Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (376177 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-38745 2 Apache, Redhat 2 Openoffice, Enterprise Linux 2025-02-13 7.8 High
Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.
CVE-2023-26513 1 Apache 1 Sling Resource Merger 2025-02-13 7.5 High
Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before 1.4.2.
CVE-2022-35797 1 Microsoft 2 Windows 10, Windows 11 2025-02-13 6.1 Medium
Windows Hello Security Feature Bypass Vulnerability
CVE-2022-35795 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-02-13 7.8 High
Windows Error Reporting Service Elevation of Privilege Vulnerability
CVE-2022-35794 1 Microsoft 5 Windows 10, Windows 11, Windows Server 2016 and 2 more 2025-02-13 8.1 High
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2023-25213 1 Tenda 2 Ac5, Ac5 Firmware 2025-02-12 9.8 Critical
Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the check_param_changed function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
CVE-2023-26820 1 Siteproxy Project 1 Siteproxy 2025-02-12 7.5 High
siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js.
CVE-2023-26817 1 Pgyer 1 Codefever 2025-02-12 8.8 High
codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the component /controllers/api/user.php.
CVE-2023-25220 1 Tenda 2 Ac5, Ac5 Firmware 2025-02-12 9.8 Critical
Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the add_white_node function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
CVE-2023-25219 1 Tenda 2 Ac5, Ac5 Firmware 2025-02-12 9.8 Critical
Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the fromDhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
CVE-2023-25218 1 Tenda 2 Ac5, Ac5 Firmware 2025-02-12 9.8 Critical
Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the form_fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
CVE-2023-25217 1 Tenda 2 Ac5, Ac5 Firmware 2025-02-12 9.8 Critical
Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the formWifiBasicSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
CVE-2023-25216 1 Tenda 2 Ac5, Ac5 Firmware 2025-02-12 9.8 Critical
Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the formSetFirewallCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
CVE-2023-25215 1 Tenda 2 Ac5, Ac5 Firmware 2025-02-12 9.8 Critical
Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the saveParentControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
CVE-2023-25214 1 Tenda 2 Ac5, Ac5 Firmware 2025-02-12 9.8 Critical
Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the setSchedWifi function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
CVE-2021-26077 1 Atlassian 1 Connect Spring Boot 2025-02-12 9.1 Critical
Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions 1.1.0 before 2.1.3 and versions 2.1.4 before 2.1.5 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
CVE-2021-26074 1 Atlassian 1 Connect Spring Boot 2025-02-12 6.5 Medium
Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions from version 1.1.0 before version 2.1.3 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
CVE-2021-26073 1 Atlassian 1 Connect Express 2025-02-12 7.7 High
Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Express versions from 3.0.2 before 6.6.0 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
CVE-2020-29445 1 Atlassian 1 Confluence Server 2025-02-12 4.3 Medium
Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters.
CVE-2020-29444 1 Atlassian 2 Confluence Data Center, Confluence Server 2025-02-12 5.4 Medium
Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters.