VULNERABILITY

CVE search

Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.

Severity

CriticalHighMediumLowExploited in the wild (KEV)

Language / ecosystem

JavaScript / TypeScript (npm)Python (PyPI)PHP (Packagist)Java / Kotlin (Maven)GoRuby (RubyGems).NET (NuGet)

Stack

JavaScript / Node.js

Next.jsNuxtReactAngularSvelte / SvelteKitAstroRemixViteExpressNestJSFastifyNode.jsaxios

PHP

LaravelSymfonyPHP

Python

DjangoFlaskFastAPI / Starlette

Ruby

Ruby on Rails

Java

Spring

GinFiber

CMS

WordPressWooCommerceDrupalGhostStrapi

Servers & databases

nginxApache HTTP ServerMySQLPostgreSQLRedis

Vendor1

pulsesecureoracleibmgoogleadobemicrosoftmozillaciscoapacheappleredhatjenkinshpAll vendors →

pulsesecure products

pulse connect secure 57pulse policy secure 27pulse secure desktop client 18pulse secure desktop 3virtual traffic manager 3desktop linux client 1odyssey access client 1pulse one on-premise 1pulse secure installer service 1pulse secure security 1secure access series ssl vpn sa-4000 1

402,579 vulnerabilities · 1,766 actively exploited (CISA KEV)

pulsesecure ✕Clear filters

88 results

ID	Severity	Summary	Published
CVE-2016-2408	HIGH7.8	Pulse Secure Desktop before 5.2R2 and Pulse Secure Installer Service before 8.2R2 and below for Windows allow restricted users to gain privileges via unspecified vectors.	02/08/2016
CVE-2016-4791	HIGH8.6	The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to enumerate files, read arbitrary files, and conduct server side request forgery (SSRF) attacks via unspecified vectors.	26/05/2016
CVE-2016-4790	MEDIUM5.5	Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.