Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (17552 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-47222 1 Myoffice 1 My Office Sdk 2025-03-18 9.8 Critical
New Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via manipulation of requests from external document storage via the MS-WOPI protocol.
CVE-2024-41623 2 D3dsecurity, Ezviz 3 D8801, D8801 Firmware, Internet Pt Camera 2025-03-18 9.8 Critical
An issue in D3D Security D3D IP Camera (D8801) v.V9.1.17.1.4-20180428 allows a local attacker to execute arbitrary code via a crafted payload
CVE-2024-29780 1 Google 1 Android 2025-03-18 5.5 Medium
In hwbcc_ns_deprivilege of trusty/user/base/lib/hwbcc/client/hwbcc.c, there is a possible uninitialized stack data disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-47049 1 Czim 1 File-handling 2025-03-18 8.2 High
The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files.
CVE-2024-23091 1 Digitaldruid 1 Hoteldruid 2025-03-18 7.5 High
Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values.
CVE-2023-2019 2 Linux, Redhat 2 Linux Kernel, Enterprise Linux 2025-03-18 4.4 Medium
A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system.
CVE-2021-33949 1 Wms Project 1 Wms 2025-03-18 9.8 Critical
An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function.
CVE-2022-35583 1 Wkhtmltopdf 1 Wkhtmltopdf 2025-03-18 9.8 Critical
wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP address on it's source. This allows the attacker to takeover the whole infrastructure by accessing their internal assets.
CVE-2023-49109 1 Apache 1 Dolphinscheduler 2025-03-18 9.8 Critical
Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
CVE-2023-24078 1 Realtimelogic 1 Fuguhub 2025-03-18 8.8 High
Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/.
CVE-2024-31807 1 Totolink 2 Ex200, Ex200 Firmware 2025-03-18 9.8 Critical
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in the NTPSyncWithHost function.
CVE-2023-0877 1 Froxlor 1 Froxlor 2025-03-18 8.8 High
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.
CVE-2024-43202 1 Apache 1 Dolphinscheduler 2025-03-18 9.8 Critical
Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.
CVE-2021-26277 2 Google, Vivo 2 Android, Frame Service 2025-03-18 5.6 Medium
The framework service handles pendingIntent incorrectly, allowing a malicious application with certain privileges to perform privileged actions.
CVE-2024-29785 1 Google 1 Android 2025-03-18 5.5 Medium
In aur_get_state of aurora.c, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-24114 1 Typecho 1 Typecho 2025-03-18 9.8 Critical
typecho 1.1/17.10.30 was discovered to contain a remote code execution (RCE) vulnerability via install.php.
CVE-2022-3843 1 Wago 2 852-111\/000-001, 852-111\/000-001 Firmware 2025-03-18 9.1 Critical
In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters.
CVE-2023-26092 1 Puzzle 1 Liima 2025-03-17 9.8 Critical
Liima before 1.17.28 allows server-side template injection.
CVE-2022-37938 1 Hpe 1 Serviceguard For Linux 2025-03-17 9.8 Critical
Unauthenticated server side request forgery in HPE Serviceguard Manager
CVE-2024-47197 1 Apache 1 Maven Archetype 2025-03-17 7.5 High
Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recommended to upgrade to version 3.3.0, which fixes the issue. Archetype integration testing creates a file called ./target/classes/archetype-it/archetype-settings.xml This file contains all the content from the users ~/.m2/settings.xml file, which often contains information they do not want to publish. We expect that on many developer machines, this also contains credentials. When the user runs mvn verify again (without a mvn clean), this file becomes part of the final artifact. If a developer were to publish this into Maven Central or any other remote repository (whether as a release or a snapshot) their credentials would be published without them knowing.