Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
v.26.4.2314

Known Vulnerabilities

This page lists 15395 vulnerabilities in this category.

Critical: 1674 High: 4166 Medium: 8761 Low: 792 Information: 2
Vulnerability Name
CVE
CWE
Severity
PostgreSQL Stack-based Buffer Overflow Vulnerability (CVE-2026-14679)
CVE-2026-14679
CWE-121
High
PostgreSQL Access of Resource Using Incompatible Type ('Type Confusion') Vulnerability (CVE-2026-14680)
CVE-2026-14680
CWE-843
High
Envoy Proxy Use After Free Vulnerability (CVE-2024-23322)
CVE-2024-23322
CWE-416
High
Django External Control of File Name or Path Vulnerability (CVE-2026-15307)
CVE-2026-15307
CWE-73
High
Lighttpd Other Vulnerability (CVE-2007-1870)
CVE-2007-1870
-
High
Python CVE-2026-15308 Vulnerability (CVE-2026-15308)
CVE-2026-15308
-
High
SSRF via logo_uri in MITREid Connect
CVE-2021-26715
CWE-918
High
PHP Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2007-4825)
CVE-2007-4825
CWE-22
High
Grafana Uncontrolled Resource Consumption Vulnerability (CVE-2026-8609)
CVE-2026-8609
CWE-400
High
Moodle Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2026-26046)
CVE-2026-26046
CWE-138
High
PHP Address Book Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2012-1911)
CVE-2012-1911
CWE-138
High
PostgreSQL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-15741)
CVE-2026-15741
CWE-138
High
Grandnode Path Traversal (CVE-2019-12276)
CVE-2019-12276
CWE-22
High
Grafana Plugin Dir Traversal (CVE-2021-43798)
CVE-2021-43798
CWE-200
High
GitLab ExifTool RCE (CVE-2021-22205)
CVE-2021-22205
CWE-918
High
ForgeRock OpenAM Deserialization RCE (CVE-2021-29156)
CVE-2021-29156
CWE-502
High
ForgeRock AM / OpenAM Deserialization RCE (CVE-2021-35464)
CVE-2021-35464
CWE-502
High
OpenSSL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2012-2110)
CVE-2012-2110
CWE-119
High
F5 iControl REST unauthenticated remote command execution vulnerability
CVE-2021-22986
CWE-78
High
BuddyPress REST API Privilege Escalation
CVE-2021-21389
CWE-269
High
Microsoft Exchange Server Pre-auth Path Confusion vulnerability (CVE-2021-34473)
CVE-2021-34473
CWE-918
High
Alibaba Nacos Authentication Bypass (CVE-2021-29441)
CVE-2021-29441
CWE-287
High
Plone CMS Incorrect Default Permissions Vulnerability (CVE-2024-22889)
CVE-2024-22889
CWE-276
High
DotCMS unrestricted file upload (CVE-2022-26352)
CVE-2022-26352
CWE-434
High
GeoServer Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2024-24749)
CVE-2024-24749
CWE-22
High
GibbonEdu Deserialization of Untrusted Data Vulnerability (CVE-2024-24725)
CVE-2024-24725
CWE-502
High
PostgreSQL Other Vulnerability (CVE-2012-1618)
CVE-2012-1618
-
High
SharePoint CVE-2026-26106 Vulnerability (CVE-2026-26106)
CVE-2026-26106
-
High
BillQuick Web Suite SQL injection (CVE-2021-42258)
CVE-2021-42258
CWE-89
High
PostgreSQL Heap-based Buffer Overflow Vulnerability (CVE-2026-14670)
CVE-2026-14670
CWE-122
High
Oracle Database Server Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-1675)
CVE-2012-1675
CWE-264
High
Apache Solr Log4Shell RCE
CVE-2021-44228
CWE-78
High
MongoDB $where operator JavaScript injection
-
CWE-943
High
Django CVE-2024-24680 Vulnerability (CVE-2024-24680)
CVE-2024-24680
-
High
Metabase Local File Inclusion (CVE-2021-41277)
CVE-2021-41277
CWE-200
High
ManageEngine Desktop Central Deserialization RCE (CVE-2020-10189)
CVE-2020-10189
CWE-502
High
Jenkins Git Plugin missing permission check (CVE-2022-36883)
CVE-2022-36883
CWE-862
High
PostgreSQL Access of Resource Using Incompatible Type ('Type Confusion') Vulnerability (CVE-2026-14671)
CVE-2026-14671
CWE-843
High
ntopng Authentication Bypass (CVE-2021-28073)
CVE-2021-28073
CWE-287
High
Apache Tomcat CVE-2024-24549 Vulnerability (CVE-2024-24549)
CVE-2024-24549
-
High
Jenkins Origin Validation Error Vulnerability (CVE-2024-23898)
CVE-2024-23898
CWE-346
High
Unauthenticated remote code execution vulnerability in Confluence Server and Data Center
CVE-2022-26134
CWE-917
High
PostgreSQL Heap-based Buffer Overflow Vulnerability (CVE-2026-14676)
CVE-2026-14676
CWE-122
High
Bonita Authorization Bypass (CVE-2022-25237)
CVE-2022-25237
CWE-863
High
Authentication bypass via MongoDB operator injection
-
CWE-943
High
WordPress Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2007-4894)
CVE-2007-4894
CWE-138
High
Plone CMS CVE-2024-23756 Vulnerability (CVE-2024-23756)
CVE-2024-23756
-
High
PostgreSQL Integer Overflow or Wraparound Vulnerability (CVE-2026-14677)
CVE-2026-14677
CWE-190
High
AjaxPro.NET Professional Deserialization RCE (CVE-2021-23758)
CVE-2021-23758
CWE-502
High
VMware vCenter Server Unauthorized Remote Code Execution
CVE-2021-21972
CWE-78
High
spring-boot-actuator-logview Path Traversal
CVE-2021-21234
CWE-22
High
Reflected Cross-Site Scripting (XSS) vulnerability in PAN-OS management web interface
CVE-2020-2036
CWE-79
High
Apache Shiro authentication bypass
CVE-2020-17523
CWE-287
High
PostgreSQL Integer Overflow or Wraparound Vulnerability (CVE-2026-15742)
CVE-2026-15742
CWE-190
High
Atlassian Confluence Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-21674)
CVE-2024-21674
CWE-94
High
IBMHttpServer Untrusted Pointer Dereference Vulnerability (CVE-2026-8835)
CVE-2026-8835
CWE-822
High
PHP Other Vulnerability (CVE-2007-4659)
CVE-2007-4659
-
High
MOVEit Transfer Incorrect Authorization Vulnerability (CVE-2026-8800)
CVE-2026-8800
CWE-863
High
PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2335)
CVE-2012-2335
CWE-264
High
Apache OFBiz SOAPService Deserialization RCE
CVE-2021-26295
CWE-502
High
IBMHttpServer Heap-based Buffer Overflow Vulnerability (CVE-2026-8834)
CVE-2026-8834
CWE-122
High
ManageEngine ADSelfService Plus Authentication Bypass (CVE-2021-40539)
CVE-2021-40539
CWE-287
High
Grav CMS Unauthenticated RCE (CVE-2021-21425)
CVE-2021-21425
CWE-284
High
GoCD information disclosure (CVE-2021-43287)
CVE-2021-43287
CWE-200
High
Ghost CMS Theme Preview XSS (CVE-2021-29484)
CVE-2021-29484
CWE-79
High
Dragonfly Arbitrary File Read/Write (CVE-2021-33564)
CVE-2021-33564
CWE-20
High
Unauthenticated OGNL injection in Confluence Server and Data Center
CVE-2021-26084
CWE-917
High
PHP Other Vulnerability (CVE-2007-4658)
CVE-2007-4658
-
High
PHP Numeric Errors Vulnerability (CVE-2007-4657)
CVE-2007-4657
-
High
IBMHttpServer NULL Pointer Dereference Vulnerability (CVE-2026-8850)
CVE-2026-8850
CWE-476
High
SearchBlox Local File Inclusion (CVE-2020-35580)
CVE-2020-35580
CWE-22
High
IBMHttpServer Reachable Assertion Vulnerability (CVE-2026-8852)
CVE-2026-8852
CWE-617
High
IBMHttpServer Expired Pointer Dereference Vulnerability (CVE-2026-8854)
CVE-2026-8854
CWE-825
High
Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-21690)
CVE-2024-21690
CWE-707
High
AppWeb Authentication Bypass (CVE-2018-8715)
CVE-2018-8715
CWE-287
High