Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (337207 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-49218 1 Recently Project 1 Recently 2024-10-16 9.8 Critical
Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently allows Object Injection.This issue affects Recently: from n/a through 1.1.
CVE-2024-49216 1 Joshua Clayton 1 Feed Comments Number 2024-10-16 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Joshua Clayton Feed Comments Number allows Upload a Web Shell to a Web Server.This issue affects Feed Comments Number: from n/a through 0.2.1.
CVE-2024-48042 1 Supsystic 1 Contact Form 2024-10-16 9.1 Critical
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Supsystic Contact Form by Supsystic allows Command Injection.This issue affects Contact Form by Supsystic: from n/a through 1.7.28.
CVE-2024-48035 1 Takayukiimanishi 1 Acf Images Search And Insert 2024-10-16 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Takayuki Imanishi ACF Images Search And Insert allows Upload a Web Shell to a Web Server.This issue affects ACF Images Search And Insert: from n/a through 1.1.4.
CVE-2024-48030 1 Gabriele Valenti 1 Telecash Ricaricaweb 2024-10-16 9.8 Critical
Deserialization of Untrusted Data vulnerability in Gabriele Valenti Telecash Ricaricaweb allows Object Injection.This issue affects Telecash Ricaricaweb: from n/a through 2.2.
CVE-2024-48028 1 Boyan Raichev 1 Ip Loc8 2024-10-16 9.8 Critical
Deserialization of Untrusted Data vulnerability in Boyan Raichev IP Loc8 allows Object Injection.This issue affects IP Loc8: from n/a through 1.1.
CVE-2024-47351 1 Thecssigniterteam 1 Maxslider 2024-10-16 7.5 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The CSSIgniter Team MaxSlider allows Path Traversal.This issue affects MaxSlider: from n/a through 1.2.3.
CVE-2024-48026 1 Grayson Robbins 1 Disc Golf Manager 2024-10-16 9.8 Critical
Deserialization of Untrusted Data vulnerability in Grayson Robbins Disc Golf Manager allows Object Injection.This issue affects Disc Golf Manager: from n/a through 1.0.0.
CVE-2020-36839 2024-10-16 8.3 High
The WP Lead Plus X plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.99. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform administrative actions, such as adding pages to the site and/or replacing site content with malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2024-49247 1 Oc2ps 1 Better-bp-registration 2024-10-16 9.8 Critical
: Authentication Bypass Using an Alternate Path or Channel vulnerability in sooskriszta, webforza BuddyPress Better Registration allows : Authentication Bypass.This issue affects BuddyPress Better Registration: from n/a through 1.6.
CVE-2024-48034 1 Fliperr Team 1 Creates 3d Flipbook Pdf Flipbook 2024-10-16 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Fliperrr Team Creates 3D Flipbook, PDF Flipbook allows Upload a Web Shell to a Web Server.This issue affects Creates 3D Flipbook, PDF Flipbook: from n/a through 1.2.
CVE-2024-48027 1 Xaraartech 1 External Featured Image From Bing 2024-10-16 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in xaraartech External featured image from bing allows Upload a Web Shell to a Web Server.This issue affects External featured image from bing: from n/a through 1.0.2.
CVE-2023-32193 1 Rancher 1 Norman 2024-10-16 8.3 High
A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.
CVE-2023-32191 1 Suse 1 Rke 2024-10-16 9.9 Critical
When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin.
CVE-2023-32196 1 Rancher 1 Rancher 2024-10-16 6.6 Medium
A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific scenarios can lead to privilege escalation.
CVE-2024-49253 1 James Park 1 Analyse Uploads 2024-10-16 8.6 High
Relative Path Traversal vulnerability in James Park Analyse Uploads allows Relative Path Traversal.This issue affects Analyse Uploads: from n/a through 0.5.
CVE-2024-47649 1 Thatplugin 1 Iconize 2024-10-16 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in THATplugin Iconize.This issue affects Iconize: from n/a through 1.2.4.
CVE-2024-47637 1 Litespeed Technologies 1 Litespeed Cache 2024-10-16 8.8 High
: Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through 6.4.1.
CVE-2024-49260 1 Limb 1 Limb Image Gallery 2024-10-16 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Limb WordPress Gallery Plugin – Limb Image Gallery allows Code Injection.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through 1.5.7.
CVE-2024-8921 2024-10-16 6.4 Medium
The Zita Elementor Site Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.