Search

Expected end of text, found '.' (at char 41), (line:1, col:42)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (324440 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-66377 1 Pexip 1 Infinity 2025-12-26 7.5 High
Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access to execute code on one node within a Pexip Infinity installation) to impact the operation of other nodes within the installation.
CVE-2025-66378 1 Pexip 1 Infinity 2025-12-26 5.9 Medium
Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP streams traversing a Proxy Node.
CVE-2025-2406 2025-12-26 7.6 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Trizbi allows Cross-Site Scripting (XSS).This issue affects Trizbi: before 2.144.4.
CVE-2025-2307 2025-12-26 7.6 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Aidango allows Cross-Site Scripting (XSS).This issue affects Aidango: before 2.144.4.
CVE-2025-68935 1 Onlyoffice 1 Document Server 2025-12-26 6.4 Medium
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
CVE-2025-68936 1 Onlyoffice 1 Document Server 2025-12-26 6.4 Medium
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
CVE-2025-14913 2025-12-26 5.3 Medium
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to an incorrect authorization check on the 'media_delete_action' function in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to delete arbitrary attachments.
CVE-2025-68937 1 Forgejo 1 Forgejo 2025-12-26 9.9 Critical
Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for template repositories. This is also fixed for 11 LTS in 11.0.7 and later.
CVE-2025-68938 1 Gitea 1 Gitea 2025-12-26 4.3 Medium
Gitea before 1.25.2 mishandles authorization for deletion of releases.
CVE-2025-68939 1 Gitea 1 Gitea 2025-12-26 8.2 High
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
CVE-2025-68940 1 Gitea 1 Gitea 2025-12-26 3.1 Low
In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.
CVE-2025-68945 1 Gitea 1 Gitea 2025-12-26 5.8 Medium
In Gitea before 1.21.2, an anonymous user can visit a private user's project.
CVE-2025-68946 1 Gitea 1 Gitea 2025-12-26 5.4 Medium
In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
CVE-2025-52600 2025-12-26 N/A
Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerability in camera video analytics that Improper input validation. This vulnerability could allow an attacker to execute specific commands on the user's host PC.The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
CVE-2025-1721 1 Ibm 1 Concert 2025-12-26 5.9 Medium
IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.
CVE-2025-56087 1 Ruijie 2 Rg-bcr600w, Rg-bcr600w Firmware 2025-12-26 8.8 High
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the run_tcpdump in file /usr/lib/lua/luci/controller/admin/common_tcpdump.lua.
CVE-2025-56107 1 Ruijie 2 Rg-bcr600w, Rg-bcr600w Firmware 2025-12-26 8.8 High
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the submit_wifi in file /usr/lib/lua/luci/controller/admin/common_quick_config.lua.
CVE-2025-56096 1 Ruijie 2 Rg-bcr600w, Rg-bcr600w Firmware 2025-12-26 8.8 High
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the restart_modules in file /usr/lib/lua/luci/controller/admin/common.lua.
CVE-2025-12771 1 Ibm 1 Concert 2025-12-26 7.8 High
IBM Concert 1.0.0 through 2.1.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
CVE-2025-56082 1 Ruijie 2 Rg-bcr600w, Rg-bcr600w Firmware 2025-12-26 8.8 High
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the check_changes in file /usr/lib/lua/luci/controller/admin/common.lua.