request forgery vulnerability in Microsoft Exchange Server that lets an unauthenticated attacker send arbitrary HTTP requests and have the Exchange server authenticate on their behalf. Chained with a post-authentication vulnerability (CVE-2021-27065), it gives an unauthenticated attacker full remote code execution and was used in mass exploitation of on-premises Exchange servers in early 2021.

A vulnerability in the Windows Print Spooler service caused by improper handling of privileged file operations. An authenticated attacker, including a low-privileged domain user, can install a malicious printer driver that runs as SYSTEM, achieving remote code execution or local privilege escalation.

A remote code execution vulnerability in Windows Remote Desktop Services, triggered by a use-after-free condition in how the service handles a client disconnecting mid-session. It is wormable: malware could exploit it with no user interaction and spread automatically between vulnerable machines, similar to WannaCry.

A race condition in the Linux kernel's memory subsystem, in how copy-on-write handles private read-only memory mappings. A local attacker can win the race to gain write access to memory that should be read-only, including files owned by root, and use it to escalate to root privileges.

A remote code execution vulnerability in Drupal core caused by insufficient sanitization of input reaching Drupal's Form API AJAX handling. An unauthenticated attacker can inject a renderable array into a request and have Drupal execute arbitrary PHP, without needing an account on the target site.

A heap-based buffer overflow in sudo's command-line argument parsing, triggered when sudo is run in shell mode (sudo -s or sudoedit -s) with an argument that ends in a single unescaped backslash. Any local user, without needing to be listed in sudoers, can exploit it to escalate to root.

A remote code execution vulnerability reached through the Windows Support Diagnostic Tool (MSDT), triggered when an application such as Microsoft Word invokes MSDT via the ms-msdt URI scheme. A malicious Office document can trigger it without macros enabled, letting the attacker run PowerShell as the current user.

A SQL injection vulnerability in Progress Software's MOVEit Transfer managed file transfer application that lets an unauthenticated attacker access and modify the underlying database, then escalate to remote code execution. The Cl0p ransomware group exploited it as a zero-day to exfiltrate data from thousands of organizations in mid-2023.

A buffer overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that leaks session tokens from device memory. An unauthenticated attacker who captures a valid session token can hijack an authenticated session, bypassing both MFA and password requirements, and it was widely exploited by ransomware groups in late 2023.

A heap buffer overflow in curl and libcurl's SOCKS5 proxy handshake. When curl is told to let the SOCKS5 proxy resolve a hostname longer than 255 bytes, a logic bug can make curl instead copy the full oversized hostname into a fixed-size local buffer, corrupting the heap.

A cryptographic flaw in the Netlogon Remote Protocol (MS-NRPC) that Windows domain controllers use to authenticate machine accounts. A weak AES-CFB8 initialization vector implementation lets an attacker with network access to a domain controller reset its computer account password and impersonate it, gaining full control of the Active Directory domain with zero credentials required.

A remote code execution vulnerability in the vSphere Client's vRealize Operations plugin for VMware vCenter Server. An unauthenticated attacker with network access to port 443 can upload a crafted file and execute commands with unrestricted privileges on the underlying operating system.

A deliberately planted backdoor in the xz compression library, inserted over roughly two years by a project co-maintainer who gained trust before sabotaging the build scripts. The backdoored liblzma intercepts and manipulates sshd's RSA key authentication on affected glibc-based Linux systems, giving an attacker with the right private key unauthenticated remote code execution. It was caught only because a developer noticed a small SSH login latency regression.

A signal handler race condition in OpenSSH's server (sshd), reintroducing a vulnerability originally fixed in 2006 (CVE-2006-5051). If a client fails to authenticate within the configured login grace time, sshd's SIGALRM handler calls functions that are not safe to call from a signal handler, and winning the resulting race lets an unauthenticated remote attacker corrupt memory and achieve code execution as root.

A local privilege escalation vulnerability in polkit's pkexec utility, present in the default configuration of most Linux distributions since 2009. pkexec fails to properly handle a missing argument count, and a local attacker can abuse that gap together with environment variable injection to have the dynamic loader execute attacker-controlled code with root privileges.

A Linux kernel vulnerability in the pipe buffer implementation: a flag that marks pipe buffer pages as mergeable is never reset when a new pipe buffer is initialized, so a local attacker can use pipe splicing to overwrite the contents of arbitrary read-only files, including files they do not have write permission to, by chaining it onto the page cache.

An unauthenticated remote code execution vulnerability in Atlassian Confluence Server and Data Center, caused by an OGNL expression injection reachable through crafted request URIs. It was exploited in the wild as a zero-day before a patch existed, letting attackers run arbitrary commands on internet-facing Confluence instances with no credentials.

A path traversal flaw in a change made to Apache HTTP Server 2.4.49's URL path normalization, letting a crafted request map outside the configured document root to read arbitrary files, and, if mod_cgi is enabled for the mapped path, achieve remote code execution. The follow-up release 2.4.50 shipped an incomplete fix, tracked separately as CVE-2021-42013.

A path traversal vulnerability in Citrix Application Delivery Controller (ADC) and Citrix Gateway that lets an unauthenticated remote attacker write an arbitrary file to the appliance, then invoke it, achieving full remote code execution. It was exploited widely within weeks of disclosure and before an initial patch was available for all affected versions.

A pre-authentication arbitrary file read vulnerability in Pulse Connect Secure SSL VPN appliances. An unauthenticated attacker can request arbitrary files from the appliance, including its session database, which caches plaintext usernames and passwords of users who logged in, effectively handing over VPN credentials without any exploitation skill required.

A pre-authentication path traversal vulnerability in the FortiOS SSL VPN web portal that lets an unauthenticated attacker read arbitrary system files, including the session file that stores usernames and plaintext passwords of previously authenticated VPN users. Despite being disclosed and patched in 2019, unpatched appliances and leaked credential lists from this flaw were still being exploited by ransomware actors years later.

A CPU hardware vulnerability (rogue data cache load) affecting most Intel processors and some ARM designs, where speculative out-of-order execution allows an unprivileged process to read memory it should never be able to access, including kernel memory, by measuring cache-timing side effects left behind by speculatively executed instructions.

A CPU hardware vulnerability (bounds check bypass) affecting a broad range of processors from Intel, AMD, and ARM. By mistraining a CPU's branch predictor, an attacker can get speculative execution to run past a legitimate bounds check with attacker-chosen data, then recover the out-of-bounds value through a cache-timing side channel, even though the speculative result is architecturally discarded.

A design flaw in the SSL 3.0 protocol's CBC block cipher padding, which is not deterministically validated. A man-in-the-middle attacker who can force a protocol downgrade to SSLv3 and induce a victim's browser to make many requests can decrypt one byte of secure cookie or session data at a time using a padding-oracle style attack.

A key reinstallation vulnerability in the WPA2 4-way handshake used to secure Wi-Fi networks. A man-in-the-middle attacker can manipulate and replay a retransmitted handshake message so a client reinstalls an already-in-use encryption key, resetting its associated nonce and allowing the attacker to decrypt, and in some configurations forge or inject, network traffic.

A flaw in how Apache Tomcat's AJP connector processes requests, letting an attacker with network access to the AJP port (8009 by default) read arbitrary files from within a web application, such as configuration files containing credentials, or, if the application also allows file uploads, include and execute an uploaded file for remote code execution.

A remote code execution vulnerability in Samba caused by insufficient validation of client-supplied paths, letting a client that can write to any share upload a shared library and then trigger the server to load and execute it, achieving code execution with the privileges of the Samba server process, often root.

A remote code execution vulnerability in Apache Commons Text's default string interpolation feature. When an application passes untrusted input through StringSubstitutor with the library's default set of lookups enabled, the attacker can trigger the script, dns, or url lookups to run arbitrary script code, perform DNS lookups, or fetch remote content, similar in shape to Log4Shell but scoped to applications that echo user input through this specific API.

A follow-up vulnerability in Apache Log4j2 showing that the initial Log4Shell (CVE-2021-44228) fix in version 2.15.0 was incomplete. In non-default configurations using a Context Lookup in the logging pattern, attacker-controlled input could still craft a malicious lookup string that survived 2.15.0's sanitization, causing denial of service and, in some configurations, remote code execution. NVD initially scored this a low-severity DoS issue, then revised it upward once further analysis confirmed RCE was reachable in more setups than first believed.

An authentication bypass vulnerability in Ivanti Connect Secure and Ivanti Policy Secure gateways, affecting specific web component URIs that fail to enforce authentication. Exploited in the wild as a zero-day starting in late 2023, it lets an unauthenticated attacker access restricted resources, and when chained with a separate command injection flaw (CVE-2024-21887), enables full unauthenticated remote code execution.

A remote code execution vulnerability in ImageMagick caused by insufficient filtering of shell metacharacters in filenames passed to its delegate commands. An application that merely processes a user-supplied image, such as generating a thumbnail, can be compromised by a crafted file that abuses coders like MVG or URL to run arbitrary shell commands.