Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (17 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-75869 1 Zohocorp 1 Ddi Central 2026-11-12 8.8 High
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values.
CVE-2026-75868 1 Zohocorp 1 Ddi Central 2026-11-12 8.1 High
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.
CVE-2026-75867 1 Zohocorp 1 Ddi Central 2026-11-12 8.1 High
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.
CVE-2026-75864 1 Zohocorp 1 Ddi Central 2026-11-12 8.1 High
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.
CVE-2026-19421 1 Zohocorp 1 Ddi Central 2026-11-12 8.8 High
Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations.
CVE-2026-19422 1 Zohocorp 1 Ddi Central 2026-11-12 9.1 Critical
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.
CVE-2026-12266 1 Zohocorp 1 Ddi Central 2026-11-10 7.6 High
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API.
CVE-2026-12265 1 Zohocorp 1 Ddi Central 2026-11-10 8.8 High
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.
CVE-2026-12264 1 Zohocorp 1 Ddi Central 2026-11-10 8.8 High
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to arbitrary file write via HA Failover Config sync upload leading to code execution as root.
CVE-2026-12574 1 Zohocorp 1 Ddi Central 2026-11-10 8.1 High
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.
CVE-2026-12573 1 Zohocorp 1 Ddi Central 2026-11-10 8.8 High
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.
CVE-2026-12572 1 Zohocorp 1 Ddi Central 2026-11-10 7.2 High
Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account.
CVE-2026-95651 1 Zohocorp 1 Ddi Central 2026-11-10 7.5 High
Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent.
CVE-2026-95646 1 Zohocorp 1 Ddi Central 2026-11-10 8 High
Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands.
CVE-2026-12269 1 Zohocorp 1 Ddi Central 2026-09-28 8.8 High
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.
CVE-2026-12268 1 Zohocorp 1 Ddi Central 2026-09-28 8.8 High
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.
CVE-2026-12267 1 Zohocorp 1 Ddi Central 2026-09-28 7.2 High
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.