Query library

runZero includes a substantial library of pre-built queries. These queries can be used to detect vulnerabilities, trigger alerts, and apply changes to assets, such as tags and ownership. These queries are categorized by use case and risk level. Custom queries can also be configured to report vulnerabilities on matching assets and services.

Best Practice #

NameTypeSeverityQueryUS SaaS LinkEU SaaS Link
Google Workspace Account Without MFAusersMediumsource:googleworkspace isEnforcedIn2Sv:fLinkLink
Active Directory Account Expires SoonusersLowhas:accountExpiresTS AND accountExpiresTS:<30daysLinkLink
Authenticated Web Service Without EncryptionservicesLow(_asset.protocol:http AND not _asset.protocol:tls) AND ( html.inputs:"password:" OR last.html.inputs:"password:" OR has:http.head.wwwAuthenticate OR has:last.http.head.wwwAuthenticate )LinkLink
HTTP Directory Indexing EnabledservicesLow_asset.protocol:http AND protocol:http AND has:html.title AND (html.title:="Index of /%" OR html.title:="HFS /%" OR html.title:="Directory listing%")LinkLink
Network Time Protocol Service With Skewed ClockservicesLow_asset.protocol:ntp and protocol:ntp and has:ntp.skewLinkLink
Obsolete SSL ProtocolservicesLow_asset.protocol:tls AND protocol:"tls" AND tls.supportedVersionNames:"SSL"LinkLink
Open Wireless NetworkwirelessLowauth:openLinkLink
SMB Signing Not RequiredservicesLow_asset.protocol:smb AND protocol:smb AND has:smb.signing AND NOT smb.signing:requiredLinkLink
SMB Version 1 EnabledservicesLow_asset.protocol:smb1 protocol:smb1LinkLink
SNMP Default CommunityservicesLow_asset.protocol:snmp AND protocol:snmp AND has:snmp.defaultCommunitiesLinkLink
Wireless Network Using WEP EncryptionwirelessLowenc:wepLinkLink
Active Directory Account Password Does Not ExpireusersInfopasswordNeverExpires:trueLinkLink

Certificates #

NameTypeSeverityQueryUS SaaS LinkEU SaaS Link
Private Key Is Widely SharedvulnerabilitiesMediumsource:runzero AND ( foreign_id:rz-ioasm-pubkey-widely-shared OR foreign_id:rz-ioasm-pubkey-known-private )LinkLink
Expired Certificate On TLS ServiceservicesLow_asset.protocol:tls AND tls.notAfterTS:LinkLink
Certificate On TLS Service Expires SoonservicesInfo_asset.protocol:tls AND tls.notAfterTS:<6weeks AND tls.notAfterTS:>nowLinkLink

Compliance #

NameTypeSeverityQueryUS SaaS LinkEU SaaS Link
Kaspersky Lab Security SoftwareassetsInfoedr.name:KasperskyLinkLink
Kaspersky Lab SoftwaresoftwareInfovendor:KasperskyLinkLink
NDAA 2019 Section 889 EquipmentassetsInfo(( mac_vendor:zte OR mac_vendor:huawei OR mac_vendor:CRRC OR mac_vendor:dahua OR mac_vendor:hikvision OR mac_vendor:hisilicon OR mac_vendor:panda OR mac_vendor:dawning OR mac_vendor:hangzhou OR mac_vendor:hytera OR mac_vendor:inspur OR mac_vendor:"Aero Engine Corporation of China" OR mac_vendor:"Aviation Industry Corporation of China" OR mac_vendor:"China Aerospace" OR mac_vendor:"China Electronics" OR mac_vendor:"China General Nuclear Power" OR mac_vendor:"China Mobile" OR mac_vendor:"China National Nuclear Power" OR mac_vendor:"China North Industries Group" OR mac_vendor:"China Railway" OR mac_vendor:"China Shipbuilding" OR mac_vendor:"China South Industries Group" OR mac_vendor:"China State Shipbuilding" OR mac_vendor:"China Telecommunications" OR mac_vendor:ztec OR mac_vendor:ztek OR mac_vendor:"z-tec" OR mac_vendor:5shanghai OR mac_vendor:"Hella Sonnen" OR mac_vendor:anhui OR mac_vendor:"technology sdn bhd" OR mac_vendor:azteq ) OR ( hw:zte OR hw:huawei OR hw:CRRC OR hw:dahua OR hw:hikvision OR hw:hisilicon OR hw:panda OR hw:dawning OR hw:hangzhou OR hw:hytera OR hw:inspur OR hw:"Aero Engine Corporation of China" OR hw:"Aviation Industry Corporation of China" OR hw:"China Aerospace" OR hw:"China Electronics" OR hw:"China General Nuclear Power" OR hw:"China Mobile" OR hw:"China National Nuclear Power" OR hw:"China North Industries Group" OR hw:"China Railway" OR hw:"China Shipbuilding" OR hw:"China South Industries Group" OR hw:"China State Shipbuilding" OR hw:"China Telecommunications" OR hw:ztec OR hw:ztek OR hw:"z-tec" OR hw:5shanghai OR hw:"Hella Sonnen" OR hw:anhui OR hw:"technology sdn bhd" OR hw:azteq ))LinkLink
Secure Networks Act Section 2 EquipmentassetsInfo( hw:huawei OR hw:="zte%" OR hw:hytera OR hw:hikvision OR hw:dahua OR hw:"china mobile" OR hw:"china telecom" OR hw:"china unicom" OR hw:"pacific networks corp" OR hw:"comnet (usa) llc" OR hw:zhejiang ) OR ( mac_vendor:huawei OR mac_vendor:="zte%" OR mac_vendor:hytera OR mac_vendor:hikvision OR mac_vendor:dahua OR mac_vendor:"china mobile" OR mac_vendor:"china telecom" OR mac_vendor:"china unicom" OR mac_vendor:"pacific networks corp" OR mac_vendor:"comnet (usa) llc" OR mac_vendor:"zhejiang" )LinkLink

End-of-Life #

NameTypeSeverityQueryUS SaaS LinkEU SaaS Link
Accellion File Transfer ApplianceassetsHighhw:"Accellion File Transfer Appliance"LinkLink
AutomationDirect MB-GATEWAYassetsHighhw:="AutomationDirect Modbus Gateway" OR hw:="Automation Direct Modbus Gateway"LinkLink
Cisco Small Business RoutersassetsHighhw:"Cisco RV0" OR hw:"Cisco RV110W" OR hw:"Cisco RV130" OR hw:"Cisco RV132W" OR hw:"Cisco RV134W" OR hw:"Cisco RV160" OR hw:"Cisco RV215" OR hw:"Cisco RV260" OR hw:"Cisco RV320" OR hw:"Cisco RV325" OR hw:"Cisco RV340" OR hw:"Cisco RV345" LinkLink
Cisco Small Business SwitchesassetsHighhw:"Cisco" and type:"switch" and ( hw:"SRW224G4-K9-" OR hw:"SRW2016-K9-" OR hw:"SG500X-" OR hw:"SF300-" OR hw:"SRW208G-K9-" OR hw:"SG300-" OR hw:"SRW2048-K9-" OR hw:"SLM2048PT-" OR hw:"SRW208-K9-" OR hw:"SF302-" OR hw:"SLM2008PT-" OR hw:"SLM224PT-" OR hw:"SF500-" OR hw:"SLM2008T-" OR hw:"SG500-" OR hw:"SG200-" OR hw:"SF200-" OR hw:"SLM224GT-" OR hw:"SLM2016T-")LinkLink
End-of-Life Operating SystemassetsHigh(os_eol_extended:>0 AND os_eol_extended:LinkLink
Zyxel CPE Remote Command ExecutionassetsHighhw:"VMG1312-B10A" OR hw:"VMG1312-B10B" OR hw:"VMG1312-B10E" OR hw:"VMG3312-B10A" OR hw:"VMG3313-B10A" OR hw:"VMG3926-B10B" OR hw:"VMG4325-B10A" OR hw:"VMG4380-B10A" OR hw:"VMG8324-B10A" OR hw:"VMG8924-B10A" OR hw:"SBG3300" OR hw:"SBG3500"LinkLink
D-Link DNS Family NASassetsInfofp.hw.product:="DNS-320L" OR fp.hw.product:="DNS-325" OR fp.hw.product:="DNS-327L" OR fp.hw.product:="DNS-340L"LinkLink
Edimax IC-7100 IP CameraassetsInfohw:"EDIMAX IC-71%Camera"LinkLink

Internet Exposure #

NameTypeSeverityQueryUS SaaS LinkEU SaaS Link
Publicly Exposed Configuration Database ServerservicesHighservice_has_public:t AND ( _asset.protocols:zookeeper OR _asset.protocols:etcd2 OR _asset.protocols:consul ) AND ( protocol:zookeeper OR protocol:etcd2 OR protocol:consul )LinkLink
Potential External Access To Internal AssetvulnerabilitiesMediumsource:runzero AND ( foreign_id:rz-query-rz-ioasm-internal-mac OR foreign_id:rz-query-rz-ioasm-internal-pubkey )LinkLink
Potential External Access To Remote Desktop ServiceassetsMediumhas_public:t AND service_has_public:f AND ( ( _asset.protocol:rdp AND protocol:rdp ) OR ( _asset.protocol:vnc AND protocol:vnc ) OR ( _asset.protocol:teamviewer AND protocol:teamviewer ) OR ( _asset.protocol:spice AND protocol:spice ) )LinkLink
Publicly Exposed Baseboard Management ControllerassetsMediumhaspublic:t AND (type:bmc OR protocol:ipmi)LinkLink
Publicly Exposed Remote Desktop GatewayservicesMediumservice_has_public:t AND ( (_asset.protocol:dtls OR _asset.protocol:http) AND ((protocol:dtls OR protocol:http) AND has:rdg.transport) )LinkLink
Publicly Exposed Remote Desktop ServiceassetsMediumservice_has_public:t AND ( ( _asset.protocol:rdp AND protocol:rdp ) OR ( _asset.protocol:vnc AND protocol:vnc ) OR ( _asset.protocol:teamviewer AND protocol:teamviewer ) OR ( _asset.protocol:spice AND protocol:spice ) )LinkLink
Publicly Exposed SSH Server With Password AuthenticationservicesMediumservice_has_public:t AND ( _asset.protocol:ssh AND protocol:ssh AND ssh.authMethods:password )LinkLink
Publicly Exposed Windows Management ServiceassetsMediumservice_has_public:t AND ( ( _asset.protocol:smb AND protocol:smb ) OR ( _asset.protocol:epm AND protocol:epm ) OR ( _asset.protocol:wsman AND protocol:wsman ) )LinkLink
Potential External Access To Configuration Database ServerservicesLowhas_public:t AND service_has_public:f AND ( _asset.protocols:zookeeper OR _asset.protocols:etcd2 OR _asset.protocols:consul ) AND ( protocol:zookeeper OR protocol:etcd2 OR protocol:consul )LinkLink
Potential External Access To Key-Value Database ServerservicesLowhas_public:t AND service_has_public:f AND ( _asset.protocols:memcache OR _asset.protocols:redis ) AND ( protocol:memcache OR protocol:redis )LinkLink
Potential External Access To NoSQL Database ServerservicesLowhas_public:t AND service_has_public:f AND ( _asset.protocols:mongodb OR _asset.protocols:couchdb OR _asset.protocols:cassandra OR _asset.protocols:elasticsearch OR _asset.protocols:riak OR _asset.protocols:influxdb ) AND ( protocol:mongodb OR protocol:couchdb OR protocol:cassandra protocol:elasticsearch OR protocol:riak OR protocol:influxdb )LinkLink
Potential External Access To Operational Technology ServiceservicesLowhas_public:t AND service_has_public:f AND ( _asset.protocols:bacnet OR _asset.protocols:modbus OR _asset.protocols:dnp3 OR _asset.protocols:opcua OR _asset.protocols:cip OR _asset.protocols:ethernetip OR _asset.protocols:profinet OR _asset.protocols:prosoft OR _asset.protocols:s7comm OR _asset.protocols:fins OR _asset.protocols:comtrol OR _asset.protocols:atg ) AND ( protocol:bacnet OR protocol:modbus OR protocol:dnp3 OR protocol:opcua OR protocol:cip OR protocol:ethernetip OR protocol:profinet OR protocol:prosoft OR protocol:s7comm OR protocol:fins OR protocol:comtrol OR protocol:atg )LinkLink
Potential External Access To Relational Database ServerservicesLowhas_public:t AND service_has_public:f AND ( _asset.protocols:mysql OR _asset.protocols:postgres OR _asset.protocols:mssql OR _asset.protocols:oracledb ) AND ( protocol:mysql OR protocol:postgres OR protocol:mssql OR protocol:oracledb )LinkLink
Potential External Access To Remote Desktop GatewayservicesLowhas_public:t AND service_has_public:f AND ( (_asset.protocol:dtls OR _asset.protocol:http) AND ((protocol:dtls OR protocol:http) AND has:rdg.transport) )LinkLink
Potential External Access To SSH Server With Password AuthenticationservicesLowhas_public:t AND service_has_public:f AND ( _asset.protocol:ssh AND protocol:ssh AND ssh.authMethods:password )LinkLink
Potential External Access To Windows Management ServiceassetsLowhas_public:t AND service_has_public:f AND ( ( _asset.protocol:smb AND protocol:smb ) OR ( _asset.protocol:epm AND protocol:epm ) OR ( _asset.protocol:wsman AND protocol:wsman ) )LinkLink
Publicly Exposed Key-Value Database ServerservicesLowservice_has_public:t AND ( _asset.protocols:memcache OR _asset.protocols:redis ) AND ( protocol:memcache OR protocol:redis )LinkLink
Publicly Exposed NoSQL Database ServerservicesLowservice_has_public:t AND ( _asset.protocols:mongodb OR _asset.protocols:couchdb OR _asset.protocols:cassandra OR _asset.protocols:elasticsearch OR _asset.protocols:riak OR _asset.protocols:influxdb ) AND ( protocol:mongodb OR protocol:couchdb OR protocol:cassandra protocol:elasticsearch OR protocol:riak OR protocol:influxdb )LinkLink
Publicly Exposed Operational Technology ServiceservicesLowservice_has_public:t AND ( _asset.protocols:bacnet OR _asset.protocols:modbus OR _asset.protocols:dnp3 OR _asset.protocols:opcua OR _asset.protocols:cip OR _asset.protocols:ethernetip OR _asset.protocols:profinet OR _asset.protocols:prosoft OR _asset.protocols:s7comm OR _asset.protocols:fins OR _asset.protocols:comtrol OR _asset.protocols:atg ) AND ( protocol:bacnet OR protocol:modbus OR protocol:dnp3 OR protocol:opcua OR protocol:cip OR protocol:ethernetip OR protocol:profinet OR protocol:prosoft OR protocol:s7comm OR protocol:fins OR protocol:comtrol OR protocol:atg )LinkLink
Publicly Exposed Relational Database ServerservicesLowservice_has_public:t AND ( _asset.protocols:mysql OR _asset.protocols:postgres OR _asset.protocols:mssql OR _asset.protocols:oracledb ) AND ( protocol:mysql OR protocol:postgres OR protocol:mssql OR protocol:oracledb )LinkLink

Open Access #

NameTypeSeverityQueryUS SaaS LinkEU SaaS Link
Cisco Smart Install ServiceservicesCritical_asset.protocol:ciscosmi protocol:ciscosmiLinkLink
Sun Solaris sadmind RPC ServiceservicesCritical_asset.protocol:rpcbind protocol:rpcbind rpcbind.programs:"100232-v10-"LinkLink
Unauthenticated Android Debug BridgeservicesCritical_asset.protocol:adb AND protocol:adb AND has:adb.featuresLinkLink
Unauthenticated Apache ZooKeeper DatabaseservicesCritical_asset.protocol:zookeeper AND protocol:zookeeper AND zk.access:allowedLinkLink
Unauthenticated CNCF etcd DatabaseservicesCritical_asset.protocol:etcd2 protocol:etcd2 etcd2.access:allowedLinkLink
Unauthenticated Distributed Ruby ServiceservicesCritical_asset.protocol:drbd AND protocol:drbdLinkLink
Unauthenticated MongoDB DatabaseservicesCritical_asset.protocol:mongodb AND protocol:mongodb AND mongodb.auth:openLinkLink
Zabbix Agent Without ACLservicesCritical_asset.protocol:zabbix-agent AND protocol:zabbix-agent AND NOT zabbix.isLocal:trueLinkLink
Unauthenticated Apache CouchDB DatabaseservicesHigh_asset.protocol:couchdb AND protocol:couchdbLinkLink
Unauthenticated Cassandra DatabaseservicesHigh_asset.protocol:cassandra AND protocol:cassandraLinkLink
Unauthenticated Elastic Search DatabaseservicesHigh_asset.protocol:elasticsearch AND protocol:elasticsearchLinkLink
Unauthenticated HashiCorp Consul DatabaseservicesHigh_asset.protocol:consul protocol:consul has:consul.config.datacenterLinkLink
Unauthenticated InfluxDB DatabaseservicesHigh_asset.protocol:influxdb AND protocol:influxdbLinkLink
Unauthenticated Memcached DatabaseservicesHigh_asset.protocol:memcache AND protocol:memcacheLinkLink
Unauthenticated Redis DatabaseservicesHigh_asset.protocol:redis AND protocol:redis AND has:redis.redisVersionLinkLink
Unauthenticated Riak DatabaseservicesHigh(_asset.protocol:riak AND protocol:riak) OR (_asset.protocol:riak-http AND protocol:riak-http)LinkLink
Click Modular Router ShellservicesMedium_asset.protocol:click protocol:clickLinkLink
Unauthenticated MongoDB Database (Limited)servicesMedium_asset.protocol:mongodb AND protocol:mongodb AND mongodb.auth:limitedLinkLink
World-Readable NFS ExportservicesMedium_asset.protocol:mountd AND protocol:="mountd" AND nfs.allowed:"%=*"LinkLink

Rapid Response #

NameTypeSeverityQueryUS SaaS LinkEU SaaS Link
Rapid Response: Squid URN Handling Buffer Overflow (CVE-2025-54574)softwareCriticalvendor:"Squid Cache" and product:"Squid" and version:>0 AND version:<6.4LinkLink
Rapid Response: Barracuda Message Archiver Reflected XSS (CVE-2025-8319)servicesInfo_asset.protocol:http AND protocol:http AND has:last.http.body AND last.http.body:"/css/archiver.css" AND last.http.body:"barracuda_info"LinkLink
Rapid Response: Fortinet FortiSIEM OS Command Injection (CVE-2025-25256)servicesInfo_asset.protocol:http AND protocol:http AND has:favicon.ico.image.mmh3 AND favicon.ico.image.mmh3:="-1341442175"LinkLink
Rapid Response: Fortinet FortiWeb Authentication Bypass (CVE-2025-52970)softwareInfovendor:=Fortinet AND product:=FortiWebLinkLink
Rapid Response: Multiple Vulnerabilities In Microsoft SharePoint ServersoftwareInfovendor:="Microsoft" AND product:="SharePoint Server%"LinkLink
Rapid Response: Multiple Vulnerabilities In N-Able N-CentralservicesInfo_asset.protocol:http AND protocol:http AND has:html.title AND html.title:="N-central Login Redirect"LinkLink
Rapid Response: Multiple Vulnerabilities In RUCKUS Networks Management ProductsservicesInfo_asset.protocol:http AND protocol:http AND has:last.html.title AND (last.html.title:"Virtual SmartZone" OR last.html.title:"Ruckus Wireless")LinkLink
Rapid Response: Multiple Vulnerabilities In SonicWall SMA 100 Series ProductsassetsInfohw:="SonicWall SMA100"LinkLink
Rapid Response: Multiple Vulnerabilities In Tridium NiagaraassetsInfoos:Tridium hw:NiagaraLinkLink
Rapid Response: Plex Media Server 1.41.7.X To 1.42.0.X < 1.42.1 Undisclosed VulnerabilitysoftwareInfovendor:=Plex AND product:="Media Server"LinkLink
Rapid Response: SUSE Multi-Linux Manager WebSocket RCE (CVE-2025-46811)servicesInfo_asset.protocol:http AND protocol:http AND has:html.title AND html.title:="SUSE%Manager - Sign In"LinkLink
Rapid Response: Trend Micro Apex One OS Command Injection VulnerabilitiesservicesInfo_asset.protocol:http AND protocol:http AND has:html.body AND html.body:"officescan/console/html/cgi/cgiChkMasterPwd.exe"LinkLink

Vulnerability #

NameTypeSeverityQueryUS SaaS LinkEU SaaS Link
AirPlay Protocol Remote Code Execution (AirBorne)assetsCriticalhw:="apple%" AND protocol:airplay AND ( (os:="apple macos" AND ((osversion:>"13.0" AND osversion:<"13.7.5") OR (osversion:>"14.0" AND osversion:<"14.7.5") OR (osversion:>"15.0" AND osversion:<"15.4"))) OR (os:="apple ipados" AND ((osversion:>"17.0" AND osversion:<"17.7.6") OR (osversion:>"18.0" AND osversion:<"18.4"))) OR ((os:="apple tvos" OR os:="apple audioos") AND osversion:>0 AND osversion:<"18.4") OR (os:="apple ios" AND osversion:>0 AND osversion:<"18.4") OR (os:="apple visionos" AND osversion:>0 AND osversion:<"2.4") )LinkLink
Apache 2.4.49 < 2.4.51 Information DisclosuresoftwareCritical_asset.protocol:http product:HTTPD AND version:>=2.4.49 AND version:<2.4.51LinkLink
Apache ActiveMQ Remote Code Execution (CVE-2023-46604)softwareCritical_asset.protocol:activemq AND product:ActiveMQ AND ((version:>0 AND version:<5.15.16) OR (version:>=5.16.0 AND version:<5.16.7) OR (version:>=5.17.0 AND version:<5.17.6) OR (version:>=5.18.0 AND version:<5.18.3))LinkLink
Apache Solr Log4Shell Remote Code ExecutionsoftwareCriticalvendor:=Apache AND product:Solr AND ((version:>=7.4.0 AND version:<7.7.3) OR (version:>=8.0.0 AND version:<8.11.0))LinkLink
Apache Tomcat 10.1.0-M1 < 10.1.34 Multiple VulnerabilitiessoftwareCriticalproduct:Tomcat AND (version:>10.1.0-M1 AND version:<10.1.34)LinkLink
Apache Tomcat 11.0.0-M1 < 11.0.2 Multiple VulnerabilitiessoftwareCriticalproduct:Tomcat AND (version:>11.0.0-M1 AND version:<11.0.2)LinkLink
Apache Tomcat 9.0.0-M1 < 9.0.98 Multiple VulnerabilitiessoftwareCriticalproduct:Tomcat AND (version:>9.0.0-M1 AND version:<9.0.98)LinkLink
Apple tvOS < 16.2 Multiple VulnerabilitiesassetsCriticalos:"Apple tvOS" AND osversion:>0 AND osversion:<16.2LinkLink
Atlassian Confluence 8.0 < 8.5.4 Remote Code ExecutionsoftwareCriticalvendor:=Atlassian AND product:Confluence AND (version:>=8.0 AND version:<8.5.4)LinkLink
Atlassian Confluence Cross-Site Scripting (CVE-2024-4367)softwareCriticalvendor:=Atlassian AND product:Confluence AND ( (version:>0 AND version:<7.19.25) OR (version:>=7.20.0 AND version:<8.5.11) OR (version:>=8.6.0 AND version:<8.9.3)) LinkLink
Atlassian Confluence Path Traversal (CVE-2019-3396)softwareCriticalvendor:=Atlassian AND product:Confluence AND ( (version:>0 AND version:<6.6.12) OR (version:>=6.7.0 AND version:<6.12.3) OR (version:>=6.13.0 AND version:<6.13.3) OR (version:>=6.14.0 AND version:<6.14.2))LinkLink
Atlassian Confluence Privilege Escalation (CVE-2023-22515)softwareCriticalvendor:=Atlassian AND product:Confluence AND ( (version:>=8.0 AND version:<8.3.3) OR (version:>=8.4.0 AND version:<8.4.3) OR (version:>=8.5.0 AND version:<8.5.2)) LinkLink
Atlassian Confluence Remote Code Execution (CVE-2021-26084)softwareCriticalvendor:=Atlassian AND product:Confluence AND ( (version:>0 AND version:<6.13.23) OR (version:>=6.14.0 AND version:<7.4.11) OR (version:>=7.5.0 AND version:<7.11.6) OR (version:>=7.12.0 AND version:<7.12.5)) LinkLink
Atlassian Confluence Remote Code Execution (CVE-2022-26134)softwareCriticalvendor:=Atlassian AND product:Confluence AND ( (version:>=1.3.0 AND version:<7.4.17) OR (version:>=7.13.0 AND version:<7.13.7) OR (version:>=7.14.0 AND version:<7.14.3) OR (version:>=7.15.0 AND version:<7.15.2) OR (version:>=7.16.0 AND version:<7.16.4) OR (version:>=7.17.0 AND version:<7.17.4) OR (version:>=7.18.0 AND version:<7.18.1) OR )LinkLink
Atlassian Confluence Server-Side Request Forgery (CVE-2019-3395)softwareCriticalvendor:=Atlassian AND product:Confluence AND ( (version:>0 AND version:<6.6.7) OR (version:>=6.7.0 AND version:<6.8.5) OR (version:>=6.9.0 AND version:<6.9.3))LinkLink
Broadcom VMware ESXi Guest EscapeassetsCriticalos:"vmware esxi" AND ((os_version:>0 AND os_version:<6) OR (os_version:>6 AND os_version:<"6.7.0 build-24514018") OR (os_version:>7 AND os_version:<"7.0.3 build-24585291") OR (os_version:>8 AND os_version:<"8.0.2") OR (os_version:>"8.0.2" AND os_version:<"8.0.2 build-24585300") OR (os_version:>"8.0.3" AND os_version:<"8.0.3 build-24585383"))LinkLink
Broadcom VMware ESXi VM EscapeassetsCriticalos:"vmware esxi" AND ((os_version:>7 AND os_version:<"7.0.3 build-24784741") OR (os_version:>8 AND (os_version:<"8.0.2 build-24789317" OR os_version:<"8.0.3 build-24784735")))LinkLink
Cacti < 1.2.23 Remote Code ExecutionsoftwareCritical_asset.products:Cacti AND vendor:Cacti AND product:Cacti AND (version:>0 AND version:<1.2.23)LinkLink
Cleo Harmony < 5.8.0.21 Unrestricted File Upload/DownloadsoftwareCriticalvendor:=Cleo AND product:harmony AND (version:>0 AND version:<5.8.0.21)LinkLink
Cleo Lexicom < 5.8.0.21 Unrestricted File Upload/DownloadsoftwareCriticalvendor:=Cleo AND product:lexicom AND (version:>0 AND version:<5.8.0.21)LinkLink
Cleo VLTrader < 5.8.0.21 Unrestricted File Upload/DownloadsoftwareCriticalvendor:=Cleo AND product:vltrader AND (version:>0 AND version:<5.8.0.21)LinkLink
ConnectWise ScreenConnect < 23.9.8 Remote Code ExecutionsoftwareCriticalvendor:ConnectWise AND product:ScreenConnect AND (version:>0 AND version:<23.9.8)LinkLink
Elastic Kibana 8.15.0 < 8.17.3 Remote Code ExecutionsoftwareCriticalvendor:Elastic AND product:kibana AND (version:>8.14 AND version:<8.17.3)LinkLink
Elasticsearch < 1.2 Remote Code ExecutionsoftwareCriticalvendor:elastic AND product:search AND ( (version:>0 AND version:<1.2 AND NOT version:"0:%") OR (version:"0:%" AND version:>"0:0" AND version:<"0:1.2"))LinkLink
F5 Big-IP Remote Code Execution (CVE-2021-22986)assetsCriticalos:="F5 Networks BIG-IP" AND ( (osversion:>"12.1" AND osversion:<"12.1.5.3") OR (osversion:>"13.1" AND osversion:<"13.1.3.6") OR (osversion:>"14.1" AND osversion:<"14.1.4") OR (osversion:>"15.1" AND osversion:<"15.1.2.1") OR (osversion:>"16.0" AND osversion:<"16.0.1.1") )LinkLink
GitLab Remote Code Execution (CVE-2021-22205)softwareCriticalvendor:=GitLab AND product:gitlab AND ((version:>11.9 AND version:<13.8.7) OR (version:>13.9 AND version:<13.9.5) OR (version:>13.10 AND version:<13.10.2))LinkLink
HPE iLO 4 Authentication BypassassetsCriticalos:"iLO 4" and os_version:>0 AND os_version:<=2.53LinkLink
HashiCorp Vault Multiple Vulnerabilities - HCSEC-2025-22softwareCriticalvendor:="HashiCorp" AND product:"Vault" AND ( (version:>=1.20.0 AND version:<1.20.2) OR (version:>=1.19.0 AND version:<1.19.8) OR (version:>=1.18.0 AND version:<1.18.13) OR (version:>0 AND version:<1.16.24))LinkLink
Microsoft OMI WSMAN Authentication BypassservicesCritical_asset.protocol:wsman AND wsman.productVendor:="Open Management Infrastructure" AND (wsman.productVersion:=0.% or wsman.productVersion:=1.0.% or wsman.productVersion:=1.1.% or wsman.productVersion:1.2.% or wsman.productVersion:=1.3.% or wsman.productVersion:=1.4.% or wsman.productVersion:=1.5.% or wsman.productVersion:=1.6.0-% or wsman.productVersion:=1.6.1-% or wsman.productVersion:=1.6.2-% or wsman.productVersion:=1.6.3-% or wsman.productVersion:=1.6.4-% or wsman.productVersion:=1.6.5-% or wsman.productVersion:=1.6.6-% or wsman.productVersion:=1.6.7-% or wsman.productVersion:=1.6.8-0)LinkLink
Multiple Fortinet Products Buffer OverflowassetsCriticalhw:="Fortinet%" AND type:="SIP Gateway" AND ((osversion:="7.2.0") OR (osversion:>"7.0.0" AND osversion:<"7.0.7") OR (osversion:>="6.4.0" AND osversion:<"6.4.11"))LinkLink
PHP 8.1.0 < 8.1.29 Multiple VulnerabilitiessoftwareCriticalos:"Windows" AND _asset.products:apache AND product:PHP AND (version:>8.1 AND version:<8.1.29)LinkLink
PHP 8.2.0 < 8.2.20 Multiple VulnerabilitiessoftwareCriticalos:"Windows" AND _asset.products:apache AND product:PHP AND (version:>8.2 AND version:<8.2.20)LinkLink
PHP 8.3.0 < 8.3.8 Multiple VulnerabilitiessoftwareCriticalos:"Windows" AND _asset.products:apache AND product:PHP AND (version:>8.3 AND version:<8.3.8)LinkLink
Palo Alto Networks PAN-OS Authentication BypassassetsCriticalos:="Palo Alto Networks PAN-OS" AND (osversion:>"11.1.6-h1" AND osversion:<11.2.4-h4) AND (osversion:>"10.2.13-h3" AND osversion:<11.1.6-h1) AND (osversion:>"10.1.14-h9" AND osversion:<"10.2.13-h3") AND (osversion:>"10.1.0" AND osversion:<"10.1.14-h9")LinkLink
Plesk Panel 9.0.X < 9.2.3 Remote Code ExecutionsoftwareCriticalnot os:Windows AND vendor:=parallels AND product:=plesk AND (version:>9.0.0 AND version:<9.5.4)LinkLink
Rejetto HTTP File Server 2 Remote Code ExecutionsoftwareCriticalvendor:Rejetto AND product:"HTTP File Server" AND version:>0 AND version:<3LinkLink
Rejetto HTTP File Server 2.0 < 2.3M Remote Code ExecutionsoftwareCriticalos:Windows AND vendor:Rejetto AND product:"HTTP File Server" AND version:>=2.0 AND version:<"2.3m" LinkLink
Roundcube Webmail Remote Code ExecutionsoftwareCriticalvendor:=Roundcube AND product:=Webmail AND ((version:>=1.5 AND version:<1.5.10) OR (version:>=1.6 AND version:<1.6.11))LinkLink
SonicWall SMA1000 < 12.4.3 Remote Code ExecutionassetsCriticalhw:="SonicWall SMA1000" AND (osversion:>0 AND osversion:<12.4.3)LinkLink
SonicWall SSLVPN Authentication Bypass (CVE-2024-53704)assetsCriticalos:SonicOS AND ( (osversion:>"6.0" AND osversion:<"6.5.5.1-6n") OR (osversion:>"7.0" AND osversion:<"7.0.1-5165") OR (osversion:>"7.1" AND osversion:<"7.1.3-7015") OR (hw:TZ80 AND osversion:>"8.0" AND osversion:<"8.0.0-8037"))LinkLink
VMware vCenter Server 7.0 < 7.0 U3t / 8.0 < 8.0 U3d Multiple VulnerabilitiessoftwareCriticalvendor:vmware AND (product:"vcenter server" OR product:"cloud foundation") AND ((version:>7.0 AND version:<"7.0.3 build-24322018") OR (version:>8.0 AND version:<"8.0.3 build-24322831"))LinkLink
Apache Tomcat 10.1.0-M1 < 10.1.43 Multiple VulnerabilitiessoftwareHighproduct:Tomcat AND (version:>10.1.0-M1 AND version:<10.1.43)LinkLink
Apache Tomcat 10.1.0-M1 < 10.1.44 HTTP/2 MadeYouReset DoSsoftwareHighproduct:Tomcat AND (version:>10.1.0-M1 AND version:<10.1.44)LinkLink
Apache Tomcat 11.0.0-M1 < 11.0.10 Multiple VulnerabilitiessoftwareHighproduct:Tomcat AND (version:>11.0.0-M1 AND version:<11.0.10)LinkLink
Apache Tomcat 11.0.0-M1 < 11.0.9 Multiple VulnerabilitiessoftwareHighproduct:Tomcat AND (version:>11.0.0-M1 AND version:<11.0.9)LinkLink
Apache Tomcat 9.0.0-M1 < 9.0.107 Multiple VulnerabilitiessoftwareHighproduct:Tomcat AND (version:>9.0.0-M1 AND version:<9.0.107)LinkLink
Apache Tomcat 9.0.0-M1 < 9.0.108 HTTP/2 MadeYouReset DoSsoftwareHighproduct:Tomcat AND (version:>9.0.0-M1 AND version:<9.0.108)LinkLink
Apache Tomcat Partial PUT Deserialization VulnerabilitysoftwareHigh_asset.products:"Tomcat" AND product:"Tomcat" AND ((version:>=11.0.0 AND version:<11.0.3) OR (version:>=10.1.0 AND version:<10.1.35) OR (version:>=9.0.0 AND version:<9.0.99))LinkLink
Apple tvOS < 11.4 Multiple VulnerabilitiesassetsHighos:"Apple tvOS" AND osversion:>0 AND osversion:<11.4LinkLink
Apple tvOS < 13.3.1 Multiple VulnerabilitiesassetsHighos:"Apple tvOS" AND osversion:>0 AND osversion:<13.3.1LinkLink
Apple tvOS < 15.2 Multiple VulnerabilitiesassetsHighos:"Apple tvOS" AND osversion:>0 AND osversion:<15.2LinkLink
Atlassian Confluence 5.2 < 7.19.22 Remote Code ExecutionsoftwareHighvendor:=Atlassian AND product:Confluence AND (version:>=5.2 AND version:<7.19.22)LinkLink
Cisco ConfD SSH Server Remote Code ExecutionsoftwareHighvendor:="Cisco" AND product:="ConfD" AND ( (version:>"7.0.0.0" AND version:<"7.7.19.1") OR (version:>"8.0.0.0" AND version:<"8.0.17.1") OR (version:>"8.1.0.0" AND version:<"8.1.16.2") OR (version:>"8.2.0.0" AND version:<"8.2.11.1") OR (version:>"8.3.0.0" AND version:<"8.3.8.1") OR (version:>"8.4.0.0" AND version:<"8.4.4.1"))LinkLink
Cisco IOS XE Arbitrary File UploadassetsHighos:="Cisco IOS XE" AND hw:"Catalyst" AND ( (osversion:>="17.7.0" AND osversion:<="17.7.1") OR (osversion:>="17.10.0" AND osversion:<="17.10.1") OR (osversion:>="17.8.0" AND osversion:<="17.8.1") OR (osversion:>="17.9.0" AND osversion:<="17.9.5") OR (osversion:>="17.11.0" AND osversion:<="17.11.1") OR (osversion:>="17.12.0" AND osversion:<="17.2.3") OR (osversion:>="17.13.0" AND osversion:<="17.13.1") OR (osversion:>="17.14.0" AND osversion:<="17.14.1") OR (osversion:>="17.11.0" AND osversion:<="17.11.99") )LinkLink
Commvault Command Center Remote Code ExecutionsoftwareHighvendor:="Commvault" AND product:="Command Center" AND version:>"11.38.0" AND version:<"11.38.20"LinkLink
ConnectWise ScreenConnect < 25.2.4 ViewState Code InjectionsoftwareHighvendor:=ConnectWise AND product:=ScreenConnect AND (version:>0 AND version:<25.2.4)LinkLink
Dell EMC Unity, UnityVSA, And Unity XTassetsHighos:"EMC Unity" AND osversion:>0 AND osversion:<5.5.0.0.0.5.259LinkLink
DrayTek Vigor2960/Vigor300B Command InjectionassetsHigh(hw:"DrayTek Vigor2960" OR hw:"DrayTek Vigor300b" OR hw:"DrayTek Vigor 2960" OR hw:"DrayTek Vigor 300b") AND osversion:>0 AND osversion:<"1.5.1.5"LinkLink
Eclipse Jetty 12.0 < 12.0.25 HTTP/2 MadeYouReset DoSsoftwareHigh(vendor:=Eclipse OR vendor:="Mort Bay") AND product:Jetty AND (version:>12 AND version:<12.0.25)LinkLink
Erlang OTP SSH Server Remote Code ExecutionsoftwareHigh_asset.protocols:ssh AND vendor:="Erlang" AND product:="SSH" AND ((version:>=5.2.0 AND version:<5.2.10) OR (version:>4.0.0.0 AND version:<4.15.3.12) OR (version:>5.1.0.0 AND version:<5.1.4.7))LinkLink
Langflow Authentication BypasssoftwareHigh_asset.protocol:http AND vendor:=Langflow AND product:=Langflow AND (version:>0 AND version:<1.3.0)LinkLink
Lantronix Xport Authentication BypassassetsHighhw:lantronix AND ((os:="Lantronix XPort%" AND not os:="Lantronix XPort Edge%") OR (lantronix.type:="XE" OR lantronix.type:="SE" OR lantronix.type:="AR" OR lantronix.type:="EH"))LinkLink
Multiple Vulnerabilities In Microsoft SQL ServersoftwareHighvendor:=Microsoft AND (product:="SQL Server" OR product:="SQL Server 20%") AND ((version:>=13.0.0 AND version:<13.0.7055.9) OR (version:>=14.0.0 AND version:<14.0.3495.9) OR (version:>=15.0.0 AND version:<15.0.4435.7) OR (version:>=16.0.0 AND version:<16.0.4200.1))LinkLink
SAP NetWeaver Visual Composer Metadata Uploader Arbitrary File UploadsoftwareHighvendor:="SAP" AND product:"NetWeaver" AND (version:>7.0 AND version:<7.55)LinkLink
Samsung MagicINFO Path Traversal VulnerabilitysoftwareHighvendor:="Samsung" AND product:"MagicINFO Server" AND version:>0 AND version:<"21.1052"LinkLink
Solr 5.0.0 < 8.4.0 Remote Code ExecutionsoftwareHighvendor:=Apache AND product:Solr AND (version:>=5.0.0 AND version:<8.4.0)LinkLink
SysAid Help Desk XML Entity Remote Code ExecutionsoftwareHighvendor:="SysAid" AND product:"Help Desk" AND version:>0 AND version:<24.4.60LinkLink
Trimble Cityworks File Deserialization VulnerabilitysoftwareHighvendor:="Trimble" AND product:="Cityworks" AND version:>0 AND version:<"23.10"LinkLink
VMware ESXi OpenSLP Heap Buffer OverflowassetsHighfp.os.product:"ESX" and port:427 and ( fp.os.version:="1.%" or fp.os.version:="2.%" or fp.os.version:="3.%" or fp.os.version:="4.%" or fp.os.version:="5.%" or fp.os.version:="6.0%" or fp.os.version:="6.5.0 build-4564106" or fp.os.version:="6.5.0 build-4887370" or fp.os.version:="6.5.0 build-5146843" or fp.os.version:="6.5.0 build-5146846" or fp.os.version:="6.5.0 build-5224529" or fp.os.version:="6.5.0 build-5310538" or fp.os.version:="6.5.0 build-5969300" or fp.os.version:="6.5.0 build-5969303" or fp.os.version:="6.5.0 build-6765664" or fp.os.version:="6.5.0 build-7273056" or fp.os.version:="6.5.0 build-7388607" or fp.os.version:="6.5.0 build-7967591" or fp.os.version:="6.5.0 build-8285314" or fp.os.version:="6.5.0 build-8294253" or fp.os.version:="6.5.0 build-8935087" or fp.os.version:="6.5.0 build-9298722" or fp.os.version:="6.5.0 build-10175896" or fp.os.version:="6.5.0 build-10390116" or fp.os.version:="6.5.0 build-10719125" or fp.os.version:="6.5.0 build-10868328" or fp.os.version:="6.5.0 build-10884925" or fp.os.version:="6.5.0 build-11925212" or fp.os.version:="6.5.0 build-13004031" or fp.os.version:="6.5.0 build-13635690" or fp.os.version:="6.5.0 build-13873656" or fp.os.version:="6.5.0 build-13932383" or fp.os.version:="6.5.0 build-14320405" or fp.os.version:="6.5.0 build-14874964" or fp.os.version:="6.5.0 build-14990892" or fp.os.version:="6.5.0 build-15256468" or fp.os.version:="6.5.0 build-15177306" or fp.os.version:="6.5.0 build-15256549" or fp.os.version:="6.5.0 build-16207673" or fp.os.version:="6.5.0 build-16389870" or fp.os.version:="6.5.0 build-16576879" or fp.os.version:="6.5.0 build-16576891" or fp.os.version:="6.5.0 build-16901156" or fp.os.version:="6.5.0 build-17097218" or fp.os.version:="6.5.0 build-17167537" or fp.os.version:="6.7.0 build-8169922" or fp.os.version:="6.7.0 build-8941472" or fp.os.version:="6.7.0 build-9214924" or fp.os.version:="6.7.0 build-9484548" or fp.os.version:="6.7.0 build-10176752" or fp.os.version:="6.7.0 build-10176879" or fp.os.version:="6.7.0 build-10302608" or fp.os.version:="6.7.0 build-10764712" or fp.os.version:="6.7.0 build-11675023" or fp.os.version:="6.7.0 build-13004448" or fp.os.version:="6.7.0 build-12986307" or fp.os.version:="6.7.0 build-13006603" or fp.os.version:="6.7.0 build-13473784" or fp.os.version:="6.7.0 build-13644319" or fp.os.version:="6.7.0 build-13981272" or fp.os.version:="6.7.0 build-14141615" or fp.os.version:="6.7.0 build-14320388" or fp.os.version:="6.7.0 build-15018017" or fp.os.version:="6.7.0 build-15160134" or fp.os.version:="6.7.0 build-15160138" or fp.os.version:="6.7.0 build-15999342" or fp.os.version:="6.7.0 build-15820472" or fp.os.version:="6.7.0 build-16075168" or fp.os.version:="6.7.0 build-16316930" or fp.os.version:="6.7.0 build-16701467" or fp.os.version:="6.7.0 build-16713306" or fp.os.version:="6.7.0 build-16773714" or fp.os.version:="6.7.0 build-17167699" or fp.os.version:="6.7.0 build-17098360" or fp.os.version:="6.7.0 build-17167734" or fp.os.version:="7.0.0%" or fp.os.version:="7.0.1 build-16850804" or fp.os.version:="7.0.1 build-17119627" or fp.os.version:="7.0.1 build-17168206" or fp.os.version:="7.0.1 build-17325020") LinkLink
AirPlay SDK Remote Code Execution (AirBorne)softwareMediumvendor:=Apple AND product:="airplay sdk%" AND ((version:>2.0 AND version:<2.7.1) OR (version:>3.0 AND version:<3.6.0.126))LinkLink
GitLab SAML Authentication BypasssoftwareMediumvendor:=GitLab AND product:gitlab AND ((version:>17.9 AND version:<17.9.2) OR (version:>17.8 AND version:<17.8.5) OR (version:>17.7 AND version:<17.7.7))LinkLink
OpenSSH 9.1p1 Double-FreeservicesMedium_asset.protocol:ssh AND protocol:ssh AND (_service.product:="OpenBSD:OpenSSH:9.1" OR _service.product:="OpenBSD:OpenSSH:9.1p1")LinkLink
lighttpd Web Server Out-of-Bounds Memory ReadservicesMediumproduct:lighttpd (_service.product:=lighttpd:lighttpd:1.4.0% OR _service.product:=lighttpd:lighttpd:1.4.1% OR _service.product:=lighttpd:lighttpd:1.4.2% OR _service.product:=lighttpd:lighttpd:1.4.3% OR _service.product:=lighttpd:lighttpd:1.4.4%)LinkLink
Updated