Export limit exceeded: 421438 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 421438 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 421438 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 421438 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (46876 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-53726 1 Microsoft 28 Server, Windows, Windows 10 and 25 more 2026-02-26 7.8 High
Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
CVE-2025-47954 1 Microsoft 2 Sql Server, Sql Server 2022 2026-02-26 8.8 High
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-53739 1 Microsoft 15 365, 365 Apps, Excel and 12 more 2026-02-26 7.8 High
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-50155 1 Microsoft 26 Server, Windows, Windows 10 1507 and 23 more 2026-02-26 7.8 High
Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
CVE-2025-55145 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2026-02-26 8.9 High
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker to hijack existing HTML5 connections.
CVE-2025-55141 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2026-02-26 8.8 High
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
CVE-2025-55142 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2026-02-26 8.8 High
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
CVE-2025-53808 1 Microsoft 24 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 21 more 2026-02-26 6.7 Medium
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
CVE-2025-54109 1 Microsoft 24 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 21 more 2026-02-26 6.7 Medium
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
CVE-2025-54207 3 Adobe, Apple, Microsoft 3 Indesign, Macos, Windows 2026-02-26 7.8 High
InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-58462 2 Opexus, Opexustech 2 Foiaxpress Pal, Foiaxpress Public Access Link 2026-02-26 9.8 Critical
OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database.
CVE-2025-27240 1 Zabbix 1 Zabbix 2026-02-26 7.2 High
A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.
CVE-2025-36120 1 Ibm 1 Storage Virtualize 2026-02-26 8.8 High
IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization checks to access resources.
CVE-2025-57729 1 Jetbrains 1 Intellij Idea 2026-02-26 6.5 Medium
In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start
CVE-2025-38743 1 Dell 2 Emc Idrac Service Module, Idrac Service Module 2026-02-26 7.8 High
Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of privileges.
CVE-2025-8354 1 Autodesk 2 Revit, Revit Lt 2026-02-26 7.8 High
A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVE-2025-55230 1 Microsoft 28 Windows, Windows 10, Windows 10 1507 and 25 more 2026-02-26 7.8 High
Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally.
CVE-2025-26496 4 Linux, Microsoft, Salesforce and 1 more 6 Linux, Windows, Tableau Desktop and 3 more 2026-02-26 9.3 Critical
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVE-2025-36157 1 Ibm 1 Jazz Foundation 2026-02-26 9.8 Critical
IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.
CVE-2025-36565 1 Dell 3 Data Domain Operating System, Powerprotect Data Domain, Powerprotect Dd 2026-02-26 6.7 Medium
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution. Exploitation may allow privilege escalation to root.