Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (367815 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-38755 1 Busybox 1 Busybox 2026-07-20 2.9 Low
A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-16088 1 Halo 1 Halo 2026-07-20 4.7 Medium
A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVE-2024-30095 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-07-20 7.8 High
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30094 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-07-20 7.8 High
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30093 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-07-20 7.3 High
Windows Storage Elevation of Privilege Vulnerability
CVE-2024-30091 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-07-20 7.8 High
Win32k Elevation of Privilege Vulnerability
CVE-2024-30090 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-07-20 7 High
Microsoft Streaming Service Elevation of Privilege Vulnerability
CVE-2024-30087 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-07-20 7.8 High
Win32k Elevation of Privilege Vulnerability
CVE-2024-30084 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-07-20 7 High
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2024-30063 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-07-20 6.7 Medium
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
CVE-2024-35250 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-07-20 7.8 High
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2024-30082 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-07-20 7.8 High
Win32k Elevation of Privilege Vulnerability
CVE-2024-30080 1 Microsoft 22 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 19 more 2026-07-20 9.8 Critical
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2024-30078 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2026-07-20 8.8 High
Windows Wi-Fi Driver Remote Code Execution Vulnerability
CVE-2024-30077 1 Microsoft 24 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 21 more 2026-07-20 8 High
Windows OLE Remote Code Execution Vulnerability
CVE-2024-30075 1 Microsoft 3 Windows Server 2008, Windows Server 2008 R2, Windows Server 2008 Sp2 2026-07-20 8 High
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
CVE-2024-30074 1 Microsoft 3 Windows Server 2008, Windows Server 2008 R2, Windows Server 2008 Sp2 2026-07-20 8 High
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
CVE-2026-38754 1 Busybox 1 Busybox 2026-07-20 5.1 Medium
A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-28220 2026-07-20 8.4 High
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API (DAPI) handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the master node deserialize an attacker-controlled callable and execute it under an attacker-controlled RBAC context. The cluster code in `framework/wazuh/core/cluster/common.py` deserializes JSON with `as_wazuh_object()`, which resolves any callable whose top-level package is wazuh or api (an overly broad allowlist controlled only by `ALLOWED_CALLABLES_PACKAGES`), and DAPI requests handled in framework/wazuh/core/cluster/dapi/dapi.py accept a client-supplied rbac_permissions value that `run_local()` applies as the global RBAC context, so supplying an rbac_mode of black causes authorization checks for expose_resources-protected functions to pass without any legitimate permission assignment. Combined, these allow privileged administrative actions on the master node such as arbitrary file writes under WAZUH_PATH, creation of new API users, and tampering with security.yaml, and can be chained into full manager compromise. This issue has been fixed in version 4.14.5.
CVE-2026-6793 2026-07-20 5.4 Medium
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allows Stored XSS. This issue affects Q-smart NexT Poll: before 1.8.7.