Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (328323 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-25170 1 Jupo 1 Mezzanine 2025-04-28 9.1 Critical
An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.
CVE-2024-26342 1 Asus 3 4g-ac68u, 4g-ac68u Firmware, Ac68u 2025-04-28 7.5 High
A Null pointer dereference in usr/sbin/httpd in ASUS AC68U 3.0.0.4.384.82230 allows remote attackers to trigger DoS via network packet.
CVE-2023-51533 1 Lightspeedhq 1 Ecwid Ecommerce Shopping Cart 2025-04-28 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart.This issue affects Ecwid Ecommerce Shopping Cart: from n/a through 6.12.4.
CVE-2023-52048 1 Ruoyi 1 Ruoyi 2025-04-28 4.7 Medium
RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/.
CVE-2024-24714 1 Bplugins 1 Icons Font Loader 2025-04-28 7.2 High
Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4.
CVE-2025-0632 2025-04-28 N/A
Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise. This issue affects Rock Maker Web: from 3.2.1.1 and later
CVE-2023-28746 1 Redhat 2 Enterprise Linux, Rhel Eus 2025-04-26 6.5 Medium
Information exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2025-22228 1 Redhat 2 Apache Camel Spring Boot, Ocp Tools 2025-04-25 7.4 High
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
CVE-2024-6096 1 Progress 1 Telerik Reporting 2025-04-25 8.8 High
In Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vulnerability.
CVE-2024-10846 2025-04-25 5.9 Medium
The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included
CVE-2018-5733 4 Canonical, Debian, Isc and 1 more 9 Ubuntu Linux, Debian Linux, Dhcp and 6 more 2025-04-25 7.5 High
A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0.
CVE-2022-45535 1 Aerocms Project 1 Aerocms 2025-04-25 4.9 Medium
AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the edit parameter at \admin\categories.php. This vulnerability allows attackers to access database information.
CVE-2022-45529 1 Aerocms Project 1 Aerocms 2025-04-25 4.9 Medium
AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the post_category_id parameter at \admin\includes\edit_post.php. This vulnerability allows attackers to access database information.
CVE-2022-45331 1 Aerocms Project 1 Aerocms 2025-04-25 7.5 High
AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the p_id parameter at \post.php. This vulnerability allows attackers to access database information.
CVE-2022-45330 1 Aerocms Project 1 Aerocms 2025-04-25 7.5 High
AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Category parameter at \category.php. This vulnerability allows attackers to access database information.
CVE-2022-44808 1 Dlink 2 Dir-823g, Dir-823g Firmware 2025-04-25 9.8 Critical
A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to execute arbitrary operating system commands through well-designed /HNAP1 requests. Before the HNAP API function can process the request, the system function executes an untrusted command that triggers the vulnerability.
CVE-2022-44252 1 Totolink 2 Lr350, Lr350 Firmware 2025-04-25 9.8 Critical
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function.
CVE-2022-44251 1 Totolink 2 Lr350, Lr350 Firmware 2025-04-25 9.8 Critical
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function.
CVE-2022-44250 1 Totolink 2 Lr350, Lr350 Firmware 2025-04-25 9.8 Critical
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg function.
CVE-2022-44249 1 Totolink 2 Lr350, Lr350 Firmware 2025-04-25 9.8 Critical
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function.